Do any duties under the Cyber Security and Resilience Bill apply to any organisation by 27 November 2026?
BinaryResolves 27 Nov 2026
History1 of 4
Hunch17%
Your forecast
Yes
No
Resolves 27 Nov 2026
How this resolves
The market resolves on legislation.gov.uk, the commencement instruments made under the Act. It resolves YES if a commencement instrument published on legislation.gov.uk brings any duty on any organisation into force on or before 23:59 GMT on 27 November 2026. Assent alone does not count, nor does a duty on the Secretary of State or a regulator to consult. If that source has not published in time, the GOV.UK Cyber Security and Resilience Bill collection page and bills.parliament.uk settle it.
The pattern behind it
3 of 4
Three of the last four British digital and network-security laws applied to nobody on the day they were made. The Telecommunications (Security) Act 2021 needed commencement regulations in 2022, the Online Safety Act 2023 was phased in through Ofcom codes rather than switched on at once, and the Data (Use and Access) Act 2025 was still being commenced by a sixth instrument in 2026. The exception is the Network and Information Systems Regulations 2018, which came into force on a date written into the instrument itself and remain the operative regime. The full record is the same four cases, 2018 to 2026.
Three of the last four UK digital laws applied to no one at first. We looked at the last four UK laws on network security, online services and data, and asked when their duties first applied to anyone. Three passed and then waited for further rules before any duty began. Only the 2018 regulations, which the current Bill updates, started on a date written into them.
Some cookies are essential for Hunch to work properly. Others are optional—you decide whether to allow them. We don’t sell your personal data. Learn more and change your choices at any time in Cookie settings.