NIS2 Ireland Status 2026, Still No Law and a CJEU Referral

NIS2 Ireland is the rare compliance question with a short answer. There is no Irish NIS2 law. The transposition deadline of 17 October 2024 passed, the National Cyber Security Bill 2024 exists only as a General Scheme, and on 8 July 2026 the Commission referred Ireland to the Court of Justice of the European Union. Ireland went to the Court alongside Spain, France and the Netherlands, and the NIS2 transposition status for all 27 member states shows how small that group has become. The delay reaches well past Dublin, because Article 26 of Directive (EU) 2022/2555 puts cloud, data centre, managed service and online marketplace providers under the supervision of the member state where they take their cyber risk decisions, and for much of the American technology industry in Europe that member state is Ireland.

Has Ireland Implemented NIS2?

No. Ireland has not transposed NIS2, and the last legislative step taken was pre-legislative scrutiny of the General Scheme, which opened on 17 October 2024 and was never completed. Until an Act commences there is no Irish registration duty, no Irish incident reporting duty and no Irish fine.

What does bind Irish operators is NIS1, transposed as S.I. 360/2018, which remains in force and enforceable until it is repealed. If you were an operator of essential services or a digital service provider in 2018, your obligations did not pause while the successor regime sat in a drafting outline.

NIS2 Ireland Transposition Stalled at a 183 Page Drafting Outline

The General Scheme of the National Cyber Security Bill 2024 was published on 30 August 2024 and runs to 183 pages. A General Scheme precedes the Bill itself, so a full Bill still has to be drafted, introduced, passed by both Houses, signed and then commenced by order.

Cabinet approved priority drafting on 24 July 2024. Pre-legislative scrutiny began at the Joint Committee on Transport and Communications on 17 October 2024, the same day the EU deadline expired, and the report never appeared before the 33rd Dáil dissolved and the 26th Seanad ceased, per the Oireachtas Library and Research Service briefing paper of 12 June 2025. The NCSC published draft Risk Management Measures on 24 June 2025. The Summer 2026 Legislation Programme lists the Bill for priority publication, per Matheson, and the responsible department has said Ireland expects to notify transposition by the end of 2026, per The Record. Ministerial timelines on this file have already moved, so we would not plan against that one.

Ireland took over the presidency of the Council of the European Union on 1 July 2026, seven days before the Commission asked the Court to fine it for failing to transpose the Union’s cyber security directive.

The status is worth stating flatly because much of the secondary material gets it wrong. Wikipedia and several vendor pages describe the Bill as published by the Oireachtas or moving through committee stage. The gov.ie publication record, the NCSC and the Oireachtas itself show a General Scheme and nothing beyond it. If the open question is whether the regime would reach your organisation on commencement, the sector and size tests in the NIS2 applicability checker run off the directive, and our read is that the Irish text will track the directive on scope rather than widen it.

The Commission Asked the Court for a Lump Sum and Daily Penalties Under INFR(2024)0279

On 8 July 2026 the Commission referred Ireland to the Court of Justice of the European Union under infringement procedure INFR(2024)0279, asking the Court to impose financial sanctions consisting of a lump sum and daily penalties until Ireland notifies complete transposition. The sanctions fall on the state, not on entities, and they are the reason the Irish drafting timetable stopped being a domestic matter.

The chain is short and dated. Deadline 17 October 2024, letter of formal notice 28 November 2024, reasoned opinion 7 May 2025, referral 8 July 2026, per the Commission press release. Twenty-three member states received formal notices in November 2024. Four were referred to the Court, Ireland under INFR(2024)0279, Spain under INFR(2024)0270, France under INFR(2024)0274 and the Netherlands under INFR(2024)0288. No judgment has issued.

The referral runs under Article 260(3) TFEU, which lets the Court impose financial sanctions in the first judgment where a member state has failed to notify transposition. In earlier transposition cases the Commission has withdrawn once the state legislated, which is context rather than a forecast, and the two elements do not behave the same way. A daily penalty stops running on notification. A lump sum addresses the period of the breach that already happened.

Irish Entities Are Already Meeting NIS2 Through Their German and Nordic Customers

The absence of an Irish Act does not mean an Irish company sees no NIS2. Article 21(2)(d) of Directive (EU) 2022/2555 makes supply chain security a duty of every essential and important entity in the member states that did transpose, and those entities discharge it through their suppliers.

