NIS2 is not Irish law yet. Here is when it still reaches you.

NIS2 (Directive (EU) 2022/2555) is an EU directive, so each Member State has to pass its own law to bring it in, which is called transposing it. They had to adopt and publish those laws by 17 October 2024 and apply them from 18 October 2024 (Article 41). Ireland did not meet that deadline and has still not transposed it.

The National Cyber Security Centre (NCSC) says so on its own NIS2 page. It says the transposition deadline has not been met and Ireland continues to work through the requirements of the Directive. It also says the older law, NIS1, remains in full effect and covers the most critical operators in the State.

The European Commission sent Ireland a letter of formal notice on 28 November 2024 and a reasoned opinion on 7 May 2025. On 8 July 2026 it decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice for failing to tell it about laws transposing NIS2. The referral asks the Court to impose financial penalties: a lump sum, and daily penalties until the country notifies that NIS2 is fully transposed. The release says most Member States complied.

On 16 September 2026 the Government approved and published its Autumn 2026 Legislation Programme. The National Cyber Security Bill is on its list of 32 Bills for priority publication, and the programme's note against it says work is ongoing. It has been on that list in every programme since spring 2025, six programmes in a row. The autumn 2024 programme had it under priority drafting.

On 7 October 2026 the Minister for Justice, Home Affairs and Migration launched the National Cyber Security Strategy 2030. It says the Department is working with the Office of Parliamentary Counsel and the Attorney General's Office to prepare a draft of the Bill to be brought to Government. That is the stage the Bill is at: a draft still being prepared, not yet brought to Government.

The Oireachtas register of Bills shows the same thing. On 15 October 2026 it held 101 Bills for 2024, 85 for 2025 and 97 for 2026. None of them has cyber, network and information systems, or the Directive's number in its short or long title. No Bill to transpose NIS2 has been introduced in either House.

A directive binds the Member States it is addressed to, not businesses directly. Until Ireland transposes NIS2, the Directive cannot by itself be enforced against an Irish private company.

The Court of Justice said in Faccini Dori in 1994, repeating what it had held consistently since Marshall in 1986, that "a directive cannot of itself impose obligations on an individual and cannot therefore be relied upon as such against an individual".

As at 15 October 2026, no Irish law names a NIS2 regulator (a competent authority) or imposes NIS2's duties to register, to keep systems secure or to report incidents, and there is no NIS2 fine. The NCSC confirms what that means in practice: its NIS2 registration and incident reporting portals are not available, and will be once the legislation is implemented.

One EU law made under NIS2 is already in force. Commission Implementing Regulation (EU) 2024/2690 is a regulation, so it is binding in full and applies directly in every Member State, with no national law needed. It sets the technical detail of the security measures in Article 21(2), and when an incident counts as significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed and managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers (Articles 1 to 3).

But its duties apply to those providers as essential or important entities under Article 3 of the Directive (recital 1). With no Irish law yet naming a regulator or a penalty, it is not settled what it requires of an Irish provider before the Bill is passed. The NCSC tells those providers to read the Implementing Regulation instead of most of its own draft measures (RMM003 to RMM014 and RMM016), and to use its incident criteria instead of RMM015.

Two things work the other way. The State cannot benefit from its own failure to transpose: the Court has recognised that certain provisions of directives may be relied on against the State or State entities. And a court applying national law must read it, as far as possible, in the light of the directive's wording and purpose.

The older law is still in force in Ireland. NIS2 repealed the 2016 Directive from 18 October 2024 (Article 44). But the Irish Regulations made under it, the European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018 (S.I. No. 360 of 2018), have not been revoked. The Irish Statute Book's legislation directory, updated to 6 October 2026, records only a transfer of their functions by S.I. No. 234 of 2025, and the NCSC says NIS1 remains in full effect.

The 2018 Regulations apply to two groups. The first is operators of essential services designated under them. The second is digital service providers that run an online marketplace, an online search engine or a cloud computing service, have their main establishment or a designated representative in Ireland, and are not micro or small enterprises. Regulation 21 still ties those providers' security measures to Implementing Regulation (EU) 2018/151, which the 2024 Implementing Regulation repealed (its Article 15).

