# The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020, Note: Explanatory note

Extent: E+W+S+N.I.

(This note is not part of the Regulations)
The Network and Information Systems Regulations 2018 (S.I. 2018/506) (“the 2018 Regulations”), as amended by the Network and Information Systems (Amendment) Regulations 2018 (S.I. 2018/629), implement Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the European Union (O.J. L 194, 19.7.2016, p. 1). These Regulations further amend the 2018 Regulations as follows.
Regulation 4 amends regulation 6 to extend the scope of the provision relating to the sharing of information by enforcement authorities.
Regulation 5 amends regulation 8 to make provision for the circumstances in which a person identified under that regulation as an operator of essential services (“OES”) has reasonable grounds to believe that they no longer meet the conditions for deemed or actual designation as an OES.
Regulation 6 inserts a new regulation (regulation 8A) in relation to an OES who has their head office outside the United Kingdom. It requires such an OES, or sets out the circumstances in which such an OES is required, to nominate a person to act on their behalf in the United Kingdom and makes further provision relating to that nomination.
Regulations 5, 7 to 11 and 14 make or include amendments to notice provisions to provide that they must be in writing.
Regulation 11 amends the provision in regulation 15 which sets out the purposes for which a competent authority designated under regulation 3(1) may serve an information notice upon an OES, corrects a drafting error in that regulation (by omitting paragraph (4)) and inserts a provision requiring compliance with information notices. Regulation 12 amends regulation 16 broadening the powers of inspection by, or initiated by, a NIS enforcement authority, that is, a designated competent authority (in relation to an OES) or the Information Commissioner (in relation to a relevant digital service provider (“RDSP”), as defined in regulation 1(3)(e)). Regulation 13 amends regulation 17 to extend the circumstances in which a NIS enforcement authority may serve an enforcement notice on an OES or RDSP for breaches of their duties under the 2018 Regulations. Regulation 14 amends regulation 18 so that it provides for the circumstances in which a NIS enforcement authority may serve a notice of intention to impose a penalty (rather than a penalty notice) and includes further new provision in relation to the imposition of penalties.
Regulation 15 removes the provisions (regulation 19) relating to the independent review of a decision to designate an OES or a penalty decision against an OES or RDSP. Regulation 16 inserts new regulations which provide for the circumstances in which an OES or RDSP may appeal to the First-tier Tribunal against a decision of a NIS enforcement authority (regulation 19A), how the Tribunal must determine the appeal (regulation 19B) and the circumstances in which a NIS enforcement authority may commence civil proceedings against an OES or RDSP (regulation A20).
Regulation 19 amends regulation 25 so that it provides that after the next report containing the Secretary of State’s conclusions of a review of the 2018 Regulations (to be published on or before 9th May 2022) subsequent reports must be published at intervals not exceeding five years (rather than biennially).
Regulation 20 amends the threshold requirements for qualification as an OES (for the purposes of regulation 8) in the oil, gas, healthcare (in Scotland) and digital infrastructure subsectors.
Regulation 21 makes transitional and saving provision for any request for an independent review of a decision under regulation 19 made before these Regulations come into force and makes new provision for appeals to the First-tier Tribunal.
An impact assessment for the 2018 Regulations has been produced by the Department for Digital, Culture, Media and Sport and is published alongside that instrument on www.legislation.gov.uk. A further impact assessment has not been produced for this instrument as no further significant impact on the private, and no impact on the voluntary, sector is foreseen.
An Explanatory Memorandum is published alongside this instrument at www.legislation.gov.uk.
The Directive referred to above is published at http://eur-lex.europa.eu.

---
Source: https://www.legislation.gov.uk/uksi/2020/1245/note (the official version)
Page: https://openlegislation.uk/network-and-information-systems-amendment-and-transitional-provision-etc-regulations-2020/note
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.