NIS2 in Ireland

National Cyber Security Bill 2024 - Heads of Bill

Bill, not law yet This page follows the National Cyber Security Bill. The rules can change before it passes.

Bill: National Cyber Security Bill
Authority: National Cyber Security Centre (NCSC)
Classes: essential entity (essential), important entity (important)
Register: NCSC NIS2 registration portal
ISO 27001: Helps, not enough alone

Know when Ireland changes its NIS2 rules

One email when the law, the deadlines or the portal change.

Where the bill stands

No Act exists yet. Only the General Scheme (Heads of Bill) exists. The Government lists the Bill for priority publication in the 2026 autumn session, and work is ongoing. The Minister will set the start date by order. This row follows the General Scheme, which can change.

Name: National Cyber Security Bill 2024 - Heads of BillNational Cyber Security Bill (General Scheme)
Status: Bill, not law yet
Text: Read the National Cyber Security Bill

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Ireland differs

Head 20 of the General Scheme The scheme does not apply Article 3(4) of the Annex to Recommendation 2003/361/EC. Entities that register domain names fall under it at any size.

Also note

The NCSC leads and supervises all sectors not listed for a sector regulator. Sector regulators supervise energy, water, banking, digital infrastructure, transport and health.
The scheme applies to medium-sized and large entities in Annex I or II types.
The NCSC plans a national certification scheme. It expects 18-24 months to set it up, a statement made on its page.
The General Scheme defines essential and important entities in Head 21.

Registration

No duty to register exists yet, because the Bill is not law. The registration portal is not open. The NCSC says it opens after the legislation takes effect. The General Scheme sets a list of essential and important entities and a 2-week duty to report changes. Its registration dates of 2025-01-17 and 2025-04-17 are already past, so a new date must follow.

Portal: NCSC NIS2 registration portal
Rule: The bill sets no registration date yet
You need: Nothing yet. The NCSC says the portal opens after the legislation takes effect.
Changes: Report changes to your data within 14 days

Incident reporting

24 hEarly warning
72 hIncident notification
1 monthFinal reportafter the 72-hour incident notification

Send the reports to the CSIRT, which is the NCSC.

The reporting portal is not yet open. The General Scheme sets these deadlines.

Measures and proof

Essential: The competent authority can direct an essential entity to allow security audits by an independent third party or by the authority. The entity pays for an independent audit.
Important: The authority acts on important entities only after it learns of alleged non-compliance. It then audits after the fact.

Duties of management

The management board approves the risk measures, oversees them and is liable for infringements. Board members take cybersecurity training. The General Scheme notes that management can face personal liability for gross negligence after an incident.

Fines

Under the bill, the ceiling is the higher of a fixed amount and a share of the annual turnover of the entity itself.

Fine ceilings, Head 44AG of the General Scheme. The higher amount applies. Each "At EUR" figure is the ceiling at that entity turnover.
Class	Ceiling	At EUR 20m	At EUR 500m	At EUR 2bn
Essential	EUR 10m or 2%	EUR 10m	EUR 10m	EUR 40m
Important	EUR 7m or 1.4%	EUR 7m	EUR 7m	EUR 28m

An adjudicator sets financial penalties. The General Scheme takes the greater of the euro amount and the percentage. It applies the percentage to the turnover of the entity.