NIS2 in Ireland while the Bill is pending: what you and your suppliers can do now

01Ireland’s position as of autumn 2026

Directive (EU) 2022/2555, known as the NIS2 Directive (opens external site), took effect in January 2023 and gave Member States until 17 October 2024 to transpose it, with national rules applying the next day and the first NIS Directive repealed at EU level.

Ireland has not yet done so. The Department of Justice, Home Affairs and Migration published the General Scheme of the National Cyber Security Bill 2024 in August 2024, and the Bill is still being drafted. Until it is enacted, the Irish NIS regulations of 2018, S.I. No. 360 of 2018, remain in force for the operators they already cover. On 8 July 2026 the European Commission referred Ireland, together with several other Member States, to the Court of Justice for not notifying full transposition. Under the General Scheme, the National Cyber Security Centre (NCSC) is to be the lead competent authority, working in a federated model with sector regulators, and it has already published draft NIS2 risk-management guidance.

02Who the directive covers

Two annexes define the sectors. Annex I holds the highly critical ones, among them energy, transport, banking, health, drinking and waste water, digital infrastructure, ICT service management, public administration and space. Annex II holds others such as postal services, waste, chemicals, food, manufacturing, digital providers and research. In general only medium and large organisations are covered, although some are in scope at any size, for example DNS and trust service providers and central government. Exactly which Irish public bodies are covered depends on the final Act.

Article 3 divides them into two groups:

• Essential entities: chiefly large organisations in Annex I sectors, plus those essential regardless of size, for example qualified trust service providers, top-level domain registries, DNS providers and central government bodies. Supervision is proactive and can include audits and inspections on site.
• Important entities: the remaining organisations in scope under either annex. Supervision is after the fact, when there are signs of non-compliance.

Whichever group an organisation lands in, three duties are the same: Article 21 on measures, Article 23 on reporting, Article 20 on accountability. What differs is the intensity of supervision and the ceiling on fines. The directive sets national maximums, for breaches of Articles 21 or 23, of no less than €10 million or 2% of global turnover (essential) and €7 million or 1.4% (important), taking the higher figure in each case. Member States choose whether public bodies can be fined at all; Ireland will make that choice in its Bill.

Could your software supplier be covered directly?

Building software does not, by itself, put a company in a NIS2 sector. A supplier may still be covered in its own right, because Annex I includes managed service providers, and the directive describes them broadly: firms that install, manage, operate or maintain ICT for clients, whether on their premises or remotely. An application management supplier of medium size or more can therefore be in scope directly, as can cloud and data centre providers. For that group, Implementing Regulation (EU) 2024/2690 (opens external site) already spells out the technical measures, and as a regulation it applies in Ireland now.

For most suppliers, NIS2 arrives as customer paperwork: security schedules in contracts, questionnaires and audit requests. Their products are also caught by the Cyber Resilience Act (opens external site) (Regulation (EU) 2024/2847), which applies directly in Ireland. Its duty to report actively exploited vulnerabilities and severe incidents started on 11 September 2026; the rest follows on 11 December 2027.

03Article 21: the minimum measures

Article 21 asks for appropriate and proportionate technical, operational and organisational measures on an all-hazards basis, reflecting the state of the art and relevant standards, and scaled to the entity’s exposure, size and the likely severity of incidents. The NCSC’s draft guidance is built around the same list. At minimum the measures address:

1. 01risk analysis and information system security policies;
2. 02handling of incidents;
3. 03business continuity, including backup management, disaster recovery and crisis management;
4. 04security of the supply chain, covering the security aspects of relationships with direct suppliers and service providers;
5. 05security in acquiring, developing and maintaining network and information systems, including vulnerability handling and disclosure;
6. 06policies and procedures for assessing whether the measures work;
7. 07basic cyber hygiene and cybersecurity training;
8. 08cryptography and, where appropriate, encryption;
9. 09human resources security, access control and asset management;
10. 10multi-factor or continuous authentication and secured voice, video, text and emergency communications, where appropriate.

Suppliers enter through points 4 and 5. Article 21(3) tells entities to weigh the vulnerabilities specific to each direct supplier, the overall quality of its products and security practices, and its secure development procedures. Customers are expected to examine how you build software, not just what you hand over.

04Boards approve the measures and answer for them

Article 20 requires the management bodies of essential and important entities to approve the risk-management measures, oversee how they are implemented, and accept liability for breaches. Members must undergo training, and staff training is encouraged too. For public bodies, national rules on the liability of public institutions and officials still apply.

