NIS2 in Ireland: National Implementation, Authorities, and Requirements

Ireland occupies an unusual position in European cybersecurity compliance. As the European headquarters location for Google, Meta, Microsoft, Apple, LinkedIn, and dozens of other technology companies, Ireland is home to entities that provide digital services to hundreds of millions of people across the EU. It hosts the International Financial Services Centre, one of Europe’s most significant financial hubs. Its data centres anchor a large proportion of EU cloud infrastructure. When the NIS2 Directive entered into force, it brought a substantial share of the EU’s most strategically important network and information systems under Irish regulatory oversight.

This guide explains how NIS2 applies in Ireland specifically — the national legislation, the competent authorities, Ireland’s unique jurisdictional role for multinational entities, and what Irish-registered organisations need to do to comply.

This article provides general information only and does not constitute legal advice. NIS2 implementation varies by member state and sector — always verify requirements against your national transposition law and applicable authority guidance. For advice specific to your organisation, consult a qualified legal or compliance professional.

Ireland’s NIS2 Transposition: The National Legislation

Status checked 29 October 2026: Ireland has not yet transposed NIS2. The NIS2 Directive (EU) 2022/2555 required all EU Member States to transpose it into national law by 17 October 2024. Ireland missed that deadline. The National Cyber Security Centre (NCSC) states on its NIS2 page that “the transposition deadline for NIS2 of 17 October 2024 has not been met” and that Ireland “continues to work through the transposition requirements of the Directive.”

Where the Irish legislation stands:

• July 2024: a Cabinet decision directed priority drafting of the legislation transposing NIS2 (NCSC).
• September 2024: the Heads of the General Scheme of the Bill were published on the website of the Department of the Environment, Climate and Communications (NCSC).
• 7 May 2025: the European Commission sent Ireland a reasoned opinion for failing to notify full transposition of the Directive (European Commission).
• July 2026: according to the Law Society of Ireland’s Gazette (7 October 2026), the Commission referred Ireland to the Court of Justice of the EU for failing to transpose NIS2. The same report says the Department of Justice, Home Affairs and Migration is preparing the draft bill and that it was included for priority publication in the Government’s autumn legislative programme.

Until the new law is enacted, the NIS1 framework stays in place. In Ireland that is the European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018 (S.I. No. 360 of 2018). The NCSC states that NIS1 “remains in full effect” and continues to apply to already designated Operators of Essential Services.

The rest of this guide describes the obligations the Directive sets at EU level and that the Irish law must transpose. The final Irish text may use the discretion the Directive leaves to Member States, for example on procedural details or stricter national rules. Check the enacted legislation once it is published, and treat everything below as subject to national law.

Ireland’s Competent Authorities Under NIS2

NIS2 requires each Member State to designate one or more competent authorities responsible for supervising compliance. Ireland has not yet made its NIS2 designations: the NCSC lists the “designation of competent authorities for various sectors” among the national building blocks that are already in place or in the final stages of development.

The National Cyber Security Centre (NCSC) is the State’s main cyber security body and includes Ireland’s national Computer Security Incident Response Team, CSIRT-IE. Under the NIS1 Regulations that still apply, the European Commission lists the NCSC as the competent authority for digital service providers and for operators of essential services in energy, transport, health, drinking water supply and distribution, and digital infrastructure. The Central Bank of Ireland is the competent authority for banking and financial market infrastructure.

Which authorities will supervise each NIS2 sector in Ireland depends on the designations in the forthcoming law. Treat any sector-by-sector authority list published before the Bill is enacted as provisional, and confirm your authority against the enacted text and the NCSC’s guidance.

Ireland’s CSIRT: Incident Reporting Under NIS2

Article 10 of the NIS2 Directive requires each Member State to designate one or more CSIRTs. Ireland’s national CSIRT today is CSIRT-IE, part of the NCSC, which the European Commission lists as Ireland’s national CSIRT and single point of contact under the NIS1 framework.

NIS2 incident reporting is not yet live in Ireland. The NCSC states that “the NIS2 registration and incident reporting portals are not available at this time” and that both will become available once the legislation is implemented. Operators already designated under NIS1 continue to report under the 2018 Regulations.

Once Irish law transposes it, the NIS2 notification timeline in Article 23, with the detail in the Commission Implementing Regulation (CIR) 2024/2690 for the digital entities it covers, is:

• Within 24 hours of becoming aware: early warning — confirm an incident occurred, note any cross-border impact, indicate suspected cause or attack type
• Within 72 hours: full incident notification — updated severity assessment, root cause analysis (where available), affected systems, mitigations applied
• Within one month: final report — complete technical analysis, cross-border impact assessment, lessons learned, long-term remediation measures

An incident is “significant” when it causes or is capable of causing severe operational disruption, financial loss to the entity, or substantial damage to other natural or legal persons. Key EU-level indicators include service unavailability affecting a large number of users, financial loss exceeding certain thresholds, or incidents affecting critical societal or economic functions. Always check your sector-specific thresholds and national rules, as additional criteria may apply. For the full significance criteria and notification workflow, see our NIS2 incident reporting guide.