A small business outside the listed sectors, and outside the short list of entity types caught at any size, is not in scope. The General Scheme published in 2024 keeps the Directive's size rule (Head 20), although the Bill itself has not been published.

The main rule is about size. NIS2 applies to public or private organisations of a type listed in Annex I or Annex II that are medium-sized or larger under the EU definition in Recommendation 2003/361/EC (Article 2(1)). There are eighteen sectors: eleven highly critical ones in Annex I and seven others in Annex II.

Under that definition a small enterprise employs fewer than 50 people and has an annual turnover "and/or" annual balance sheet total of no more than 10 million euro (Article 2(2) of the Recommendation's Annex). The Commission's user guide, which has no legal force, reads that as a staff test plus one of two financial tests: an enterprise must be under the staff limit, and can go over one of the two financial limits and still count as small.

On that reading a business becomes medium-sized with 50 or more staff, or where both its turnover and its balance sheet total exceed 10 million euro. A thirty-person company with 12 million euro turnover and a 4 million euro balance sheet is still small. Staff are counted in annual work units, so part-time and part-year work counts as a fraction, and owner-managers and partners who work regularly in the business count. Turnover is measured without VAT (Articles 4(1) and 5 of the Annex).

Two details of the definition matter. First, related companies count. A company adds all the staff and figures of a linked enterprise, and a share of a partner enterprise's in proportion to the holding (Article 6(2) of the Annex). Recital 16 of the Directive, which explains the Directive and is not itself a rule, says a Member State can take account of how independent an organisation is of those enterprises, including in the IT systems it uses, and treat it on its own figures where that is appropriate. How Ireland will use that is not yet known. Second, going over a limit changes your status only when it happens in two accounting periods in a row (Article 4(2) of the Annex).

Some organisations are in scope whatever their size. They are: telecoms providers (providers of public electronic communications networks or publicly available electronic communications services), trust service providers, top-level domain name registries and DNS service providers (Article 2(2)(a)); anyone providing domain name registration services (Article 2(4)); and organisations identified as critical under the Critical Entities Resilience Directive (Article 2(3)). Central government public administration is in scope too (Article 2(2)(f)). A Member State can also bring in an organisation of an Annex type at any size, for example where it is the only provider in the State of a service essential to critical societal or economic activities (Article 2(2)(b) to (e)).

Managed IT, cloud and data centre services are not on that list. A managed service provider installs, manages, operates or maintains IT products, networks, infrastructure, applications or other network and information systems for customers, on their premises or remotely. A managed security service provider carries out or assists with cybersecurity risk management (Article 6(39) and (40)). Both are Annex I types (point 9), as are cloud computing and data centre service providers (point 8). For all four, size decides: in scope from medium-sized, out of scope when small or micro unless the State identifies them.

Two of the any-size definitions reach further than their names suggest. A DNS service provider includes anyone providing authoritative domain name resolution (the name servers that answer for a domain) for other people's use (Article 6(20)). A web host or agency that runs the name servers for its clients' domains should read that definition against what it does. Providers of domain name registration services include a registrar's agent, such as a reseller (Article 6(22)).

A registrar or reseller's duties will be in Articles 3(4), 27 and 28. It must give the regulator its details for the national list and for the registry kept by ENISA, the EU cyber security agency. It must report changes within two weeks for the list and within three months for the registry. It must keep accurate and complete registration data, with published policies and checking procedures. It must publish the registration data that is not personal data, and answer lawful requests for access within 72 hours. Annexes I and II do not list domain registration. An organisation that only provides it is therefore neither essential nor important, and the security and incident reporting duties in Articles 21 and 23 do not reach it in that role.

Article 3 sorts in-scope organisations of an Annex type into two classes: essential and important. Qualified trust service providers, TLD name registries and DNS service providers are essential entities whatever their size. A telecoms provider is essential if it is medium-sized or larger, and important if it is small or micro. An Annex I organisation above the medium-sized limits is essential, and so are critical entities, central government public administration and any entity a Member State identifies as essential. Every other in-scope entity of an Annex type is important.

