- Latest available (Revised)
- Original (As made)
There are currently no known outstanding effects for the The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019, SCHEDULE.
Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.
Regulation 2
1. The NIS Regulations are amended as follows.U.K.
Commencement Information
I1Sch. para. 1 in force at 20.1.2021, see reg. 1(2)
2. In regulation 1, after the definition of “the Commission”, insert—U.K.
““EU Regulation 2018/151” means Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact.”.
Commencement Information
I2Sch. para. 2 in force at 20.1.2021, see reg. 1(2)
3. In regulation 2—U.K.
(a)omit paragraph (6);
(b)in paragraph (7), omit “or communicating it to the Commission”.
Commencement Information
I3Sch. para. 3 in force at 20.1.2021, see reg. 1(2)
4. In regulation 3(3)—U.K.
(a)in subparagraph (c), omit “, including an indication of the importance of each operator in relation to the subsector in relation to which it provides an essential service”;
(b)omit subparagraph (g)(ii);
(c)after paragraph (3), insert—
“(3A) In relation to the subsector for which it is designated under paragraph (1), the competent authority may consult and co-operate with a public authority in the EU if it is in the interests of effective regulation of that subsector (whether inside or outside the United Kingdom).”.
Commencement Information
I4Sch. para. 4 in force at 20.1.2021, see reg. 1(2)
5. In regulation 4—U.K.
(a)for paragraph (2), substitute—
“(2) The SPOC may liaise with the relevant authorities in any Member State of the EU, the Cooperation Group and the CSIRTs network if it considers it appropriate.”;
(b)after paragraph (2), insert—
“(2A) The SPOC must—
(a)consult and co-operate, as it considers appropriate, with relevant law enforcement authorities;
(b)co-operate with the NIS enforcement authorities to enable the enforcement authorities to fulfil their obligations under these Regulations.”;
(c)in paragraph (3)—
(i)in words before sub-paragraph (a), for “must”, substitute “ may, if it considers it appropriate to do so ”;
(ii)in subparagraph (b), omit “, indicating their importance in relation to that sector”;
(d)omit paragraphs (4) and (5).
Commencement Information
I5Sch. para. 5 in force at 20.1.2021, see reg. 1(2)
6. In regulation 5—U.K.
(a)in paragraph (2), omit subparagraph (e);
(b)for paragraph (3) substitute—
“(3) The CSIRT may co-operate with or participate in international co-operation networks (including the CSIRTs network) if the CSIRT considers it appropriate to do so.”.
Commencement Information
I6Sch. para. 6 in force at 20.1.2021, see reg. 1(2)
7. In regulation 6—U.K.
(a)in paragraph (1), for “the Commission and the relevant authorities in other Member States”, substitute “ and public authorities in the EU ”;
(b)in paragraph (2), for “the Commission or the relevant authorities in other Member States” substitute “ a public authority in the EU ”.
Commencement Information
I7Sch. para. 7 in force at 20.1.2021, see reg. 1(2)
8. Omit regulation 8(7).U.K.
Commencement Information
I8Sch. para. 8 in force at 20.1.2021, see reg. 1(2)
9. Omit regulation 9(5).U.K.
Commencement Information
I9Sch. para. 9 in force at 20.1.2021, see reg. 1(2)
10. For regulation 11(6) substitute—U.K.
“(6) After receipt of the NIS incident information under paragraph (5)(b), and based on that information, the CSIRT may inform the relevant authorities in a Member State if the CSIRT considers that the incident has a significant impact on the continuity of an essential service provision in that Member State.”.
Commencement Information
I10Sch. para. 10 in force at 20.1.2021, see reg. 1(2)
11. In regulation 12—U.K.
(a)in paragraph (1), for “European Union” substitute “ United Kingdom ”;
(b)omit [F1paragraph (10)];
(c)in paragraph (11), for “paragraph (10)”, substitute “ these Regulations ”;
(d)in paragraph (14), in the opening words, for “another Member State” substitute “ a Member State of the EU ”;
(e)omit paragraph (17).
Textual Amendments
F1Words in Sch. para. 11(b) substituted (20.1.2021) by The Network and Information Systems (Amendment etc.) (EU Exit) (No. 2) Regulations 2019 (S.I. 2019/1444), regs. 1(2), 4; 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I11Sch. para. 11 in force at 20.1.2021, see reg. 1(2)
12. For regulation 13 substitute—U.K.
13. The Information Commissioner may give information and assistance to, and otherwise co-operate with, a public authority in the EU if the Information Commissioner considers that to do so would be in the interests of effective supervision of digital service providers (whether inside or outside the United Kingdom), including in the event of an incident notified under regulation 12(3).”.
