If you ship software, or run something other people depend on
Two sets of rules. One has no exemption for small companies, and the other is not yet law in Ireland.
The Cyber Resilience Act (CRA) and NIS2 are two different kinds of law. The CRA regulates products. It reaches anyone who puts connected hardware or software (a 'product with digital elements') on the EU market, and it has no exemption for small businesses. Its first firm duty, in force since 11 September 2026, is to report certain security problems, starting with an early warning within twenty four hours. NIS2 regulates organisations in certain sectors. In general it applies only to medium and large organisations in those sectors, and Ireland has still not made it part of Irish law.
For a small software supplier, that makes the CRA the more likely of the two to apply. These articles work out which one, if either, applies to a business, and say so when the answer is neither.