NIS2 in Ireland: what applies while the Bill is unpublished?

The National Cyber Security Bill itself had not been published as of the Oireachtas answer of 20 October 2026 (only the General Scheme was published, Aug 2024). The form still applies the Directive's scope test. It does not treat an Irish law as in force.

Indicative only, not legal advice.

Check your organisation

Your answers stay in this browser. Submitting the form does not send them to a server, and the page does not store them.

Activity

Annex I is sectors of high criticality. Annex II is other critical sectors. If more than one activity fits, run the check again. Confirm the stricter result with the competent authority.

Size

Use annual figures in euro. Headcount is the number of employees (annual work units if you have them). Medium means 50 or more employees, or turnover and balance sheet total both above EUR 10 million. Large means 250 or more employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Linked and partner enterprises

Add 100 percent of a linked enterprise: a holding or control above 50 percent. Add only your share of a partner enterprise: a holding from 25 to 50 percent. A holding below 25 percent stays out of the total. This is the simple version of Recommendation 2003/361/EC. NIS2 says a public-sector shareholder does not by itself change the size test.

Country

Choose a Member State to see national notes. Austria, Belgium, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Poland, Slovenia and Sweden show national notes. Every other country says that national details are coming soon.

Possible national designation

Optional. Tick a box only if it might apply. The checker cannot see a Member State's list, so the result will tell you to check the designation.

Indicative result only. This is not a legal determination of your NIS2 status and not legal advice. Your status depends on national law and on any identification by your Member State. Confirm it with the competent authority or a qualified adviser.

Try the live demoBook a gap review

Install free from GitHub (self-hosted). Core is the free self-hosted edition.

Last checked: 1 November 2026.

The National Cyber Security Bill is not in force

Ireland's transposition status is draft. The Bill itself had not been published as of the Oireachtas answer of 20 October 2026 (only the General Scheme was published, Aug 2024). On 8 July 2026 the Commission decided to refer Ireland to the Court of Justice for failing to transpose the rules.

What the checker can still tell you

The form applies Directive (EU) 2022/2555: Annex I and Annex II, the medium and large enterprise test, and the size-independent cases in Article 2(2) to Article 2(4). Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4). The result is an indication under the Directive.

Authority and CSIRT

Under the General Scheme, Ireland plans sectoral national competent authorities, with the NCSC as lead authority (and authority for the remaining sectors) and single point of contact. CSIRT-IE sits within the NCSC. The Bill is not in force. No entry-into-force date, registration deadline or registration portal is listed for Ireland.

Incident reporting

The Directive sets an early warning within 24 hours, an incident notification within 72 hours, and a final report no later than one month after the incident notification. Confirm whether those clocks apply to you, and which channel to use, with the authority for your sector.

How GRCompliance helps

GRCompliance can hold the Article 21 measures, the risk register and the incident clocks on infrastructure you control. It does not file an Irish registration and it does not decide your legal status.

Next steps

Check another country. Read the NIS2 checklist for SMEs and the guide to NIS2 incident reporting deadlines. NIS2 compliance software and the self-hosted install are the product pages. Try the live demo or book a gap review.

Other country pages: Austria, Belgium, Finland, Germany, Italy, Luxembourg, Netherlands, Poland, Slovenia, Sweden.

FAQ

Is an Irish NIS2 law in force?

No. Ireland is marked draft. The Bill itself had not been published as of the Oireachtas answer of 20 October 2026 (only the General Scheme was published, Aug 2024). The checker still applies the Directive's scope test.

Who is the Irish authority?

Under the General Scheme, Ireland plans sectoral national competent authorities, with the NCSC as lead authority (and authority for the remaining sectors) and single point of contact. CSIRT-IE sits within the NCSC. This is the Scheme's plan, and the Bill is not in force.

Did the Commission decide to refer Ireland to the Court of Justice?

On 8 July 2026 the Commission decided to refer Ireland to the Court of Justice for failing to transpose the rules. The press release is linked below.

Is there an Irish registration deadline?

No entry-into-force date, registration deadline or registration portal is listed for Ireland. Confirm those points with the authority for your sector.

Is this checker legal advice?

Indicative only, not legal advice.

Directive text: Directive (EU) 2022/2555 on EUR-Lex. Size test: Commission Recommendation 2003/361/EC. Agency overview: ENISA.

Irish sources: Oireachtas, 20 October 2026, General Scheme, August 2024, European Commission, decision to refer.