In February 2026, the Legislation, Justice and Constitution Committee submitted its report on the Welsh Government’s Legislative Consent Memorandum on the Cyber Security and Resilience (Network and Information Systems) Bill. This is the Welsh Government’s response.

 

Introduction

The Cyber Security and Resilience (Network and Information Systems) Bill makes updates to the UK’s only cross-sector cyber regulations, the Network and Information Systems Regulations 2018 (S.I. 2018/506) (“NIS Regulations”), as well as delivering new powers with the aim of ensuring government can respond to new and emerging cyber threats.

The Bill will update the NIS Regulations by bringing more entities into their scope and equipping regulators with powers with the aim of better fulfilling their duties. The Bill includes powers to amend and add to the NIS Regulations in the future and respond to imminent and actual threats to UK national security. These reforms are intended to better protect the services and other activities that are essential to the day-to-day functioning of society in the UK, and the economy, through safeguarding relevant network and information systems (the systems that allow computers and other devices to communicate with each other) and their surrounding environment.

I thank the members of the Legislation Justice and Constitution Committee for their report on the Cyber Security and Resilience (Network and Information Systems) Bill Legislative Consent Memorandum and have set out my response to the report below.

 

 

Response to the Report

It is good to see that the Committee agrees with the Welsh Government’s assessment, as set out in the LCM, regarding the provision within the Bill which requires the consent of the Senedd, in accordance with Standing Order 29. I thank the members of the Committee for their assessment of the Welsh Government’s LCM for this Bill.