Trust and compliance for regulated Irish organisations

Under Directive (EU) 2022/2555, known as NIS2, essential and important entities must manage cybersecurity risk to their network and information systems. Article 21(2) lists supply-chain security among the minimum measures, and Article 21(3) requires entities to consider how secure their direct suppliers and service providers are in practice.

Ireland has not yet transposed NIS2. As of autumn 2026, the General Scheme of the National Cyber Security Bill 2024 has been published and the Bill is still being drafted, S.I. No. 360 of 2018 (the NIS1 regulations) remains in force, and the National Cyber Security Centre is planned as lead authority and has published draft guidance on risk management measures. Preparing now is sensible: we help you show that your supply chain is under control. Each contract sets out security clauses, how incidents reach you and how vulnerabilities are handled, and we document the controls for your engagement in a form your supplier risk process can review. How the final Irish Act applies to your organisation is your own assessment.

DORA, Regulation (EU) 2022/2554 on digital operational resilience, has been in application since 17 January 2025. It applies directly in Ireland, as in every Member State. Financial entities, from banks and insurers to investment firms and payment institutions, have to manage ICT third-party risk inside their ICT risk management framework, hold a register of information covering every contractual arrangement for ICT services (Article 28) and put key provisions into those contracts (Article 30).

When we supply ICT services to a financial entity, we agree to the provisions listed in Article 30: a full description of the services, the places of delivery and of data processing, help when an ICT incident happens, termination rights, and cooperation with the competent authorities that supervise you. For services behind critical or important functions, exit strategies and our part in your resilience testing are in the contract too.

We provide what your register of information needs, and exit plans are documented from day one so that changing supplier stays a real option.

Regulation (EU) 2024/1689, the AI Act, takes effect in phases. The bans on prohibited practices and the AI literacy duty have applied since February 2025, and the Article 50 transparency obligations since August 2026. Following the 2026 amendment by Regulation (EU) 2026/1744, high-risk systems listed in Annex III must comply from 2 December 2027. In Ireland, the Regulation of Artificial Intelligence Act 2026 gives effect to the Act, with the AI Office of Ireland as central coordinating authority and sector authorities that include the Central Bank of Ireland, the Data Protection Commission, the HPRA and the CCPC.

High-risk systems need documentation (Article 11), logs recorded without manual steps (Article 12) and a design allowing effective oversight by people (Article 14), and deployers must give that oversight to staff with the competence and authority to intervene (Article 26). We build for this from the first release: approval steps and the power to override are placed where decisions affect people, and documentation is written as the code is.

Whether you are the provider or the deployer depends on how the system is put into service. That question belongs to the legal assessment, which your own legal advisers make; we give them the technical facts they need.

Before signing, your procurement, legal and security colleagues want evidence. We can give you the ISO/IEC 27001 certificate with its scope, completed answers to your security questionnaire for suppliers, and the data processing terms that would cover your engagement.

Use the contact page and tell us the framework you assess suppliers against, for example NIS2, DORA or the NCSC’s draft guidance. The right people will come back to you.