Where the rules stand

A dated log of Irish and EU rules on cyber security. Anything that is not yet law is labelled as such. Each entry links to its source and says when it was last checked.

1. Pending Pending · not yet law Ireland

   National Cyber Security Bill

   The Bill that will put NIS2 into Irish law and put the National Cyber Security Centre on a statutory footing. The government published its General Scheme on 30 August 2024. It has not been enacted. In July 2026 the Commission said Ireland had still not notified full transposition. We could not confirm whether a final Bill has been published since.

   For a small firm: If you supply essential services, or supply firms that do, expect security questions now, even though the Irish law is not yet in place.

   gov.ie, General Scheme of the National Cyber Security Bill 2024 · checked 18 October 2026

2. 8 Jul 2026 Milestone European Union → Ireland

   Commission refers Ireland to the EU Court of Justice over NIS2

   The Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for not notifying how they have put NIS2 into national law. It asked the Court for a lump sum and daily penalties until full transposition is notified. This followed letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025.

   For a small firm: It shows the Irish law is overdue. It does not mean NIS2 duties already apply to you through Irish law.

   European Commission, Shaping Europe's digital future · checked 18 October 2026

3. 11 Sept 2026 In force European Union

   Cyber Resilience Act reporting duties apply

   Makers of products with digital elements must now report actively exploited vulnerabilities and severe incidents (Article 14). Most other duties of the Act apply from 11 December 2027.

   However, Article 14 shall apply from 11 September 2026

   For a small firm: Relevant if you make or sell software or connected products.

   EUR-Lex, Regulation (EU) 2024/2847, Article 71 · checked 18 October 2026

4. 20 Jan 2026 Proposed · not law European Union

   Cybersecurity Act 2 proposed

   The Commission proposed a new regulation, COM(2026) 11, to replace the 2019 Cybersecurity Act. It covers ENISA's role, EU security certification, and ICT supply chain security, including rules on high-risk suppliers. In October 2026 it was still awaiting a Parliament committee decision. It may change or never pass.

   For a small firm: Nothing to do yet. Watch for changes to supplier rules and certification.

   European Parliament Legislative Observatory, procedure 2026/0011(COD) · checked 18 October 2026

5. 7 May 2025 Milestone European Union → Ireland

   Commission sends Ireland a reasoned opinion on NIS2

   A formal step in infringement proceedings, sent because Ireland had not notified full transposition of NIS2. It came after a letter of formal notice in November 2024.

   For a small firm: It signals that the Irish law is overdue, not that its duties already apply to you.

   European Commission, NIS2 Directive implementation in Ireland · checked 18 October 2026

6. 17 Jan 2025 In force European Union

   Digital Operational Resilience Act (DORA) applies

   DORA sets ICT risk rules for banks, insurers, investment firms and many others in finance. ICT providers they depend on are drawn in as well.

   It shall apply from 17 January 2025.

   For a small firm: Relevant if your customers are regulated financial firms. Expect contract clauses and audits.

   EUR-Lex, Regulation (EU) 2022/2554, Article 64 · checked 18 October 2026

7. 10 Dec 2024 In force European Union

   Cyber Resilience Act enters into force

   The Act sets security rules for products with digital elements. It was published on 20 November 2024 and entered into force twenty days later. Reporting duties apply from 11 September 2026, and most other duties from 11 December 2027.

   This Regulation shall apply from 11 December 2027.

   For a small firm: Relevant if you make or sell software or connected products.

   EUR-Lex, Regulation (EU) 2024/2847, Article 71 · checked 18 October 2026

8. 7 Nov 2024 In force European Union

   NIS2 Implementing Regulation (EU) 2024/2690 enters into force

   Sets detailed technical measures for certain digital providers, such as cloud, data centres and managed service providers. Published on 18 October 2024, it entered into force twenty days later.

   This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

   For a small firm: Relevant if you are a managed IT provider. It is also a useful, detailed reading of NIS2 Article 21 for everyone else.

   EUR-Lex, Implementing Regulation (EU) 2024/2690, Article 16 · checked 18 October 2026

9. 17 Oct 2024 Milestone European Union

   NIS2 transposition deadline passes

   Member States had to adopt their national NIS2 rules by this date and apply them from 18 October 2024. Ireland did not meet the deadline.

   By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive.

   For a small firm: The directive exists, but in Ireland the national rules that apply it are still pending.

   EUR-Lex, Directive (EU) 2022/2555, Article 41 · checked 18 October 2026

10. 16 Jan 2023 In force European Union

    NIS2 Directive enters into force

    Directive (EU) 2022/2555 replaces the first NIS Directive. It widens the sectors covered and adds duties for management and supply chains. It was published on 27 December 2022 and entered into force twenty days later.

    This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

    For a small firm: Whether it applies to you depends on your sector and size, and on the Irish law.

    EUR-Lex, Directive (EU) 2022/2555, Article 45 · checked 18 October 2026

11. Ongoing Guidance Ireland

    NCSC Ireland guidance on NIS2

    The National Cyber Security Centre publishes guidance on NIS2, including risk management measures and incident reporting. It is advice, not law.

    For a small firm: A sound Irish starting point for what "appropriate measures" looks like.

    ncsc.gov.ie, NIS2 · checked 18 October 2026

Rules and their status change. Check anything important against the source before you rely on it. This is not legal advice.