An Irish managed service provider serving a German essential entity is answering security questionnaires and signing contractual annexes written out of NIS2 today, with no Irish law involved. That is the real Irish exposure in 2026, and it arrives through procurement rather than through a regulator. In our assessment there is a second channel for public sector bodies, since after a transposition deadline expires the unconditional and sufficiently precise provisions of a directive can be relied on against the state and its emanations, though the scope of that is a question for counsel rather than for a compliance function.

Nine Competent Authorities Would Split Irish Supervision, With the NCSC in the Lead

Head 17 of the General Scheme would designate competent authorities by sector and Head 18 would make the National Cyber Security Centre the lead competent authority. Nine bodies would share supervision, so the regulator that matters to an entity is settled by its sector before anything else is.

The NCSC would also hold the CSIRT function under Head 12 and the single point of contact role under Head 13. Its technical powers are the sharpest part of the Scheme, covering scanning under Head 6, DNS blocking and sinkholing under Head 7, sensor deployment on the networks of essential and important entities under Head 8, temporary sensors on communications networks under Head 9, and coordinated vulnerability disclosure under Head 16. Data captured under the sensor powers could be held for up to 18 months, with destruction certified to the High Court, a safeguard the Irish Council for Civil Liberties considers insufficient across Heads 6 to 10.

Head 19 would amend the Communications Regulation Act 2002 so that ComReg can extend its levy to the entities it supervises. Supervision under the Irish model would carry an invoice to the supervised.

Scope Would Run From a Few Hundred NIS1 Operators to Several Thousand Entities

Estimates of the Irish NIS2 population run from around 3,500 in earlier NCSC and Philip Lee figures to between 4,500 and 6,000 in the 2026 SureCloud analysis, against roughly 120 supervised operators under NIS1 on the NCSC and Philip Lee count and around 450 on SureCloud’s. The spread is itself the finding, because nobody supervising the transition has published a settled number.

The size test runs off Commission Recommendation 2003/361/EC rather than off a single headcount. An entity in an Annex I sector is essential where it exceeds the ceilings for a medium-sized enterprise, meaning 250 or more staff, or turnover above €50 million together with a balance sheet total above €43 million. Important status attaches at 50 or more staff, or turnover above €10 million together with a balance sheet total above €10 million. Several Irish guides compress this into an “and” between headcount and turnover, which quietly narrows the test. A manufacturer with 400 staff and €30 million turnover is essential under the Recommendation and exempt under the summary, and the summary is the one most people have read. Our walkthrough of how the NIS2 size and sector tests interact sets out the sequence.

Size falls away entirely only for the categories listed in Article 2(2) of the directive, which are providers of public electronic communications networks or publicly available electronic communications services, trust service providers, TLD name registries and DNS service providers, together with the case-specific triggers such as being the sole provider of a service in a member state. Cloud computing providers, data centre providers, content delivery networks and managed service providers appear in Annex I but stay inside the size test unless one of those triggers catches them.

The exclusions are as specific. Head 23 of the General Scheme defines a public administration entity in terms that do not include the judiciary, parliaments or central banks. Activities in national security, public security, defence and law enforcement sit outside the regime. DORA operates as lex specialis for financial entities within its scope, which the NCSC states directly, so banking and financial market infrastructure entities look to DORA for ICT risk management and incident reporting rather than to this Bill. The Critical Entities Resilience Directive is being transposed separately through the Department of Defence.

Head 31 Registration Would Run Through a Portal the NCSC Has Not Switched On

Head 31 would require in-scope entities to file a registration data set with the NCSC covering the entity name, its sector, subsector and type under Annex I or Annex II, the address of its main establishment and other EU establishments or its representative, contact email and telephone details, the member states where it offers services, and its IP ranges. The NCSC has both the registration portal and the incident reporting portal in place and states that they are not available at this time.

Article 27 of Directive (EU) 2022/2555 set 17 January 2025 as the registration date for certain digital providers and requires changes to be notified within three months. In Ireland that date passed without an obligation attaching, because there is no Act for it to attach to. Several vendor pages still cite a July 2026 Irish self-registration deadline as fact. There is no commencement order and the portal is shut.

Certification is a separate track and it would be voluntary. Head 30 would permit the use of cyber security certification schemes, transposing Article 24 of the directive, and the NCSC has signalled a forthcoming Irish Cyber Security Measures Certification scheme that will encompass NIS2 aligned measures, with a level intended to help SMEs and Cyber Fundamentals adopted as the reference framework. No standard would be mandatory by name. The Irish obligation that would bite is registration.

