NIS2 obligations in Ireland

Competent authority & CSIRT Legal ref: Head 17

• Commission for the Regulation of Utilities (CRU): energy, drinking water and wastewater. ecs-org.eu · 28 Oct 2026 · secondary source
• Commission for Communications Regulation (ComReg): digital infrastructure, ICT service management, space and digital providers. ecs-org.eu · 28 Oct 2026 · secondary source
• Central Bank of Ireland (CBI): banking and financial market. ecs-org.eu · 28 Oct 2026 · secondary source
• Iris Aviation Authority (IAA): transport – aviation. ecs-org.eu · 28 Oct 2026 · secondary source
• Commission for Rail Regulation (CRR): transport – rail. ecs-org.eu · 28 Oct 2026 · secondary source
• Minister of Transport: transport – maritime. ecs-org.eu · 28 Oct 2026 · secondary source
• An Agency or Agencies under the remit of the Minister for Health: health. ecs-org.eu · 28 Oct 2026 · secondary source
• Irish NCSC . ecs-org.eu · 28 Oct 2026 · secondary source
• Sectoral authorities. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Schedule I, II

• NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Head 21, 31

• Entities are required to provide the following information to the relevant competent authorities: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Address (of main establishment, other legal establishments in the EU and/or of legal representative outside the EU). ecs-org.eu · 28 Oct 2026 · secondary source
• Contact details of the entity and if applicable, the legal representative. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification as well as type of entity. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities were requested to submit the information by 17 January 2025. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Head 15

• Entities shall notify, without undue delay, the CSIRT of any incident that has a significant impact on the provision of their service. ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements : ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours plus an initial assessment of the impact, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Head 44

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art.11

• Ireland recognises the Belgian Cyber Fundamentals Framework and NIST 2.0. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Draft Law

What changed recently

1. 8 Jul 2026
   Referred by the Commission to the Court of Justice for failing to notify transposition digital-strategy.ec.europa.eu source-checked