Ireland NIS2 Transposition (National Cyber Security Bill)

Irish bill establishing the NCSC on a statutory footing and transposing NIS2; not yet enacted as of August 2026 and subject to Court of Justice referral.

JurisdictionIreland
CategoryCybersecurity
StatusProposed
Latest development

Analysis

Ireland’s National Cyber Security Bill 2024 is intended to transpose the NIS2 Directive (Directive (EU) 2022/2555) into Irish law and place the National Cyber Security Centre (NCSC) on a statutory footing, but as of August 2026 it remains at General Scheme / heads of bill stage and has not yet been enacted or introduced as a Bill in the Oireachtas, and Ireland has been referred to the Court of Justice of the EU for failure to notify transposition measures. See: General Scheme of the National Cyber Security Bill 2024 – gov.ie, Heads of Bill – National Cyber Security Bill 2024 (assets.gov.ie PDF), NIS2 Directive (EU) 2022/2555 – EUR-Lex, European Commission NIS2 transposition in EU countries, NCSC Ireland NIS2 page.

Because the Bill is not yet enacted, requirements are based on the General Scheme / heads of bill plus the directly binding NIS2 Directive at EU level, and may still change during the Irish legislative process. All implementation planning should therefore treat these as probable obligations and monitor official updates.

Key Requirements (Based on General Scheme of the National Cyber Security Bill 2024 and NIS2)

All factual statements below are grounded in the General Scheme / Heads of Bill, Oireachtas briefing, and NIS2 text; they may be refined in the final Act.

  • Establishment of the National Cyber Security Centre (NCSC) on a statutory footing
  • The General Scheme specifies that the Bill “provides for the establishment of the National Cyber Security Centre (NCSC) on a statutory basis” as an Executive Office of the Minister for the Environment, Climate and Communications and the Department.General Scheme – gov.ie
  • The Heads of Bill PDF further details provisions for establishment of the NCSC on a legislative basis, defining it as the lead competent authority for NIS2 implementation.Heads of Bill – assets.gov.ie
  • Parliamentary material notes that the National Cyber Security Bill “places [the] National Cyber Security Centre (NCSC) on a statutory footing.”Oireachtas written answer – Legislative Programme
  • NIS2 requires Member States to designate one or more competent authorities and a CSIRT; the Irish Bill appoints the NCSC as such authority for NIS2.NIS2 Directive – EUR-Lex, Heads of Bill – assets.gov.ie
  • Transposition of NIS2 and repeal/replacement of NIS1 regime
  • Scope: essential and important entities across expanded sectors
  • Risk management and cybersecurity measures (Article 21 NIS2, reflected in Heads of Bill)
  • Incident reporting obligations and timelines
  • Governance, management accountability, and board-level obligations
  • Supervision, enforcement, and sanctions

Compliance Challenges

Because the Bill is still in draft form, organisations face both substantive and procedural challenges in preparing for compliance.

  • Regulatory uncertainty due to delayed transposition and evolving draft
  • Determining scope and entity classification (essential vs important)
  • Aligning existing security controls with NIS2 risk-management requirements
  • Incident reporting processes and data quality
  • Organisations must design incident detection and reporting workflows capable of meeting 24‑hour and 72‑hour deadlines, which can be difficult when incidents are complex or cross-border.NIS2 Directive – Article 23
  • Irish-focused analyses point out the difficulty for boards and management in ensuring accurate, timely reporting to NCSC/CSIRT-IE while avoiding over-reporting or under-reporting in the absence of detailed national guidance.Bird & Bird analysis – incident reporting, NCSC Ireland NIS2 page
  • Board accountability and culture change
  • Real examples of challenges (Ireland and EU)
  • The European Commission’s reasoned opinion and subsequent referral to the Court of Justice illustrate a systemic challenge: some Member States, including Ireland, have struggled to meet transposition deadlines and establish clear domestic regimes.[NIS2 Directive implementation in

Recent developments

  • — As of 2026-08-12, the Ireland **National Cyber Security Bill 2024** intended to transpose NIS2 has **not yet been introduced in the Oireachtas**, and NIS2 remains untransposed; the “Bill” exists only as a 183‑page General Scheme published on 2024-08-30, with the older NIS1 regulations (S.I. 360/2018) still applying.[10] (source)
  • — Ireland still has not transposed NIS2 and the National Cyber Security Bill 2024 remains unenacted; on 2026-07-08 the European Commission referred Ireland (alongside Spain and France) to the Court of Justice of the EU for failing to notify transposition, while stressing that Irish organisations already need to prepare for NIS2 obligations.[6] (source)
  • — A July 2026 security roundup notes that Ireland was the only one of four referred countries to publicly outline NIS2 implementation plans, with the responsible minister expecting to **notify transposition by end of 2026**, and confirms that the National Cyber Security Bill will transpose NIS2 and place the NCSC on a statutory footing.[8] (source)
  • — The European Commission decided on 2026-07-27 to refer **Ireland, Spain, France and the Netherlands** to the Court of Justice of the EU for failing to notify measures transposing the NIS2 Directive into national law, escalating infringement proceedings against Ireland over the delayed National Cyber Security Bill.[9] (source)
  • — A July 2026 update explains that on 2026-07-09 the Commission referred Ireland to the Court of Justice for failing to transpose NIS2 and notes ministerial statements that Ireland is targeting **notification of transposition by end of 2026**, with NIS2 expected to bring roughly **4,500–6,000 organisations** into scope as essential or important entities.[1] (source)
  • — On 2026-07-07 the Irish **National Cyber Security Centre (NCSC)** published cyber governance guidance for management boards and senior executives of organisations expected to be in scope of NIS2, even though the National Cyber Security Bill has still not been enacted, signalling regulatory expectations ahead of formal transposition.[3] (source)
  • — An April–June 2026 status update describes Ireland’s NIS2 position as **“Draft”**, stating that the National Cyber Security Bill 2024 is not yet enacted, Ireland missed the 2024-10-17 transposition deadline and is subject to infringement proceedings, with NIS1 (S.I. 360/2018) still in force and enactment plus a registration portal expected during 2026.[12] (source)
  • — In a 2026-05-13 parliamentary answer, Ireland’s Minister confirmed that the **National Cyber Security Bill** is being drafted as the legislative vehicle for NIS2, listed as a **priority for publication in the Summer 2026 legislative programme**, and will formally appoint the NCSC as the national competent authority and CSIRT while placing it on a statutory footing.[14] (source)
  • — A March 2026 industry guide highlights that the transition from NIS1 to the **National Cyber Security Bill** will expand the regulatory net from roughly 450 to over **6,000 Irish entities**, and warns in-scope organisations that a July 2026 NIS2 **self‑registration deadline** with the NCSC is approaching, emphasising impacts on supply chain security and incident reporting.[15] (source)
  • — A detailed implementation article explains that the **National Cyber Security Bill 2024** is the planned transposition vehicle for NIS2, replacing S.I. 360/2018, and outlines key features such as a self‑registration requirement three months after the incident‑reporting portal launch and an expected scope of **4,500–6,000 organisations** under Irish NIS2 rules.[4] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates