The current regime sits on three statutory layers and one strategic layer. The first statutory layer is the NIS Regulations 2018, which translated EU Directive 2016/1148 into UK law and imposed security and incident-notification duties on operators of essential services (OES) in five regulated sectors plus relevant digital service providers (RDSPs). The second layer is SI 2020/1245, which extensively amended NIS 2018 on IP completion day. The most consequential changes are (i) a new reg. 8A requiring non-UK OES to nominate a UK representative — anchoring jurisdiction post-Brexit; (ii) a substantially broader inspection regime in reg. 16 that gives competent authorities and the Information Commissioner entry, production, removal, testing and 'any other action reasonably required' powers; (iii) a more procedural enforcement architecture (pre-notice representations, separate intention-to-penalise notice, payment of penalty independent of compliance with enforcement notice); and (iv) replacement of the independent reviewer with a First-tier Tribunal appeal on judicial-review grounds and a parallel civil-enforcement route.
The third statutory layer is sector-specific carve-out. Reg. 8(1A) (inserted by SI 2020/1245) disapplies NIS from telecoms network and service providers who are within scope of ss.105A–105C Communications Act 2003 — meaning the Telecommunications Security Regulations 2022 / Ofcom code of practice route, and not NIS, governs public networks. Consumer connectable products run on a separate track under Part 1 of the PSTI Act 2022, with s.70 of that Act still uncommenced. This layered carve-out matters because the Cyber Security and Resilience Bill (introduced November 2025) keeps the same architectural model — extending NIS rather than collapsing the regimes — and the Keeling schedules show the Bill amending NIS 2018, not replacing the telecoms or PSTI regimes.
The strategic layer is the National Cyber Strategy 2022 (and its 2016–21 predecessor), the 2022 Cyber Security Incentives and Regulation Review, and the modular Cyber Security Codes of Practice. These do not create duties of their own but they (a) provide the policy steer for which sectors should next be brought into scope under the Bill (data centres, managed service providers, designated critical suppliers); (b) furnish the voluntary stick-and-carrot — Cyber Essentials, the Software Vendors Code, the AI and App Store Codes, the Cyber Governance Code — which feeds into procurement and insurance leverage; and (c) underpin programmes like Cyber Local, the Software Security Ambassadors Scheme and LORCA.
What the regime cannot do is regulate state-actor cyber operations, criminal investigation responses, or consumer data protection beyond product-security — those sit under separate regimes (military, law enforcement, UK GDPR). It also cannot reach pure supply-chain risk except through (i) the Bill's proposed designated critical supplier route; (ii) procurement and insurance pressure flowing from Cyber Essentials; and (iii) the voluntary software vendors code. The accountability and remedies architecture is therefore mixed: hard regulatory enforcement on OES/RDSPs (penalties up to £17m, FtT appeals), softer code-of-practice expectations on the wider tech and software ecosystem, and product-level CE-style requirements on consumer IoT.
For analysts, the live points of doctrinal tension are: scope creep through the Bill versus regulator capacity at NCSC, the Information Commissioner and sector regulators; the boundary between the Cyber Security and Resilience Bill (NIS expansion) and the parallel telecoms / consumer-product regimes; and the absence of statutory incentives (tax, insurance) despite the McPartland Review's growth framing.