The government can order a vendor's kit removed from critical infrastructure, and never announced the power

The biggest change to the Cyber Security and Resilience Bill since it left the Commons was never announced.

On or around 24 August the government tabled twenty-four amendments inserting a vendor-related directions regime into Part 4. They let the Secretary of State direct an essential service provider to stop using, stop installing, or remove goods, services or facilities supplied by a named third party, where national security requires it.

That is a substantial new power. There was no press release, no written ministerial statement, and nothing published on gov.uk. Ministerial quotes went to three trade outlets instead.

So the only account most people have read is the coverage. I checked three of its claims against the amendments themselves, using the Bills API, because the marshalled list PDF blocks automated fetching.

Three claims, against the text

What was reported, and what was tabled

On disclosure. Coverage said the government "would have no obligation to publicly name a risky supplier before taking action, nor disclose any orders to an affected supplier", and would only publish "higher-level data on any directions imposed in an annual report".

Amendment 151 says the Secretary of State "must publish, in such manner as the Secretary of State considers appropriate, notice of the fact that" a direction has been given, varied or revoked. That notice "must be published as soon as practicable" and must "state the person to which the direction, variation or revocation has been given" and "include a summary of the direction, variation or revocation, its effect and the reasons for it". There is a redaction power where publication might harm commercial interests unreasonably or would be contrary to national security.

So the default is per-direction publication with reasons, not annual aggregation. The half of the claim that survives is different and worth keeping: the person named is the regulated entity receiving the direction, not the vendor. The vendor is not named by default. The coverage reached a roughly right conclusion about vendor anonymity through a wrong description of the regime.

On self-referral. Coverage said "such bodies will also be able to refer themselves for a risk assessment if they have any qualms about a potential supplier."

Amendment 105 is headed "Power to establish mandatory referral scheme", and defines it as a scheme which "requires a person specified or of a description specified in regulations ... to refer the transaction to the Secretary of State". I searched all 193 amendments for "referral" and found three: 104 and 105, both government, and 153 from Viscount Camrose. No voluntary self-referral route exists anywhere in the package.

On procurement guidance. Coverage said the proposals "seek to establish 'cyber-safe' procurement guidance for essential service providers."

The word "procurement" appears in three of the 193 amendments: number 16 from Lord Ravensdale, 83 from Baroness Kidron and 166 from Baroness Ludford. None of them is a government amendment.

What the coverage left out, which matters more

Four safeguards are in the tabled text and in none of the write-ups.

The affirmative procedure. Amendment 102(11): regulations specifying who may be directed "may not be made unless a draft of the instrument has been laid before and approved by a resolution of each House of Parliament". There is an urgency carve-out, but the default is a vote in both Houses. One outlet ran a subheading asking whether the powers are opaque without mentioning this.

A necessity and proportionality test, in 102(4).

Consultation duties, in 102(7) and 105(8), the latter requiring consultation "so far as it is reasonably practicable to do so" before regulations are made.

Extraterritorial reach. A direction may require something to be done "in a place other than the United Kingdom". That is arguably the most significant thing in the package and nobody reported it at all.

What the package actually contains

Amendment	What it does
102	The core power. Directions may prohibit or restrict use of goods, services or facilities, prohibit installation, or require removing, disabling or modifying them. Trigger is a national security risk from a third party’s products. Necessity and proportionality test, consultation duty, affirmative procedure
105	Power to establish a mandatory referral scheme, requiring specified persons to refer qualifying transactions before they proceed. Qualifying transaction defined by regulations, potentially by value, nature, criticality or the identity of the vendor
151	Publication of notice of every direction, as soon as practicable, naming the person directed, with a summary, its effect and the reasons, subject to redaction for commercial interests or national security
152	An annual report to Parliament
101	Confirms that references to the Secretary of State include the Chancellor of the Duchy of Lancaster

The scrutiny question

Set the coverage aside; there is a procedural point that stands on its own.

The only Delegated Powers and Regulatory Reform Committee report on this Bill is its seventh report, of 21 July 2026. That predates these amendments. The government filed a supplementary delegated powers memorandum on 25 August. The Committee has not reported on it. The most recent impact assessment is dated 14 May 2026, so there is none covering this regime either.

A power to order the removal of a named vendor's products from critical national infrastructure reaches Committee today with neither delegated-powers scrutiny nor an impact assessment, having never been announced.

Lord Clement-Jones put it on the record on 1 September: "To drop 65 amendments of this nature on the eve of Committee, which will completely reshape the architecture of this Bill, after its passage through the Commons, is a major challenge to effective parliamentary scrutiny."

The position

The powers themselves are not obviously wrong. Other countries have equivalents, the trigger is national security, and the drafting carries a proportionality test, consultation duties and an affirmative procedure that the coverage missed entirely.

The problem is how they arrived. A twenty-four amendment package that rewires a Part of a Bill after it has cleared the Commons, briefed to three trade outlets, with no announcement, no impact assessment and no delegated-powers report, is a poor way to legislate something this consequential. The predictable result is that the public account of the regime contains at least three errors, and the four safeguards that would most reassure people went unreported.

Publishing the package would have fixed both problems at once.