# The Network and Information Systems Regulations 2018, Regulation 25: Review and report

Extent: E+W+S+N.I.

(1) The Secretary of State must—
(a) carry out a review of the regulatory provision contained in these Regulations and in EU Regulation 2018/151; and
(b) publish a report setting out the conclusions of that review.
(2) The first report must be published on or before 9th May 2020 , the second report must be published on or before 9th May 2022 and subsequent reports must be published at intervals not exceeding five years.
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) Section 30(4) of the Small Business, Enterprise and Employment Act 2015 requires that reports published under this regulation must, in particular—
(a) set out the objectives intended to be achieved by the regulatory provision referred to in paragraph (1)(a);
(b) assess the extent to which those objectives are achieved;
(c) assess whether those objectives remain appropriate; and
(d) if those objectives remain appropriate, assess the extent to which they could be achieved in another way which involves less onerous regulatory provision.
(5) In this regulation “regulatory provision” has the same meaning as in sections 28 to 32 of that Act.

---
Source: https://www.legislation.gov.uk/uksi/2018/506/regulation/25 (the official version)
Page: https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-25
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.