NIS 2 status in Ireland
What the Directive requires, where Ireland stands on transposition, and who carries supervision in the interim.
Overview
The NIS 2 Directive sits at the EU level. It binds every Member State, Ireland included, to a single floor of obligations for essential and important entities. Ireland has to translate that floor into Irish law and stand up supervision under it.
Ireland missed the transposition deadline of 17 October 2024. The General Scheme of the National Cyber Security Bill 2024 was published on 30 August 2024. As of early October 2026 no National Cyber Security Bill has been introduced in the Oireachtas. On 8 July 2026 the European Commission referred Ireland, together with Spain, France and the Netherlands, to the Court of Justice of the EU and asked the Court to impose a lump sum and daily penalties until Ireland notifies full transposition. Until the Act is in force, Ireland's NIS 1 transposition (the European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018, S.I. No. 360/2018) continues to apply.
The National Cyber Security Centre (NCSC-IE) is the national CSIRT. Under the General Scheme it is to become the lead competent authority and single point of contact for NIS 2, next to sector competent authorities: the CRU for energy, drinking water and waste water, ComReg for digital infrastructure, ICT service management, space and digital providers, the Central Bank of Ireland for banking and financial market infrastructure (where DORA applies as lex specialis), and further authorities for transport and health. Since 1 June 2025 the NCSC and the NIS functions belong to the Department of Justice, Home Affairs and Migration, which took them over from the Department of the Environment, Climate and Communications.
EU Directive
Directive (EU) 2022/2555 (NIS 2)
The EU cybersecurity directive. It sets the obligations every Member State must transpose, including the size and sector test for essential and important entities. It applies to Ireland regardless of the state of national transposition.
EU implementing act
Implementing Regulation (EU) 2024/2690
Technical and methodological requirements for DNS providers, TLD registries, cloud, data centre and CDN providers, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers. Directly applicable in Ireland, no national transposition needed.
Irish transposition
General Scheme of the National Cyber Security Bill 2024 (draft); until enactment: S.I. No. 360/2018 (NIS 1)
The government approved priority drafting on 24 July 2024 and published the General Scheme on 30 August 2024. No bill has been introduced in the Oireachtas yet. The bill and the secondary regulations that follow will carry the operational detail. Until then, the NIS 1 transposition remains in force, supplemented by NCSC-IE guidance.
National Cyber Security Bill
Will bring NIS 2 obligations into Irish law, define essential and important entities, set out supervisory and enforcement powers and anchor incident reporting. Operational detail will be filled in by secondary regulations and NCSC-IE guidance. Today: Heads of Bill published, final text not yet enacted.
NCSC-IE as lead competent authority
The National Cyber Security Centre is the national CSIRT (CSIRT-IE). Under the General Scheme it is to become the lead competent authority and single point of contact for NIS 2, with sector regulators such as the CRU, ComReg and the Central Bank as competent authorities for their sectors. It already publishes preparatory guidance, including the draft Risk Management Measures guidance from June 2025, and references the Belgian CyFun framework as a practical baseline.
Registration and reporting
By 17 April 2025 each Member State had to establish its list of essential and important entities (Art. 3(3) NIS 2). Ireland has no such legal basis yet, and the registration and incident reporting portals open only once the Act is in force. Significant incidents will then follow the Directive: early warning within 24 hours, incident notification within 72 hours, final report within one month.
On Irish territory, Irish law applies
Activity on Irish territory follows the Irish transposition. A German managing director with an Irish subsidiary reads the upcoming National Cyber Security Act for that subsidiary, and the 2018 NIS 1 Regulations in the meantime, not the German BSIG. The directive obligations are identical. Procedures, portals and penalties live in Irish law.
Ireland cannot fall below the EU floor
The Directive is minimum harmonisation. Ireland may go stricter. Ireland cannot fall below the Directive, not on the duties of essential and important entities, not on reporting deadlines, not on management body accountability. Until Ireland transposes, the Directive's duties do not bind Irish companies directly. Once the Act is in force, it cannot set a lower bar than the Directive.
