The cyber security legislation UK suppliers actually face

Most of the cyber security legislation UK tech firms read about this year will never name them. DORA, NIS2 and the EU AI Act fill the trend lists, and if you're a founder or first security lead at a 50-person supplier planning next year's budget, it's easy to treat each one as your own legal duty. I think that wastes the budget. These laws mostly arrive as clauses in your customers' contracts and questions in their due diligence, on their timetable. The one law likely to name some UK suppliers directly is the Cyber Security and Resilience (CS&R) Bill, and only if you provide managed services.

As of 22 October 2026. I refresh this reading every year.

Why the usual trend list gets this wrong

The usual compliance trend list reads every new EU law as a direct obligation on whoever is reading it. That view is understandable. Some of these laws do reach outside the EU, the fines are large, and nobody wants to be the firm that ignored one. But for a UK supplier of 25 to 100 people, the list sets the wrong priorities.

Take the reach argument seriously first. The EU AI Act does apply to providers placing AI systems on the EU market "irrespective of whether those providers are established or located within the Union or in a third country" (Article 2, Regulation (EU) 2024/1689). If you sell an AI system into the EU, that part is yours.

DORA and NIS2 work differently for most suppliers. DORA binds financial entities. NIS2 binds essential and important entities in EU member states. One exception is worth checking: under Article 26, certain providers based outside the EU that offer services there, including cloud computing and managed service providers, must designate a representative in the EU. If that might be you, take legal advice. For most UK suppliers, what binds you is the contract your regulated customer has to sign with you, and the questionnaire it has to send before it signs. That's a different problem. It runs on your customer's deadline, not the regulator's, and it fails at the deal stage, not in an enforcement notice.

What actually moved this year, read from the supplier side

The year's real movements are a mix of laws now biting through supply chains, one deadline that moved, and one UK Bill now at report stage in the Lords. Here they are in the order I'd read them if I ran a supplier.

DORA: the first full year of contract terms

DORA has applied since 17 January 2025, according to EIOPA. This is its first full year. Two parts of it land on suppliers. Financial entities must keep a register of information covering "all contractual arrangements on the use of ICT services provided by ICT third-party service providers" (Article 28(3)). And Article 30 lists the terms those contracts must contain, including, for services that support critical or important functions, "unrestricted rights of access, inspection and audit" (Regulation (EU) 2022/2554).

On 18 November 2025 the European Supervisory Authorities published the first list of designated critical ICT third-party providers, built from those registers. Those providers now fall under the ESAs' oversight framework. For a small supplier, the register is the part that matters: if you're in it, your customer will want your contract to match Article 30. How those terms flow down to you is covered in our guide to SaaS compliance for B2B tech firms.

NIS2: supply chain security, and a proposal to simplify

Member States had until 17 October 2024 to transpose NIS2 into national law, according to the European Commission. Article 21(2)(d) requires in-scope entities to manage "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Directive (EU) 2022/2555). Article 21(3) asks them to weigh each direct supplier's vulnerabilities and secure development procedures. That is a questionnaire waiting to be sent to you.

On 20 January 2026 the Commission proposed targeted amendments to NIS2 "to increase legal clarity". They are a proposal, not law. Until any amendment is adopted, your customer still has to show it assessed you.

EU AI Act: the deadline moved, the buyer questions didn't

The AI Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the rules for Annex III high-risk AI systems to 2 December 2027, and for Annex I systems to 2 August 2028, according to the Commission's AI Act page. Prohibitions have applied since 2 February 2025, and the Omnibus adds a new one from December 2026.

So the regulator's high-risk dates moved back by a year or more. Your buyer's question didn't. An AI feature that an enterprise customer won't accept without governance evidence blocks the deal today, whatever the Official Journal says about 2027. If AI is in your product, our EU AI Act overview sets out who carries which duty.

ISO/IEC 42001: the shape of AI governance evidence

ISO/IEC 42001:2023 is the management system standard for AI, published by ISO and IEC in December 2023. No law requires it. Its value to a supplier is that it gives the buyer's AI question a recognised, auditable answer, rather than a policy document written the week before the call. If buyers are going to ask for AI governance evidence ahead of the regulator, ISO/IEC 42001 is the form that evidence is most likely to take.

The CS&R Bill: the one that may name you

The CS&R Bill was introduced to Parliament on 12 November 2025 and reforms the NIS Regulations 2018, according to GOV.UK. As of today it is not an Act: the Parliament bill page shows report stage in the Lords set for 26 October 2026.

The Bill would bring medium and large managed service providers into the NIS Regulations. The government's factsheet on relevant managed service providers excludes small and micro enterprises and names the Information Commission as the regulator. The Bill also lets regulators designate critical suppliers to essential and digital services. This is the one law in the set that can put a UK supplier directly in scope, with its own regulator and its own incident reporting.

Where the rest of the year's argument lives

Three other shifts matter, and each has its own piece. Annual audits are giving way to continuous control monitoring. Compliance is becoming an engineered system, with controls written as compliance as code. And the questionnaire is now the main route these laws take to reach you, which is why I'd answer security questionnaires once and reuse the answers.

The strongest objection: we're too small for any of this

The best argument against my reading is proportionality. DORA and NIS2 both scale their demands to size and risk. The CS&R Bill leaves small and micro firms out of its managed service provider duties. A 40-person SaaS company, the argument goes, can reasonably park all of it.

On the CS&R Bill, that's partly right. If you are a small enterprise, the managed service provider duties don't apply to you as drafted, and you should check where you sit rather than assume. Size isn't the whole test, though: the government's factsheet on critical suppliers says small and micro providers can still be designated as critical suppliers if they meet the conditions.

On DORA and NIS2, it misses how the obligation reaches you. Proportionality shapes how much your customer has to do, not whether it has to do it. Your EU clients and critical third-party relationships will ask regardless, and the questionnaire doesn't read the proportionality clause. Being small doesn't take you off your customer's register. It just means you have fewer people to answer it.

What to do about it

Five moves, in order:

1. Map which customers are regulated, and under what. List your top accounts by revenue and note which ones fall under DORA, NIS2, the FCA's operational resilience rules or the AI Act. This list, not the trend list, is your real exposure.
2. Keep one obligations register. One place that records each obligation, which customer or law it comes from, the contract clause, and the evidence that meets it. Without it, every new questionnaire starts from zero.
3. Answer once and reuse. Most questionnaires ask the same things in different words. Build a reviewed answer library and send the same evidence to every customer.
4. Watch the CS&R Bill if you provide managed services. Track Royal Assent and the secondary legislation that follows, and check whether you would count as a medium or large provider.
5. Build evidence that stays current. A control that only gets checked before an audit will be out of date when the next questionnaire arrives. Evidence that refreshes itself is cheaper than evidence you rebuild each time.

The question to ask next year

Most of this year's compliance headlines didn't name your firm, and next year's won't either. The question for your budget isn't which laws apply to you. It's which of your customers are regulated now, and what they will ask you to prove next. Trust is market access infrastructure, and for a supplier it's built one customer contract at a time.

If you want to see where each regime sits in relation to the others, start with our list of compliance frameworks a UK firm needs, and in what order.