Which Irish Entities Must Comply?

NIS2 applies to entities that are established in EU Member States or that provide services within the EU while being established in a third country (with jurisdiction rules for the latter set by Article 26). The scope criteria are the same across all Member States.

Standard scope criteria — both conditions must be met:

1. The entity operates in one of the 18 sectors listed in Annex I or Annex II of the Directive (see our NIS2 scope guide for the full sector list)
2. The entity qualifies as a medium-sized enterprise or larger: 50 or more employees, or €10 million or more in annual turnover and balance sheet total

Always-in-scope entities — apply regardless of size: top-level domain (TLD) name registries, DNS service providers, cloud computing service providers, data centre services, content delivery networks, managed service providers (MSPs), managed security service providers (MSSPs), online marketplaces, online search engines, social networking service platforms, and trust service providers.

Ireland’s economic structure means a large number of significant entities are likely to fall under Irish NIS2 oversight once the law is in force:

Category	Ireland Context	NIS2 Tier
Global technology companies (EU HQs)	Google, Meta, Microsoft, Apple, LinkedIn, Stripe, Amazon, Salesforce — all operate EU headquarters or primary EU operating entities from Ireland	Essential (digital infrastructure, ICT services, online platforms)
International financial services	IFSC Dublin hosts major global banks, investment firms, and insurance companies; Central Bank regulated	Essential (banking, financial market infrastructure)
Data centres	Ireland is one of Europe’s largest data centre markets; AWS, Microsoft Azure, and Google Cloud all operate major Irish campuses	Essential (digital infrastructure — data centre services)
Healthcare	HSE and private hospital groups; HSE suffered a major ransomware attack in 2021 that paralysed national health services for weeks	Essential (healthcare)
Energy	EirGrid (transmission), ESB Networks (distribution), Gas Networks Ireland, major energy suppliers	Essential (energy — electricity and gas)
Managed service providers	Numerous MSPs and MSSPs serving EU clients from Irish bases	Essential (ICT service management — always in scope)

This concentration of critical and digital infrastructure makes Ireland one of the most significant Member States for NIS2 enforcement in practical terms, which is why the delay in transposition matters well beyond Ireland.

Ireland’s Lead-Authority Role for Multinational Entities

One of the most strategically important features of NIS2 for Irish-registered entities is the Directive’s main establishment jurisdiction rule — a mechanism that gives Ireland regulatory primacy over the European operations of many global companies.

Article 26 of NIS2 establishes that where an entity has establishments in multiple EU Member States, the competent authority in the Member State of the entity’s main establishment has primary jurisdiction. For the purposes of NIS2, “main establishment” refers to the Member State where the entity’s central administration in the EU is located, or — if central administration and the highest decision-making authority over cybersecurity risk management are in different Member States — the latter takes precedence.

For many US technology companies that structured their EU operations through Irish entities, and for financial services firms that established their EU primary booking entity or operational hub in Ireland, this means:

• The Irish competent authority is the lead authority, even if the entity provides services across all 27 Member States
• Incident notifications go to the Irish CSIRT or competent authority as primary point of contact
• The Irish authority coordinates with authorities in other Member States where the entity has establishments
• Enforcement decisions are led by the Irish authority, with other Member State authorities informed and consulted

This structure is conceptually similar to GDPR’s “one-stop-shop” mechanism, where the Irish Data Protection Commission (DPC) acts as lead supervisory authority for many technology companies with their EU data protection operations based in Ireland. Entities that already mapped their GDPR lead authority to Ireland will often — though not always — find Ireland is also their NIS2 lead authority, depending on where their cybersecurity governance decision-making sits.

Practical implications for affected entities:

• Do not register with NIS2 authorities in multiple Member States as if each were an equal primary authority — establish your correct lead jurisdiction first
• Your NIS2 Officer or CISO should build a direct relationship with the Irish authority, not with other Member State authorities as primary contacts
• Cross-border incident coordination still occurs, but through the Irish authority as lead, not directly between the entity and each national authority
• If your corporate structure has changed since your initial GDPR lead authority mapping (acquisitions, restructuring), revisit your NIS2 jurisdiction determination independently

Note: Article 26 jurisdiction rules depend on corporate structure and the location of genuine decision-making authority — not simply registered office location. The application to specific entities requires careful legal analysis. Always verify your applicable authority with qualified legal counsel.

