Skip to main content

Ireland

NIS2 in Ireland: where things stand and how to prepare

The obligations of the NIS2 Directive are known, and the National Cyber Security Centre has published guidance to prepare for them. Here is what they involve, and the technical work that can start now.

Transposition in Ireland

The NIS2 Directive (Directive (EU) 2022/2555) had to be transposed by Member States by 17 October 2024. The Irish transposing law is the National Cyber Security Bill.

On 8 July 2026, the European Commission referred Ireland, together with Spain, France and the Netherlands, to the Court of Justice of the European Union for failing to notify full transposition of NIS2, and asked the Court to impose a lump sum and daily penalty payments until transposition is complete.

According to the NCSC, the legislation transposing the first NIS Directive (NIS1) remains in effect and covers the most critical operators, and the NIS2 registration and incident reporting portals will be available once the national legislation is in place. The state of the legislation can change: always check the NCSC's own page before taking a decision.

What NIS2 asks of organisations in scope

NIS2 covers 18 critical sectors, including health, energy, transport, digital infrastructure and the public sector, and distinguishes essential entities from important entities. As a general rule, it applies to medium-sized and large organisations in those sectors, with some exceptions regardless of size. The Directive's requirements are fixed; national law sets how they are supervised and enforced. The core obligations are:

  • Risk management measures (Article 21): risk analysis and information security policies, incident handling, business continuity and backup management, supply chain security, secure acquisition and maintenance of systems, vulnerability handling, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication where appropriate.

  • Incident reporting (Article 23): an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month.

  • Management accountability (Article 20): management bodies approve the risk management measures, oversee their implementation and follow training.

  • Penalties (Article 34): the Directive requires maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities.

Preparing now: the NCSC’s guidance and Cyber Fundamentals

Organisations do not have to wait for the national law to start. In June 2025, the NCSC published draft Risk Management Measures guidance and announced the Cyber Fundamentals (CyFun) framework, as a structured route to the measures NIS2 requires. Both are available from the NCSC's NIS2 page.

If you are not in scope yourself

Many Irish SMEs will not be essential or important entities. They will still feel NIS2 through their customers: supply chain security is one of the Article 21 measures, so in-scope organisations will ask their suppliers and service providers for evidence of their own security. Questionnaires, contract clauses and audits are the usual form it takes.

For a small business, the practical answer is the same as for an in-scope entity, at a smaller scale: know your accounts and devices, keep systems updated, test your backups, and be able to show it.

How we can help

We are an independent IT service provider established in France, working remotely with Irish businesses. We help with the technical side of NIS2 preparation:

  • a gap review of your systems against the Article 21 measures and the NCSC’s Risk Management Measures, with a prioritised plan;

  • an Active Directory audit covering access control, privileged accounts and password policies;

  • Microsoft 365 and Intune set-up: device compliance, conditional access and update policies, with periodic reviews;

  • an IT audit that checks backups, asset inventory and weak points, the basis of business continuity;

  • cybersecurity awareness training for staff and management;

  • IT project management to coordinate a compliance programme across several suppliers.

What we do not do

We give no legal advice and do not determine whether your organisation is in scope: that assessment belongs to you and your advisers, with the NCSC’s tools. We are not a certification or conformity assessment body, and we make no promise of compliance.

We also do not provide round-the-clock monitoring or incident response. Reporting a significant incident within 24 hours requires people who watch your systems continuously; that is an ongoing service we exclude, and a role for your in-house team or a local provider. We can help you prepare the procedure and the evidence it relies on.

To talk about your situation, contact us or see our pricing.

Frequently asked questions

Where does NIS2 stand in Ireland?

On 8 July 2026, the European Commission referred Ireland to the Court of Justice of the EU for failing to notify full transposition of NIS2. The Directive's obligations are known, and the NCSC's NIS2 page gives the current state of the Irish legislation and its guidance to prepare.

We are a small business. Does NIS2 concern us?

Possibly not directly, as NIS2 mainly targets medium-sized and large organisations in its sectors. But if your customers are in scope, they will ask you about your security as part of their supply chain obligations.

Can you handle our incident reporting?

No. We do not provide continuous monitoring or incident response. We can help you prepare the procedure, the inventory and the technical measures your team or provider will rely on.

Let’s talk about your project

Describe your context: you will receive a first reply, with no commitment.

Discuss your project

Sources

Official texts consulted in September 2026:

Services·See pricing·Discuss your project
Call
Email us