That shifts the supplier conversation. A board asked to sign off wants evidence it can follow: which suppliers sit behind which services, which risks remain, what has truly been tested. Irish boards do not need to wait for the Act to start asking.

05Reporting incidents: 24 hours, 72 hours, one month

Article 23 obliges entities to report significant incidents to their CSIRT or competent authority, meaning incidents that have caused or could cause serious disruption or financial loss to the entity, or considerable harm to others. The Irish Act will decide which body receives the reports. The sequence is:

Where appropriate, entities must also tell the recipients of their services without undue delay about significant incidents likely to affect them. The Irish Act will add its own forms and channels.

The clock starts when the entity becomes aware. If the incident starts in a supplier’s system, the customer can meet 24 hours only if the supplier detects it, recognises it and reports it within hours. Detection, logging and an agreed notification route therefore belong in the contract, not only in the engineering backlog.

06What Irish customers will ask of software suppliers

Article 21 becomes concrete measures and evidence a supplier should be able to produce without launching a project. The requests we meet most:

• Secure development. Threat modelling for significant changes, peer review, automated security testing and dependency scanning in the pipeline, signed builds and a software bill of materials (SBOM) per release.
• Vulnerability handling and disclosure. A public route for reporting vulnerabilities, response times by severity, and notice to the customer when its environment is affected.
• Controlled access for supplier staff. Named accounts, multi-factor authentication, least privilege, time-boxed elevated rights and a record of every admin action in the customer’s systems.
• Logs and incident evidence. Security events recorded with reliable timestamps, retained for an agreed time and exportable, so the customer can fill in the early warning and the final report.
• Working together in an incident. A named contact and channel, notification well inside the customer’s 24 hours, and help with root-cause analysis.
• Continuity and recovery. Backups proven by restoring them, recovery targets matched to the customer’s, and a procedure that has been rehearsed.
• Supply-chain records. An up-to-date list of subcontractors and hosting locations, and of the main third-party components and services the solution relies on.
• A way out. Data export in usable formats, documentation and handover help, so the customer can switch supplier without losing control.

Mature engineering teams do most of this already. What NIS2 adds is that the customer has to be able to prove it. Our trust and compliance page explains how we work as a supplier, including our ISO/IEC 27001 certified information security management system.

07Contract and procurement checklist

1. 01Link suppliers to services. Record which suppliers support which services likely to be in scope, and which can reach your systems or data.
2. 02Rank by criticality. Put the strictest terms on suppliers that run or can change critical systems.
3. 03Put the measures in the contract. Security requirements, notification time and route, vulnerability handling, logging and retention, audit or evidence rights, subcontracting and locations. In a tender competition, state them in the request for tender.
4. 04Ask for proof, not statements. Certificates with their scope, test results, an SBOM, the date of the last restore test.
5. 05Settle the exit at the start. Data return, transition support and how long the supplier keeps the service running.
6. 06Practise together. Run an incident exercise with your critical suppliers, 24-hour early warning included.
7. 07Review often. Suppliers, services and threats move; a register updated once a year is stale for most of it.

08What the Irish Act will settle

Much is still open in Ireland and will be fixed by the Act itself: how entities register, where reports go, which forms they use, which regulator supervises which sector, and whether anything is added to the directive’s minimum. On the General Scheme, the NCSC leads and sector regulators supervise their own sectors, but the enacted text decides. Jurisdiction normally follows establishment. Article 26 departs from that for some providers: telecoms providers answer in each country they serve; cloud, data centre and managed service providers, with several other digital providers, answer where their main establishment is; public administration answers to the State that created it.

09Points to follow

• Publication of the National Cyber Security Bill in the Oireachtas, its passage, and the NCSC’s final guidance and registration arrangements.
• A proposal from Brussels to simplify incident reporting: the Digital Omnibus (opens external site) (COM(2025) 837, November 2025) would let one ENISA-run entry point receive the reports owed under NIS2, the GDPR, DORA and other laws. When we checked in October 2026, MEPs were still considering it (opens external site)), so nothing changes in reporting until it is adopted and starts to apply.
• EU-level assessments of risk in critical ICT supply chains (Article 22), which Irish entities will be expected to reflect in their supplier measures.
• Full application of the Cyber Resilience Act to software products in December 2027.

Banks, insurers and other financial entities follow the Digital Operational Resilience Act instead of the NIS2 provisions on ICT risk, reporting and supervision, and DORA already applies in Ireland; read DORA and your ICT suppliers for that side. The directive and its implementing acts are collected on the Commission’s NIS2 policy page (opens external site).