The 10 Security Obligations: What Irish Entities Must Implement

The core compliance obligations are the same for all entities across the EU. Once Ireland’s law is in force, in-scope Irish entities will need to implement all ten Article 21 cybersecurity risk-management measures proportionate to their risk exposure, size, and the criticality of their services:

Measure	Reference	Core Requirement
Risk analysis and information security policies	Art. 21(2)(a)	Risk assessment methodology, documented ISMS policy
Incident handling	Art. 21(2)(b)	Detection, response, and notification procedures
Business continuity and crisis management	Art. 21(2)(c)	Business continuity plan, disaster recovery, backup management
Supply chain security	Art. 21(2)(d)	Supplier security requirements, contract clauses
Network and information system security	Art. 21(2)(e)	Secure acquisition, development, and maintenance of systems
Effectiveness assessment	Art. 21(2)(f)	Security metrics, audits, penetration testing
Cybersecurity training and awareness	Art. 21(2)(g)	Management training (Art. 20(2)), staff awareness programme
Cryptography and encryption	Art. 21(2)(h)	Data-at-rest and in-transit encryption, key management
Access control and HR security	Art. 21(2)(i)	Least privilege, joiner-mover-leaver controls, privileged access management
MFA and secure communications	Art. 21(2)(j)	Multi-factor authentication, encrypted communications channels

For entities in the always-in-scope digital sectors — DNS providers, cloud services, data centres, MSPs, MSSPs, online marketplaces, search engines, and social networks — the Commission Implementing Regulation (CIR) 2024/2690 applies directly and specifies detailed technical requirements for each measure across 13 Annex sections. Many Irish-registered tech companies will be subject to the CIR as well as the base Directive obligations.

Penalties and Enforcement in Ireland

Ireland’s NIS2 penalty provisions do not exist yet: they will be set by the forthcoming Irish law. The Directive sets the two-tier administrative fine structure that the national law must provide. Subject to national law and supervisory authority discretion, the maximum levels are:

• Essential entities: administrative fines may reach up to €10,000,000 or 2% of the entity’s total worldwide annual turnover in the preceding financial year, whichever is higher
• Important entities: fines may reach up to €7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher

These are maximum levels, not automatic sanctions. Actual penalty amounts depend on the nature, severity, duration, and intentionality of the infringement, prior infringements, and cooperation with the supervisory authority.

Management liability under Article 20 will apply in Ireland once the Directive is transposed, as it does across the EU. Members of the management body can be held personally responsible for cybersecurity infringements. In severe or repeated cases, supervisory authorities may impose a temporary prohibition on individuals from exercising management functions. For multinational companies with EU decision-making authority held by executives based in Ireland, this personal liability exposure is particularly significant — executives are not shielded from enforcement action by their non-Irish nationality or non-Irish residence.

Beyond financial penalties, the Directive requires competent authorities to be able to apply a range of supervisory measures, including binding instructions to implement specific security controls, mandatory security audits, orders to notify affected customers or users, and publication of infringement decisions. For the full enforcement framework, see our NIS2 penalties guide.

Registration and Self-Identification in Ireland

Article 3 of the NIS2 Directive requires essential and important entities to submit their details to the competent authority so that they can be identified. In Ireland this step cannot be completed yet. As of the NCSC’s latest update, “the NIS2 registration and incident reporting portals are not available at this time”, and both portals will open once the legislation is implemented.

Until then there is no Irish NIS2 registration process to follow, and no Irish registration deadline has been set. Use the time to assemble your organisation’s identification and contact details, your sector and sub-sector classification and the Member States where you provide in-scope services. Watch the NCSC’s NIS2 page at ncsc.gov.ie/nis2 for the portal launch and the registration window.

Practical Implementation Steps for Irish Organisations

Whether you are an indigenous Irish company newly in scope, a multinational with Irish-based EU operations, or a global technology company that expects Irish supervision across your EU services, the same structured implementation approach applies.

1. Confirm your scope and entity tier

Apply the Annex I and II sector classifications and size thresholds to your organisation. For digital sector entities, check the always-in-scope list. Determine whether you are an essential or important entity — the distinction affects penalty levels, supervisory intensity, and some specific obligations.

2. Establish your lead competent authority

If you operate across multiple EU Member States, determine where your main establishment is located for NIS2 purposes. Document the analysis — supervisory authorities may request it. If your answer is Ireland, the Irish competent authority designated under the forthcoming law will be your primary contact.

3. Prepare to register

The NIS2 registration portal is not yet open in Ireland. Prepare your registration data now and monitor the NCSC’s NIS2 page so you can submit your notification of in-scope status as soon as the portal and the competent authority for your sector are confirmed.

4. Appoint a NIS2 Officer or equivalent

Designate a responsible person who can interface with the competent authority, manage incident notifications, and coordinate the Article 21 implementation programme. This is the person whose contact details you register with the authority.

5. Conduct a gap assessment

Map your existing security controls against the ten Article 21 measures and, where applicable, the relevant CIR Annex sections. Identify gaps and prioritise remediation by risk level. Risk assessment and incident handling should come first — they underpin everything else.

