NIS2 Ireland update: where things stand in November 2026

NIS2 in Ireland is still not transposed into Irish law: the National Cyber Security Bill has not been published or enacted, and the European Commission referred Ireland to the EU Court of Justice over the delay in July 2026. The Government's new National Cyber Security Strategy 2030, launched on 7 October 2026, recommits to the Bill, and the Minister has said he expects to notify transposition by the end of 2026. For businesses, the NIS2 Ireland message is to prepare now, because the obligations are known even if the Irish start date is not.

Key takeaways

• Ireland missed the 17 October 2024 NIS2 transposition deadline and was referred to the CJEU in July 2026.
• The National Cyber Security Bill is still being drafted; the Minister expects to notify transposition by end-2026.
• The strategy launched on 7 October 2026 sets 29 measures and targets a CyFun-based certification scheme for Q3 2027.
• The NCSC is set to be the lead competent authority and has already issued draft risk measures and board guidance.
• Medium and large firms in Annex I and II sectors should prepare now for 24-hour reporting and Article 21 measures.

What changed in the last few weeks?

The main development is the National Cyber Security Strategy 2030, launched by the Minister for Justice, Home Affairs and Migration on 7 October 2026. It contains 29 measures across three pillars: "Detect and Defend", "Enhance National Resilience" and "Strengthen Our Cyber Ecosystem". The Law Society Gazette reports that it commits to implementing the full range of EU cyber security law and that the National Cyber Security Bill is "included for priority publication in the Government's autumn legislative programme".

What has not changed: the Bill itself. According to the Gazette, the Department is still drafting it with the Office of Parliamentary Counsel and the Attorney General's office before it goes to Government. No enactment date has been set.

How did Ireland end up before the Court of Justice?

By missing the deadline and the steps that followed. Article 41 of the NIS2 Directive required Member States to adopt and publish their transposing measures by 17 October 2024 and apply them from 18 October 2024. The Irish Examiner reports that the Commission sent Ireland a letter of formal notice on 28 November 2024 and a reasoned opinion on 7 May 2025.

On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court (Law Society Gazette). It asked the Court to impose a lump sum plus daily penalties until Ireland notifies full transposition (Irish Examiner). The same report says Justice Minister Jim O'Callaghan expects to notify transposition of NIS2 by the end of 2026.

Who will NIS2 cover in Ireland?

The Irish law will follow the Directive, which sets the minimum scope. NIS2 applies to entities in the sectors listed in Annexes I and II that are medium-sized enterprises or larger, under the size-cap rule in Article 2(1). Some entities, such as certain digital infrastructure providers, are covered regardless of size.

Annex I: sectors of high criticality	Annex II: other critical sectors
Energy, transport, banking, financial market infrastructure	Postal and courier services, waste management
Health, drinking water, waste water	Chemicals, food production and distribution
Digital infrastructure	Manufacturing, including computer, electronic and optical products, and electrical equipment
ICT service management (B2B): managed service providers and managed security service providers	Digital providers: online marketplaces, search engines, social networks
Public administration, space	Research

Two groups of smaller tech firms often overlook their position. Managed service providers that run IT for other businesses sit in Annex I. Electronics and electrical equipment manufacturers above the size threshold sit in Annex II.

What will in-scope businesses have to do?

The core duties are set in the Directive and will not change much in transposition:

• Risk-management measures. Article 21(2) lists at least ten areas, including risk analysis, incident handling, business continuity, supply chain security, secure development including vulnerability handling and disclosure, cyber hygiene and training, cryptography, access control, and multi-factor authentication where appropriate.
• Incident reporting. For significant incidents, Article 23(4) requires an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month.
• Management accountability. Article 20 requires management bodies to approve the risk measures, oversee them and follow training, and makes them liable for infringements.
• Fines. Member States must set maximum fines of at least EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities (Article 34).

The 24-hour, 72-hour structure is similar to the Cyber Resilience Act's product reporting, which already applies. Our guide to Cyber Resilience Act reporting explains the product-side rule, and our NIS2 vs Cyber Resilience Act comparison shows how the two fit together.

What has the NCSC already published?

More than many businesses realise. The NCSC is set to be Ireland's "lead competent authority to supervise and enforce NIS2", according to William Fry. It has published draft Risk Management Measures guidance setting out fifteen measures, each with foundational and supporting actions, and it co-owns the Cyber Fundamentals (CyFun) framework that will form the basis of a national certification scheme. The new strategy targets that CyFun-based scheme for Q3 2027 (Matheson).

In July 2026 the NCSC also published cyber governance guidance for management boards. Byrne Wallace Shields summarises its message as "cybersecurity is now a board-level legal responsibility, not an IT matter to be delegated and forgotten". The same note points out that registration with the NCSC and the incident reporting portal will only open once the law is in force, and competent authorities have no NIS2 enforcement powers until then.

What should Irish businesses do now?

Act as if the law will commence in 2027, because the content is settled even if the date is not. A practical sequence:

1. Check scope. Map your activities against Annexes I and II and your headcount, turnover and balance sheet against the medium-sized thresholds.
2. Read the NCSC draft measures. Run a gap analysis against the fifteen Risk Management Measures and Article 21(2).
3. Brief the board. Use the NCSC's board guidance to set out responsibilities and arrange training.
4. Write an incident playbook. Define what a significant incident is for you and who files the 24-hour early warning. If you already run a GDPR breach notification process, extend it rather than starting again.
5. Review suppliers. Supply chain security is a named measure, so expect your own customers to ask you security questions, and ask the same of your vendors.
6. Watch for the Bill. When it is published, check the final entity definitions, registration steps and penalty levels.

What is still uncertain?

Three things. The publication and enactment dates of the Bill are not fixed. The final penalty levels and supervisory structure will only be known from the Bill text, which Matheson notes "remains to be seen", although it is likely to draw on the 2024 General Scheme. And the outcome and timing of the Court case are open. Businesses should treat any date before the Bill is published as an estimate.

Frequently asked questions

Is NIS2 law in Ireland yet?

No. As of November 2026, the National Cyber Security Bill that will transpose NIS2 has not been enacted. The Minister has said he expects to notify transposition by the end of 2026.

Who will enforce NIS2 in Ireland?

The National Cyber Security Centre is set to be the lead competent authority, and the Bill would put it on a statutory footing. It has already published draft risk management guidance and board guidance in preparation.

Does NIS2 apply to small businesses in Ireland?

Generally not to small and micro enterprises, because the Directive's size-cap rule applies it to medium-sized and larger entities in listed sectors. Some providers, such as certain digital infrastructure services, are covered regardless of size, and small firms may still face NIS2 requirements through customer contracts.

What are the NIS2 reporting deadlines?

An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of the notification. Irish reporting channels will open once the law is in force.

Can a business be fined under NIS2 before Ireland transposes it?

Irish competent authorities have no NIS2 enforcement powers until the Act is in force. The risk now is commercial and reputational, plus a short runway once the law commences.

Building a connected product and want a second opinion on its security plan? Book a free 30-minute call with our team.

Cover photo by Selim Karadayı on Pexels.