Managed Service Providers, Data Centres, and Designated Critical Suppliers

The draft Bill expands regulatory scope to cover managed service providers, data centres, and suppliers that may be designated as critical.

The concentration theme is the largest in this database. The largest healthcare breach of 2025 happened at a company with no patients, at 25-0801. Seventy-four banks were exposed through one analytics vendor at 25-0814. Nineteen organisations’ staff directories sat in a procurement platform at 25-0613. Thousands of retailers lost deliveries because a distributor could not invoice, at 25-0606.

In every one, the regulated, notifying, publicly accountable entity was not the entity that failed. Extending scope to the dependency is the only structural answer, and this is the first time this corpus has recorded a general regime attempting it.

"Managed service provider" and "data centre" are definable categories. "Critical supplier" is a designation somebody has to make, about a specific company, in advance of the incident that would demonstrate criticality.

Nothing in this corpus suggests that is easy. Marquis was a data analytics vendor. Chain IQ handled procurement. Neither would appear on any prospective list of critical national suppliers, and both are exactly the kind of organisation whose failure this provision is meant to reach.

Criticality in this database is emergent — it comes from how many organisations happen to depend on you, which is not a property visible from the outside and frequently not known to the supplier itself.

A designation regime that depends on a regulator guessing correctly will always trail the market. One that requires regulated entities to declare their dependencies would produce the map from the other direction — from the parties who actually know.

That is a heavier obligation and, on this desk’s reading of the corpus, the only version likely to catch the next Marquis before rather than after. Whether the Bill does that is a detail of the regime this desk cannot assess from a draft.