6. Implement, document, and test

NIS2 compliance is evidence-based. Supervisory authorities expect documented policies, records of risk assessments, training completion logs, and tested incident response plans. Our NIS2 compliance checklist maps documentation requirements across all implementation phases. For template documentation covering all ten Article 21 measures, see our NIS2 template library.

Frequently Asked Questions

Is NIS2 law in Ireland?

Not yet (checked 29 October 2026). Ireland missed the 17 October 2024 transposition deadline. The Heads of the General Scheme of the Bill were published in September 2024, the European Commission sent Ireland a reasoned opinion on 7 May 2025, and the Law Society Gazette reported in October 2026 that the Commission referred Ireland to the Court of Justice of the EU in July 2026 and that the bill is listed for priority publication. Until the new law is enacted, the NIS1 Regulations of 2018 (S.I. No. 360 of 2018) continue to apply.

Who is the NIS2 competent authority in Ireland?

Ireland has not yet designated its NIS2 competent authorities; they will be set by the forthcoming law. Under the NIS1 Regulations that still apply, the NCSC is the competent authority for digital service providers and for operators of essential services in most sectors, and the Central Bank of Ireland covers banking and financial market infrastructure. CSIRT-IE, part of the NCSC, is the national CSIRT.

Does NIS2 apply to US companies with their EU headquarters in Ireland?

It may. Under Article 26 of the NIS2 Directive, entities established in multiple EU Member States are primarily supervised by the competent authority in the Member State where their main EU establishment is located. For many US technology and financial services companies that structured their EU operations through Irish entities, this means the Irish competent authority will be the lead authority — even where the company serves customers across all 27 Member States. The analysis depends on where genuine EU operational and cybersecurity decision-making authority sits, not simply on where the registered office is located.

What are the NIS2 penalties in Ireland?

Ireland has not yet enacted NIS2 penalty provisions. The Directive sets the two-tier framework the Irish law must provide. For essential entities (Annex I), fines may reach up to €10,000,000 or 2% of total worldwide annual turnover, whichever is higher. For important entities (Annex II), fines may reach up to €7,000,000 or 1.4% of worldwide annual turnover. These are maximum levels, subject to national law and supervisory discretion. Management body members may also face personal liability, including temporary prohibition from exercising management functions in severe cases.

When did Irish entities need to register for NIS2?

They cannot register yet. The NCSC states that the NIS2 registration and incident reporting portals are not available and will open once the legislation is implemented, so no Irish NIS2 registration deadline applies today. Check the NCSC’s NIS2 page at ncsc.gov.ie for the portal launch and deadline.

How does NIS2 relate to the GDPR “one-stop-shop” for Irish-based companies?

NIS2 introduces a comparable — though not identical — lead-authority mechanism for cybersecurity oversight. Entities that have their EU data protection lead authority at the Irish Data Protection Commission (DPC) under GDPR will often, but not always, also find Ireland is their NIS2 lead authority. The two determinations are independent: GDPR lead authority follows where the entity’s main EU data processing decision-making is located; NIS2 lead authority follows where cybersecurity risk-management decisions are made. For most companies, the answer will be the same, but verify both independently.

Related guides

• Ireland’s NIS2 Competent Authorities: NCSC, CBI, ComReg, CRU, and the Sector Routing Table Irish Entities Need Now

Sources

1. Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS2 Directive), Articles 3, 20, 21, 23, 26. EUR-Lex.
2. National Cyber Security Centre Ireland. NIS2 Implementation — official guidance and registration information. ncsc.gov.ie.
3. Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 laying down rules for the application of Directive (EU) 2022/2555 (CIR 2024/2690). EUR-Lex.
4. ENISA. NIS2 Directive — topic overview and technical guidance publications. European Union Agency for Cybersecurity. enisa.europa.eu.
5. National Cyber Security Centre Ireland. NIS2 — national steps, registration and incident reporting portal status (last updated 24 June 2025; checked 29 October 2026). ncsc.gov.ie/nis2.
6. European Commission. NIS2 Directive: Ireland — transposition status, reasoned opinion of 7 May 2025, NIS1 authorities and CSIRT. digital-strategy.ec.europa.eu.
7. European Commission. NIS2 transposition — reasoned opinions to 19 Member States, 7 May 2025. digital-strategy.ec.europa.eu.
8. S.I. No. 360 of 2018, European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018. Office of the Attorney General. irishstatutebook.ie.
9. Law Society of Ireland Gazette. “Government pledge on delayed cyber bill”, 7 October 2026. lawsociety.ie.

This article is for informational purposes only and does not constitute legal advice. NIS2 obligations vary by entity type, sector, and national transposition. For advice specific to your organisation and jurisdiction, consult a qualified legal or compliance professional.