Is NIS2 law in Ireland yet?

Not as of 5 November 2026. The National Cyber Security Bill that will transpose NIS2 has not yet been published or introduced in the Oireachtas. On 6 October 2026 the Minister for Justice, Home Affairs and Migration said he expects to seek Government approval to publish it shortly and to notify transposition by the end of 2026. Until then, the 2018 NIS Regulations (S.I. No. 360 of 2018) still apply to designated operators of essential services.

What is the NIS2 deadline for Irish companies?

There is no compliance date for Irish companies yet. The EU deadline for Ireland to transpose NIS2 was 17 October 2024 and it was missed, which is why the European Commission referred Ireland to the Court of Justice on 8 July 2026. Registration and reporting dates will be set once the National Cyber Security Bill is enacted, and the Government says it wants to be ready to implement the directive from the day of enactment.

Who do I report a NIS2 incident to in Ireland?

Under the General Scheme, significant incidents go to the CSIRT in the NCSC first, not to your sector regulator. You send an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month of the notification. The NCSC's NIS2 reporting portal opens once the law is enacted; until then, incidents of national concern can be reported to certreport@ncsc.gov.ie.

Does NIS2 apply to small Irish businesses?

Usually not directly. NIS2 applies to medium-sized and large entities in the listed sectors, meaning 50 or more staff, or annual turnover and balance sheet both above €10 million. Some entities are covered regardless of size, such as DNS providers, top-level domain registries, qualified trust service providers and domain registration services. Small suppliers to in-scope companies will still feel it through supply-chain requirements written into their contracts.

All resources

Ireland·5 November 2026·11 min read

NIS2 in Ireland: who it covers, who regulates it, what to do now

As of November 2026, NIS2 is not yet Irish law. Here is where the National Cyber Security Bill stands, who will regulate which sectors, and what Irish companies and MSPs should prepare now.

By Abhishek Singh, Founder of Alexus AI, 12+ years building enterprise IT platforms. First published 5 November 2026.

Is NIS2 law in Ireland?

No. As of 5 November 2026, Ireland has not transposed NIS2 (Directive (EU) 2022/2555) into Irish law. The National Cyber Security Bill, which will transpose it and put the National Cyber Security Centre (NCSC) on a statutory footing, has not yet been published or introduced in the Oireachtas, and the Government says it aims to notify full transposition to the European Commission by the end of 2026.

Until the Bill is enacted, the original NIS Directive, transposed by S.I. No. 360 of 2018, still applies to the operators of essential services and digital service providers already designated under it. There is no NIS2 registration requirement yet: the NCSC says its NIS2 registration and incident reporting portals will open once the legislation is in place.

That is not a reason to wait. The Government has said it wants Ireland ready to implement the directive fully on the day the Bill is enacted. From that day, the duties to manage cyber risk and report incidents attach to whatever processes and records you already have, so the preparation has to happen first.

Where does the National Cyber Security Bill stand?

This is the verified timeline as of November 2026.

July 2024: a Cabinet decision directed priority drafting of the legislation to transpose NIS2.
30 August 2024: the Government published the General Scheme (Heads of Bill) of the National Cyber Security Bill 2024, prepared at the time by the Department of the Environment, Climate and Communications.
17 October 2024: the EU transposition deadline passed. The same day, the Joint Committee on Transport and Communications held pre-legislative scrutiny of the General Scheme, but no report was published before the Dáil was dissolved.
28 November 2024 and 7 May 2025: the European Commission sent Ireland a letter of formal notice and then a reasoned opinion for failing to notify full transposition.
18 February 2026: the Joint Committee on Justice, Home Affairs and Migration published its report on pre-legislative scrutiny of the General Scheme.
8 July 2026: the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU, asking the Court to impose a lump sum and daily penalties until full transposition is notified.
6 October 2026: the Minister for Justice, Home Affairs and Migration told the Dáil that drafting is at a very advanced stage, that he expects to seek Government approval to publish the Bill shortly, and that he aims to notify transposition by the end of 2026.
7 October 2026: the National Cyber Security Strategy 2030 confirmed that the Department of Justice, Home Affairs and Migration is preparing the draft Bill with the Office of the Parliamentary Counsel and the Office of the Attorney General.

What happens next with the Bill?

As of 5 November 2026 there is no National Cyber Security Bill in the Oireachtas bills database. Once the Government approves it, the Bill will be published, debated through the stages in the Dáil and the Seanad, signed into law and then commenced. Registration and reporting dates will be set at that point.

The enacted text can differ from the 2024 General Scheme, so treat the Irish details below as the Government's published intent, not settled law. Ireland is one of four Member States the Commission has taken to court over NIS2; NIS2 by country explains how to check national transposition elsewhere.

Who regulates NIS2 in Ireland?

The NCSC sits at the centre of the Irish model. Under the General Scheme it is the national CSIRT (through CSIRT-IE), the single point of contact with the EU, the lead competent authority that coordinates the other regulators, and the competent authority for every sector not given to a sectoral regulator. The Government approved these sectoral designations in December 2023 (Head 17).