NCSC-IE
National Cyber Security Centre. National CSIRT (CSIRT-IE), and under the General Scheme the future lead competent authority and single point of contact for NIS 2. Publishes preparatory guidance, will open the registration and reporting portals once the Act is in force, and coordinates with ENISA and other Member States.
Department of Justice, Home Affairs and Migration
Lead department for the transposition. On 1 June 2025 the government moved the cyber security functions, including those under the NIS 1 Regulations (S.I. No. 360/2018), from the Department of the Environment, Climate and Communications to the Department of Justice (S.I. No. 234/2025). The NCSC is an operational arm of this department. The General Scheme of the National Cyber Security Bill 2024 is published; the bill itself has not yet been introduced in the Oireachtas.
ENISA
The EU cybersecurity agency. Publishes guidance, operates the European vulnerability database and coordinates across borders. Not a supervisor for Irish entities. Under the General Scheme that role will sit with NCSC-IE and the sector competent authorities once the Act is in force.
Until Ireland transposes, German rules apply, because our parent sits in Germany.
No. NIS 2 follows the establishment principle. An Irish subsidiary is regulated in Ireland, a German one in Germany. The German parent may support the Irish subsidiary internally, the legal duty to register, report and supervise sits with the Irish entity and runs to NCSC-IE once the Act is in force. Until then, NIS 1 (S.I. No. 360/2018) governs for the sectors already covered.
As long as the portal is not live, I do not have to do anything.
The NIS 2 duties to register and report reach an Irish company only through the Irish Act, which is not yet in force. Until then, NIS 1 (S.I. No. 360/2018) applies to operators of essential services already designated under it. Preparing still pays off: risk management, an incident process, supply chain clauses and management body training take months to set up, and the Act will set the registration deadline once NCSC-IE opens the portal.
Only the old NIS 1 OES are caught by NIS 2.
No. NIS 2 widens the sector and size catalogue substantially. Operators of Essential Services under NIS 1 are usually still caught under NIS 2, but the perimeter is broader and now distinguishes between essential and important entities. Medium and large entities listed in Annexes I and II of the Directive are in scope, as are some small providers with a particular role, plus parts of the public administration.
Most of the Irish mid-market operators we meet treat NIS 2 like a postponed deadline and wait for the National Cyber Security Bill. Legally that holds for now: a directive binds the State, not the company, so until the Act is in force only the NIS 1 Regulations apply, and only to operators already designated under them. Practically, the work takes months, so whoever starts now meets the Act with the documentation already in place.
The practical step is the same as everywhere in the EU: run the applicability test against the Directive, use the NCSC-IE preparatory guidance (the draft Risk Management Measures, CyFun) as orientation, set up the four continuous duties (keep registration data current, incident reporting, supply chain risk, supervision by the management body) and document the minimum. Once the Act is in force, the remaining work is mostly plugging the finished documentation into the Irish procedures.
- Directive (EU) 2022/2555 (NIS 2): EUR-Lex
- Implementing Regulation (EU) 2024/2690
- General Scheme of the National Cyber Security Bill 2024: Department of Justice, Home Affairs and Migration (gov.ie)
- European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018 (S.I. No. 360/2018): Irish Statute Book
- NCSC-IE: National Cyber Security Centre, NIS 2 status and guidance (ncsc.gov.ie)
- NCSC-IE: Draft Risk Management Measures Guidance (June 2025)
- ComReg: under the General Scheme, competent authority for digital infrastructure, ICT service management, space and digital providers
- Central Bank of Ireland: competent authority for DORA in the financial sector
- S.I. No. 234/2025, Cyber Security (Transfer of Departmental Administration and Ministerial Functions) Order 2025: Irish Statute Book
- European Commission, 8 July 2026: Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice (digital-strategy.ec.europa.eu)
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
