The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019

Explanatory Note

(This note is not part of the Regulations)

These Regulations are made in exercise of the powers conferred by section 8(1) of the European Union (Withdrawal) Act 2018 (c. 16) in order to address failures of retained EU law to operate effectively and other deficiencies (in particular under paragraphs (a), (b), (c), (d) and (g) of section 8(2)) which apply to this instrument arising from the withdrawal of the UK from the European Union.

Part 1 amends the Network and Information Systems Regulations 2018 (S.I. 2018/506) (the NIS Regulations) and Part 2 amends Commission Implementing Regulation (EU) 2018/151 (OJ No L 26, 31.1.2018, p. 48) as retained by the European Union (Withdrawal) Act 2018 (the Act) and revokes Regulation (EU) No 526/2013 concerning the European Union Agency for Network and Information Security (ENISA) and repealing Regulation (EC) No 460/2004 (the ENISA Regulation)(OJ L165, 18.6.2013, p.41) as retained by the Act.

The NIS Regulations place obligations on GCHQ and the NIS enforcement authorities (the Information Commissioner and the competent authorities which regulate the operators of essential services) to liaise, consult, co-operate and share information with certain EU bodies. The obligations derive from Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union (the NIS Directive)(OJ No L194, 19.7.2016, p.1). The UK will no longer be a Member State following the UK's withdrawal from the EU and it will therefore no longer be appropriate to require these bodies to carry out these functions. These Regulations therefore amend the NIS Regulations so as to remove those obligations whilst retaining the ability of these bodies to continue to exercise those functions if required. These amendments are necessary in order to remove these deficient provisions from the UK statute book.

Regulation 2 of the NIS Regulations is amended so as to remove the obligation on UK ministers to communicate the NIS national strategy to the Commission. These amendments are necessary in order to remove these deficient provisions from the UK statute book.

Commission Implementing Regulation (EU) 2018/151 is amended so as to remove references to EU based services providers and to convert from Euros into sterling. These amendments are necessary in order to remove these deficient provisions from the UK statute book.

The ENISA Regulation is being revoked because it establishes and confers functions upon the European Union Agency for Network and Information Security (ENISA), which is an EU body. The Regulation is retained by the Act and cannot operate to have any effect in UK law. It is therefore being revoked so as to remove it from the UK statute book.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private or voluntary sector is foreseen.

An Explanatory Memorandum is published alongside the instrument at www.legislation.gov.uk.

The EU instruments referred to above are published at http://eur-lex.europa.eu.