A Member State may also keep the operators of essential services it identified under NIS1 as essential entities (Article 3(1)(g)). The General Scheme would do that for the operators designated under S.I. No. 360 of 2018 (Head 21(1)(g)).

Banking and financial market infrastructures are Annex I sectors that already have their own law in force. The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has applied since 17 January 2025. For financial entities identified as essential or important, it counts as a sector-specific law under Article 4 of NIS2 (DORA, Article 1(2)). Where a sector-specific law's requirements are at least equivalent, the matching NIS2 provisions do not apply (Article 4). The NCSC's draft guidance says it does not apply to financial entities covered by DORA.

The Government's Strategy estimates that about 4,500 entities will come into scope for supervision in Ireland. It says the NCSC will be the competent authority for public administration entities and for the majority of the important entities in Annex II.

The General Scheme, which is not law, names the authorities sector by sector (Head 17). ComReg would supervise digital infrastructure, ICT service management, digital providers and space, which takes in DNS, TLD, cloud, data centre, trust service, telecoms and managed service providers. Sector bodies such as the Commission for the Regulation of Utilities and the Central Bank would take their own sectors, and the NCSC every other sector. The Bill may change any of it.

The scope may change before Ireland legislates. On 20 January 2026 the Commission proposed changes to NIS2. DNS service providers would no longer be caught at any size, which the Commission describes as removing micro and small DNS service providers from scope. An Annex I organisation would be essential only above the size limits for small mid-cap enterprises. It is a proposal. On 15 October 2026 the European Parliament's procedure file showed it awaiting a committee decision. If adopted, it would give Member States twelve months after it enters into force to transpose it.

These are what the Directive requires of an essential or important entity. They will apply to an Irish entity once the Bill is law, and the Irish Act will set the detail.

The board or other management body must approve the cybersecurity risk management measures and oversee how they are put in place. It can be held liable for the entity's breaches of the rules, and its members must take training (Article 20).

The measures must cover at least the ten matters in Article 21(2), from risk analysis and incident handling to supply chain security, cryptography and multi-factor authentication.

A significant incident is reported in stages to the national computer security incident response team (CSIRT) or the regulator (competent authority): an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after the notification (Article 23(4)). The legal clocks an Irish business can face sets those beside the GDPR's.

The Directive does not set the fines. It sets the lowest that each Member State's maximum fine can be. For breaching Article 21 or 23, the maximum must be at least 10 million euro or 2% of total worldwide annual turnover, whichever is higher, for an essential entity, and at least 7 million euro or 1.4% for an important one (Article 34(4) and (5)). The Irish figures will be whatever the Act sets.

Until Ireland transposes NIS2, the Directive reaches an Irish supplier through its customers' contracts, with one exception set out below. Where you process personal data for a customer, the GDPR already binds you directly as well. A supplier handling data for a customer (a processor) must keep that data secure, as the customer must (Article 32). It must also tell the customer of a personal data breach without undue delay after becoming aware of it (Article 33(2)).

In-scope entities must address supply chain security, including the security-related aspects of the relationships between each entity and its direct suppliers or service providers (Article 21(2)(d)). They must take into account the vulnerabilities specific to each direct supplier and the overall quality of its products and cybersecurity practices, including its secure development procedures (Article 21(3)).

A customer regulated in a Member State that has transposed is bound by that duty now, and it passes it on to its direct suppliers through the contracts they sign. The NCSC's draft guidance of June 2025, written for Irish entities once the Bill is law, gives an example. It lists clauses a contract with a direct supplier should include, as a supporting action that it does not count among its baseline foundation actions (RMM012.SA02). They include a duty on the supplier to notify the entity of all relevant incidents as soon as it becomes aware of them, a right to audit or to receive audit reports, security certifications for the supplier's staff, a duty to manage vulnerabilities, and the supplier's duties when the agreement ends. The list is not complete. A customer regulated elsewhere follows its own authority's guidance, which may differ.

A clause like that binds you from the day you sign it, because it is in the contract. The fact that Ireland has not transposed NIS2 does not change a clause you signed. What a customer under NIS2 will ask you, and where each question comes from goes through them one group at a time.

