UK Cyber Security & Resilience Bill — MSP + data-centre readiness

A new UK Bill at committee stage in the 2025-26 parliamentary session. It updates the Network and Information Systems Regulations 2018 (UK NIS) to bring managed service providers (MSPs) and data centres into scope, expand the regulator's powers, and standardise incident reporting timelines.

Managed service providers (MSPs) — IT outsourcing, managed security, managed cloud. Data centres above a threshold. Some critical digital infrastructure operators not previously in NIS. The exact threshold + scope wording is still moving in committee.

Phased: initial notification within 24 hours of becoming aware of a significant incident, full report within 72 hours. Mirrors EU NIS2 Article 23 timelines. Designated Critical Operations require additional reports to relevant sector regulators.

Phased implementation expected from 2026 onward, contingent on Royal Assent and statutory instruments. Current estimate: substantive obligations from 2027 with grace periods for new in-scope entities.

We're scaffolding a meok-uk-csr-readiness MCP based on the existing meok-nis2-de-register-mcp codebase. Same evidence-pack pattern: entity classifier + register payload + signed compliance attestation. Available to early customers — email nicholas@meok.ai for early access.