Commencement Information
I12Sch. para. 12 in force at 20.1.2021, see reg. 1(2)
13. In regulation 25—U.K.
(a)in paragraph (1)(a), after “these Regulations” insert “ and in EU Regulation 2018/151 ”;
(b)omit paragraph (3).
Commencement Information
I13Sch. para. 13 in force at 20.1.2021, see reg. 1(2)
14.—(1) Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact is amended as follows.
(2) For “digital service provider”, in each place it occurs, substitute “ RDSP ”.
(3) For “digital service providers”, in each place it occurs, substitute “ RDSPs ”.
(4) After Article 1, insert—
In this Regulation—
“NIS Regulations” means the Network and Information Systems Regulations 2018;
“RDSP” has the same meaning as in the NIS Regulations.”.
(5) In Article 2—
(a)In paragraph 1, for “point (a) of Article 16(1) of Directive (EU) 2016/1148” substitute “ regulation 12(2)(c)(i) of the NIS Regulations ”;
(b)in paragraph 2, for “point (b) of Article 16(1) of Directive (EU) 2016/1148” substitute “ regulation 12(2)(c)(ii) of the NIS Regulations ”;
(c)in paragraph 3, for “point (c) of Article 16(1) of Directive (EU) 2016/1148” substitute “ regulation 12(2)(c)(iii) of the NIS Regulations ”;
(d)in paragraph 4, for “point (d) of Article 16(1) of Directive (EU) 2016/1148” substitute “ regulation 12(2)(c)(iv) of the NIS Regulations ”;
(e)in paragraph 5, for “point (e) of Article 16(1) of Directive (EU) 2016/1148” substitute “ regulation 12(2)(c)(v) of the NIS Regulations ”.
(6) In Article 3—
(a)in paragraph 1, for “point (a) of Article 16(4) of Directive (EU) 2016/1148” substitute “ regulation 12(7)(a)(i) of the NIS Regulations ”;
(b)in paragraph 2, for “point (b) of Article 16(4) of Directive (EU) 2016/1148” substitute “ regulation 12(7)(a)(ii) of the NIS Regulations ”;
(c)in paragraph 3—
(i)for “point (c) of Article 16(4) of Directive (EU) 2016/1148” substitute “ regulation 12(7)(a)(iii) of the NIS Regulations ”;
(ii)after “Member States”, insert “ of the EU ”;
(d)in paragraph 4, for “point (d) of Article 16(4) of Directive (EU) 2016/1148” substitute “ regulation 12(7)(a)(iv) of the NIS Regulations ”;
(e)in paragraph 5, for “point (e) of Article 16(4) of Directive (EU) 2016/1148” substitute “ regulation 12(7)(a)(v) of the NIS Regulations ”.
(7) In Article 4—
(a)in paragraph 1—
(i)in point (a), before “Union” insert “ European ”;
(ii)in point (b), before “Union” insert “ European ”;
(iii)for point (d)—
(aa)before “Union” insert “ European ”;
(bb)for “EUR 1000 000” substitute “ £880,000 ”;
(b)omit paragraph 2.
(8) After Article 5, omit the words from “This Regulation” to “Member States.”.
Commencement Information
I14Sch. para. 14 in force at 20.1.2021, see reg. 1(2)
15. Regulation (EU) No 526/2013 of the European Parliament and of the Council of 21 May 2013 concerning the European Union Agency for Network and Information Security (ENISA) and repealing Regulation (EC) No 460/2004 is revoked.
Commencement Information
I15Sch. para. 15 in force at 20.1.2021, see reg. 1(2)
16. In Annex 11 of the EEA Agreement, so far as it forms part of domestic law on and after exit day by virtue of section 3(1) of the European Union (Withdrawal) Act 2018, point 5cp is revoked insofar as it is retained EU law.
Commencement Information
I16Sch. para. 16 in force at 20.1.2021, see reg. 1(2)
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Explanatory Memorandum sets out a brief statement of the purpose of a Statutory Instrument and provides information about its policy objective and policy implications. They aim to make the Statutory Instrument accessible to readers who are not legally qualified and accompany any Statutory Instrument or Draft Statutory Instrument laid before Parliament from June 2004 onwards.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: