NIS2 is not Irish law yet. Here is why it still reaches you.

Directive (EU) 2022/2555, NIS2, had a transposition deadline of 17 October 2024. Ireland did not meet it and has still not transposed it.

The National Cyber Security Centre says so on its own page: the transposition deadline has not been met, Ireland continues to work through the requirements, and the predecessor regime NIS1 remains in full effect and covers the most critical operators in the State.

The European Commission escalated. Letters of formal notice went out on 28 November 2024, reasoned opinions on 7 May 2025, and on 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice, with a request that the Court impose financial sanctions consisting of a lump sum and daily penalties until complete transposition is notified.

A directive that has not been transposed cannot be enforced against a private company. That is settled and it has been for forty years.

The Court of Justice put it in Faccini Dori: a directive cannot of itself impose obligations on an individual and cannot therefore be relied upon as such against an individual. The principle originates in Marshall and has not moved since.

So today, in Ireland, there is no NIS2 competent authority with powers over a private company, no registration duty, no NIS2 incident reporting duty and no NIS2 fine. The NCSC confirms the practical consequence: its NIS2 registration and incident reporting portals are not available, and will be once the legislation is implemented.

Two things run the other way and are worth knowing. The absence of horizontal effect does not stop a private party invoking a sufficiently precise and unconditional provision against the State or an emanation of the State. And national law has to be interpreted, so far as possible, in conformity with the directive.

It is worth working this out now, because the answer for most Irish SMEs is that it will not reach them, and knowing that is worth more than a readiness programme.

NIS2 applies to entities of a type listed in Annex I or Annex II that qualify as medium-sized enterprises under the EU definition, or exceed those ceilings. Eighteen sectors in total: eleven of high criticality in Annex I, seven others in Annex II.

The size test is finer than the usual shorthand. Under the EU definition a small enterprise has fewer than 50 staff and turnover or balance sheet total not exceeding 10 million euro. So an entity crosses into medium-sized on 50 or more staff, or where both turnover and balance sheet total exceed 10 million. A thirty-person company with 12 million turnover and a 4 million balance sheet is still small.

Some entities are caught regardless of size: providers of public electronic communications networks or publicly available electronic communications services, trust service providers, TLD name registries, DNS service providers, domain name registration services, entities identified as critical under the CER Directive, and central government public administration.

This is the practical answer to why NIS2 keeps landing on desks in a country that has not transposed it.

Article 21(2)(d) of the Directive requires in-scope entities to manage supply chain security, including the security of their direct suppliers. Entities in member states that did transpose are already regulated, and they are discharging that duty by pushing requirements down their supply chains in contract.

So an Irish software house selling into a German utility or a Dutch hospital is being asked for incident notification windows, vulnerability handling, multi-factor authentication and a right to audit. Those obligations are real and enforceable, and their source is the contract rather than Irish law. Arguing that Ireland has not transposed NIS2 is not a defence to a clause you signed.

The other live regime is the older one. NIS1 remains in effect here through S.I. No. 360 of 2018 for entities already designated as operators of essential services or as digital service providers.

It is worth putting the two side by side, because the smaller company is far more likely to be caught by the one nobody is discussing.

The Cyber Resilience Act is a regulation, so it applies directly without transposition. It has no SME exemption. Its reporting duty starts on 11 September 2026 and reaches backwards over products already in customers' hands. If you ship software or a connected product, that is the one with a date on it, and whether it reaches a SaaS at all turns on whether anything is installed at the customer's end.

NIS2 regulates operators above a size floor and is not law here. The CRA regulates products, has no floor, and is law everywhere in the Union already.

Guidance rather than obligation, and it is worth reading because it signals what the Irish regime will look like.

The NCSC published guidance on cyber governance for management board members in NIS2 entities in July 2026, built around its Cyber Fundamentals framework, which it adopted from the Belgian Centre for Cybersecurity. It has also published draft risk management measures, a NIS2 quick reference guide and a FAQ.

Certification or self-assessment under Cyber Fundamentals is optional and it is not a statutory presumption of compliance with anything. It is a reasonable thing to work towards if you expect to be in scope, and a poor use of money if you do not.

Date what you read. As at 31 August 2026 the NCSC's NIS2 landing page carries a last updated date of 24 June 2025, while its Cyber Resilience Act page was updated on 28 August 2026.

The proportionate answer depends entirely on which of three positions you are in.