Question

To ask His Majesty's Government why no full impact assessment was prepared for the revised Telecommunications Security Code of Practice 2026.

The Telecommunications Security Code of Practice provides technical guidance for public telecoms providers on how they can comply with their security requirements as set out in the Telecommunications (Security) Act 2021 and the Electronic Communications (Security Measures) Regulations 2022.

A full impact assessment was carried out for the telecoms security framework when it came into effect in 2022. The estimated cost of the framework on Tier 1 and Tier 2 public telecoms providers was assessed in the frameworks impact assessment (The Electronic Communications (Security Measures) Regulations 2022).

A full Regulatory Impact Assessment was not prepared for the revised Code of Practice. The revised Code provides additional guidance on how public telecommunications providers may demonstrate compliance with existing statutory security duties under the Act. The updates to the Code do not introduce new statutory duties or regulatory requirements and do not constitute a regulatory provision under the Better Regulation Framework.

An assessment on the costs to industry of the proposed updates to the Code was carried out, details of which are included in the explanatory memorandum. Indicative estimates suggest potential one-off implementation costs in the order of £1.9 million to £3.2 million per provider, with ongoing annual costs of approximately £285,000 to £445,000 per provider. When considered in the context of the scale and revenues of the UK telecommunications sector, the Government considers these costs to be relatively minor.