Commission for Regulation of Utilities (CRU): energy, drinking water and waste water.
Commission for Communications Regulation (ComReg): digital infrastructure, ICT service management, space and digital providers.
Central Bank of Ireland: banking and financial market infrastructure.
Irish Aviation Authority: aviation.
Commission for Railway Regulation: rail.
Minister for Transport: maritime transport.
National Transport Authority: road transport.
An agency or agencies under the Minister for Health: health.
NCSC: all other sectors in the directive's annexes, for example postal and courier services, waste management, chemicals, food, manufacturing and research.

Does the NCSC or a sector regulator supervise my company?

The NCSC's NIS2 FAQ adds that the named sectoral regulators will supervise essential entities in their sectors, while the NCSC will be responsible for all other in-scope entities. Check the enacted text before you rely on either reading.

Banks and other financial entities covered by the Digital Operational Resilience Act (DORA) follow DORA's ICT risk-management and incident-reporting rules instead of NIS2's. The directive itself treats DORA as the sector-specific law for financial entities, and in Ireland that work sits with the Central Bank.

Which Irish companies does NIS2 cover?

NIS2 covers public and private entities in the sectors of its Annex I (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space) and Annex II (postal and courier, waste management, chemicals, food, manufacturing, digital providers and research). The Irish General Scheme follows those annexes.

Size: medium-sized and large entities in those sectors are in scope. Under the EU SME definition that means 50 or more staff, or annual turnover and balance sheet total both above €10 million. The NCSC's FAQ explains how to count.
Essential entities: mainly large entities in Annex I sectors (250 or more staff, or turnover above €50 million and balance sheet above €43 million), plus some entities regardless of size. Other in-scope entities are important entities. Both carry the same core duties; essential entities face proactive supervision and higher maximum fines.
Regardless of size: qualified trust service providers, top-level domain name registries, DNS service providers, domain name registration services, and entities identified as critical entities under the Critical Entities Resilience Directive.
Existing operators: operators of essential services designated under the 2018 Regulations will be treated as essential entities (Head 21).
Public bodies: public administration entities are covered, and the General Scheme also proposes that public bodies such as local authorities and universities must report significant incidents to the CSIRT.

How many Irish organisations are in scope?

The National Cyber Security Strategy 2030 estimates that about 4,500 entities will come into scope for supervision and enforcement in Ireland, compared with seven sectors under the original directive.

Cloud, data centre, managed service, online marketplace, search engine and social networking providers fall under the jurisdiction of the Member State where they have their EU main establishment. As a result, Ireland will also supervise many international providers whose EU base is here.

Work through the full test in Does NIS2 apply to my company?, then run the NCSC's Am I in Scope? tool. The NCSC is clear that it will not confirm scope for you: the entity has to make, and record, that judgement.

How will NIS2 incident reporting work in Ireland?

Head 15 of the General Scheme copies Article 23 of the directive closely. Significant incidents are reported to the CSIRT in the NCSC first, rather than to the sectoral regulator, and the CSIRT shares information with the relevant competent authority. The Department's stated reason is that the CSIRT needs the full national picture.

Early warning within 24 hours of becoming aware of a significant incident, saying whether it is suspected to be unlawful or malicious and whether it could have cross-border impact.
Incident notification within 72 hours, updating the early warning with an initial assessment of severity and impact and any indicators of compromise.
An intermediate report if the CSIRT asks for one.
A final report no later than one month after the incident notification, or a progress report at that point if the incident is still being handled.

What counts as a significant incident in Ireland?

The same test as the directive: an incident is significant if it has caused, or could cause, severe operational disruption or financial loss for the entity, or considerable material or non-material damage to other people or organisations. The full rules, including the stricter EU thresholds for cloud and managed service providers, are in our guide to NIS2 Article 23 incident reporting.

Until the NIS2 portal opens, incidents of national concern can be reported to the NCSC at certreport@ncsc.gov.ie, and operators designated under the 2018 Regulations continue to report under those rules.

What are the NIS2 penalties in Ireland?

The General Scheme sets maximum fines at the levels the directive requires. For a breach of the risk-management duties (Head 29) or the reporting duties (Head 15), an essential entity faces up to €10 million or 2% of worldwide turnover, whichever is greater, and an important entity up to €7 million or 1.4%.

Fines would be decided by an independent adjudicator after an investigation by an authorised officer, and take effect only once confirmed by the High Court. Obstructing an authorised officer or giving false or misleading information would be a criminal offence, with a fine of up to €50,000 or up to five years' imprisonment on indictment.

Management boards must approve the risk-management measures, oversee their implementation, complete cyber security training, and can be held liable for infringements (Head 28). The explanatory note says managers can be found personally liable where gross negligence is found after an incident. The NCSC has published guidance on cyber governance for management board members.