The substantive duties would follow Article 21 of Directive (EU) 2022/2555 through Head 29, covering risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, cryptography and access control, with incident reporting under Head 15 following the 24 hour early warning, 72 hour notification and one month final report sequence. Those requirements are common to every member state and we set them out in full in our guide to the NIS2 directive requirements.

Data Centres Took 23% of Irish Metered Electricity in 2025

Head 31 names data centre providers and cloud computing providers among the entities that would have to register, and ComReg would hold the widest single designation, covering digital infrastructure, ICT service management, space and digital providers. The concentration behind that designation is what makes the Irish gap different from the Spanish or French one.

CSO figures published on 7 July 2026 put data centre consumption at 23% of total metered electricity in 2025, up from 22% in 2024 and 5% in 2015. Consumption rose from 6,973 GWh to 7,663 GWh year on year, an increase of roughly 10%. Measured against 2015 the rise is 518%. More than 80 data centres operate in Ireland according to DataCenterDynamics, clustered around Greater Dublin, and Dublin sits in the FLAP-D group of leading European markets.

Article 26 of the directive is where this stops being a domestic story. For cloud computing, data centre, content delivery, managed service and online marketplace providers, jurisdiction follows the main establishment, meaning the place where decisions on cyber risk management measures are taken. Where that place is Dublin, the supervising authority is an Irish authority that has not yet been designated by an Act. In our assessment that is the most consequential feature of the Irish delay and the one least visible from inside Ireland.

The Scheme does treat the sector carefully in one respect. To obtain traffic data at OSI Layers 1 to 4 from data centre operators or public communications networks, the NCSC would have to apply ex parte to the High Court on sworn information, and the court could exclude the public where disclosure would endanger the security of the state.

Proposed Fines Would Reach €10 Million or 2%, With a High Court Judge Confirming Them

Head 44 proposes administrative fines of up to the greater of €10 million or 2% of worldwide annual turnover in the preceding financial year for essential entities, and the greater of €7 million or 1.4% for important entities. These are figures in a drafting outline, not Irish law. They match the directive ceilings, which is why they belong to Head 44 of the General Scheme when quoted and never to an Irish instrument in force.

The ceilings would attach to breaches of Head 29 on cyber security risk management measures and Head 15 on incident response and reporting. Other breaches would run through compliance notices under Heads 36, 36A, 37 and 37A, with Head 37B covering failure to comply with a notice.

The enforcement mechanism is the part worth reading twice. An independent adjudicator would decide whether a breach occurred and what sanction applies under Heads 44AC and 44AD, and the sanction would take effect only once the High Court confirms it under Head 44AE, with the sequence running to Head 44AV. Our read is that a fine routed through an adjudicator and then through a judge lands materially later than one a supervisory authority imposes directly, and rests on a materially thicker evidential record.

Head 43 would create an offence by a body corporate, with a director, manager, secretary or officer liable where the offence was committed with their consent or connivance, or is attributable to their wilful neglect. Figures circulating for criminal penalties, including €5,000 on summary conviction, €50,000 or up to five years on indictment and €250,000 for certain breaches, come from a single secondary source, NIS Solutions, and we could not locate support for them in the published General Scheme.

Classification and Registration Data Are the Work the Delay Cannot Postpone

Nothing in the Irish timetable prevents an entity from establishing where it sits and assembling what Head 31 would ask for. That work carries over unchanged on the day an Act commences, and most of it answers customer questionnaires in the meantime. Where external help is part of the plan, our compliance provider directory lists NIS2 specialists by regulation and country.

1. Confirm what applies today. If you were an operator of essential services or a digital service provider under S.I. 360/2018, those obligations are live and enforceable, and they are the only Irish cyber security duties that currently are.
2. Classify against Annex I and Annex II by sector, then against Recommendation 2003/361/EC on size, using the “or” between headcount and the financial ceilings rather than the “and” most summaries use. The NIS2 scope checker runs both tests in sequence.
3. Identify which of the nine authorities under Head 17 would supervise you, and whether DORA or the separate CER transposition displaces the Bill for your activity.
4. Assemble the Head 31 data set, including the IP ranges field. In our assessment that field is the item most organisations will struggle to produce at short notice, and it is the one a commencement order gives no time to build.
5. Map existing controls against Article 21 of Directive (EU) 2022/2555 and the NCSC draft Risk Management Measures of 24 June 2025, using Cyber Fundamentals as the reference framework Ireland has adopted.

The one date not worth planning around is the date of the Act. Pre-legislative scrutiny died with a dissolution, ministerial timelines have already moved, and the Court of Justice has been asked to charge Ireland by the day until the transposition is notified.