One kind of supplier can already be bound by another State's NIS2 law. A telecoms provider (public electronic communications networks or services) falls under the jurisdiction of each Member State where it provides its services (Article 26(1)(a)). An Irish telecoms provider with customers in a Member State that has transposed may therefore be bound by that State's law now.

Other entities fall under the Member State where they are established (Article 26(1)). Recital 113, which explains the Directive and is not itself a rule, says an entity established in more than one Member State should fall under the jurisdiction of each. The digital types in Article 26(1)(b), from DNS and domain registration to cloud and managed services, go by their main establishment in the Union: the place where their cybersecurity decisions are mainly taken (Article 26(2)). For one whose main establishment is in Ireland, that is Irish law, and there is no Irish NIS2 law yet.

Under the Commission's proposal of January 2026, the Commission would adopt guidelines on the supply chain requirements that in-scope entities pass on to their suppliers. Recital 9 says the supply chain duty has led many entities to send their suppliers long questionnaires in differing formats, which may be a significant burden. It says the Commission should recommend the level of detail, structure and format of those requests. The explanatory memorandum says the guidelines are meant to "prevent the undue passing on of obligations on entities not in scope". It is a proposal, and nothing in it binds a customer today.

The Strategy says the NCSC will publish guidance on supply chain risk management by Q2 2027, and that particular attention will be paid to SMEs, so that supply chain expectations do not become a barrier to taking part. That is a target in a strategy, with no legal effect.

The Cyber Resilience Act (CRA) is worth setting beside NIS2, because it has no minimum size and NIS2 does.

The Cyber Resilience Act (Regulation (EU) 2024/2847) is a regulation, so it applies directly without an Irish law, and its scope has no exemption for small companies. Its reporting duty (Article 14) has applied since 11 September 2026, and it covers products placed on the market before 11 December 2027 (Article 69(3)). The only allowance for size is in the fines: a micro or small manufacturer cannot be fined for missing either 24-hour early warning deadline, for an actively exploited vulnerability or for a severe incident (Article 64(10)(a), as corrected on 2 July 2025).

The fines themselves need national law, because each Member State sets its own rules on penalties (Article 64(1)). The Strategy 2030 says the law naming Ireland's CRA regulator (its market surveillance authority) and setting up penalties is still to be passed, with a target of Q4 2027. The reporting duty applies regardless.

If you ship software or a connected product, that is the law with a date on it. Whether it reaches a SaaS at all is a separate question. The free Cyber Resilience Act check asks five questions about one product and says whether the Act reaches you.

In short: NIS2 regulates organisations above a minimum size, with the exceptions above, and is not law here yet. The CRA regulates products, has no minimum size, and its reporting duty already applies in Ireland as everywhere else in the EU.

Guidance, a strategy and a committee report. None of them creates a legal duty, but together they indicate what the Irish law may look like.

The NCSC has published guidance on cyber governance for management board members in NIS2 entities, built around the Cyber Fundamentals framework, which was developed in Belgium and which Ireland has joined as a scheme co-owner. It has also published draft risk management measures, a NIS2 quick reference guide and a FAQ.

The NCSC says certification or self-assessment under Cyber Fundamentals is optional, and the law does not treat it as proof that you comply (it is not a statutory presumption of compliance). The Strategy 2030 aims to approve Cyber Fundamentals as a national voluntary certification scheme by Q3 2027, and to have NIS2 entities use it to assess their maturity by Q2 2030. CyFun, ISO 27001 and Cyber Essentials sets the three side by side.

The Justice committee's report of February 2026 makes sixteen recommendations on the General Scheme. Two bear on a business that expects to be in scope: a transition or grace period of 12 months from the commencement of the legislation, and guidance on the practical application of the supply chain security requirements. They are recommendations, and the Bill may or may not follow them.

Check the date on what you read. On 15 October 2026 the NCSC's NIS2 page said it was last updated on 24 June 2025, and its Cyber Resilience Act page said 11 September 2026.

What to do depends on which of these describes you.