When do Irish companies register for NIS2?

Not yet. The NCSC says there is no requirement to register until the legislation is enacted and new dates are published. Under the General Scheme, in-scope entities will give their competent authority their name, address, contact details including IP ranges, sector and subsector, and the Member States where they provide services, and must report changes within two weeks.

Cloud, data centre, content delivery, managed service and managed security service providers, DNS and domain providers, online marketplaces, search engines and social networks register with the NCSC directly. Any in-scope entity can also be asked to name the cloud, data centre, telecoms, managed service and managed security providers and technology vendors behind its essential or important services, so keep that list current.

What should an Irish mid-market company do now?

Our NIS2 overview shows how the Article 20, 21 and 23 duties fit together.

Decide and document your scope: the sector, the size calculation, whether you would be essential or important, the date and who signed it off.
Name an accountable executive and brief the board. Article 20 duties land on the management body, and board training is a requirement.
Measure yourself against the NCSC's draft Risk Management Measures and the CyFun framework, which the NCSC recommends as a structured way to organise and evidence your controls. CyFun is voluntary and is not, by itself, proof of compliance.
Write your incident classification rule and a 24-hour and 72-hour reporting runbook now, addressed to the NCSC's CSIRT.
Build a current inventory of systems, services and dependencies, plus the supplier list the NCSC may ask for.
Start keeping dated evidence: change approvals, access reviews, backup tests and incident records. Evidence cannot be created after the fact.

What should an Irish MSP do now?

Managed service providers and managed security service providers are listed in Annex I under ICT service management (business to business). A medium-sized MSP is likely to be an important entity and a large one an essential entity. The General Scheme names ComReg as the competent authority for ICT service management, and MSPs fall under the Member State of their EU main establishment: where their cyber security risk decisions are mainly taken.

Smaller MSPs below the size thresholds are not directly in scope, but their in-scope clients must manage supply-chain risk under Article 21, so expect security questionnaires, new contract clauses and requests for incident timelines. An MSP that can show each client its own systems, dependencies and incident history, kept separate from other clients, will be able to answer those requests quickly.

How Alexus AI helps

Alexus AI is built in Saggart, Dublin 24, and backed by Enterprise Ireland's New Frontiers programme, so the Irish timeline is the one we follow most closely. It is an operational intelligence platform first: read-only connectors to your cloud, monitoring, ITSM and code tools build one live map of what you run and what depends on what, which SREs, IT operations teams and MSPs use day to day.

The same data produces NIS2 evidence: readiness across all ten Article 21 measures with evidence per measure, an Article 23 clock with draft early warnings, notifications and final reports that a person reviews and submits, a hash-chained audit trail you can verify on demand, and an Article 20 pack for board sign-off. It is EU-hosted, built, and being proven with design partners now. Alexus does not decide your scope or make you compliant; it gives you the operational evidence.

This guide is general guidance, not legal advice. Confirm your position against the Irish legislation once it is enacted.

Frequently asked questions

Is NIS2 law in Ireland yet?: Not as of 5 November 2026. The National Cyber Security Bill that will transpose NIS2 has not yet been published or introduced in the Oireachtas. On 6 October 2026 the Minister for Justice, Home Affairs and Migration said he expects to seek Government approval to publish it shortly and to notify transposition by the end of 2026. Until then, the 2018 NIS Regulations (S.I. No. 360 of 2018) still apply to designated operators of essential services.
What is the NIS2 deadline for Irish companies?: There is no compliance date for Irish companies yet. The EU deadline for Ireland to transpose NIS2 was 17 October 2024 and it was missed, which is why the European Commission referred Ireland to the Court of Justice on 8 July 2026. Registration and reporting dates will be set once the National Cyber Security Bill is enacted, and the Government says it wants to be ready to implement the directive from the day of enactment.
Who regulates NIS2 in Ireland?: The NCSC is the lead competent authority, the national CSIRT and the single point of contact. Under the 2024 General Scheme, sector regulators supervise their own sectors: the CRU for energy and water, ComReg for digital infrastructure, ICT service management, space and digital providers, the Central Bank for banking and financial market infrastructure, and named transport and health bodies. The NCSC covers every other sector. The enacted Bill may change this.
Who do I report a NIS2 incident to in Ireland?: Under the General Scheme, significant incidents go to the CSIRT in the NCSC first, not to your sector regulator. You send an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month of the notification. The NCSC's NIS2 reporting portal opens once the law is enacted; until then, incidents of national concern can be reported to certreport@ncsc.gov.ie.
Does NIS2 apply to small Irish businesses?: Usually not directly. NIS2 applies to medium-sized and large entities in the listed sectors, meaning 50 or more staff, or annual turnover and balance sheet both above €10 million. Some entities are covered regardless of size, such as DNS providers, top-level domain registries, qualified trust service providers and domain registration services. Small suppliers to in-scope companies will still feel it through supply-chain requirements written into their contracts.