Cybersecurity · Ireland
Cybersecurity law & regulation in Ireland (2026)
Ireland shaded by its cybersecurity status
Cybersecurity in Ireland: sectoral rules.
FrameworkCurrent in-force framework is a patchwork: NIS1 Regulations (S.I. No. 360/2018) supervised by the National Cyber Security Centre (NCSC) and sectoral competent authorities, plus DORA for financial entities (S.I. No. 20/2025) supervised by the Central Bank of Ireland. A comprehensive NIS2 transposition — the National Cyber Security Bill 2024 — is still at General Scheme stage and expected to be enacted in 2026.
Ireland currently regulates cybersecurity through a sectoral patchwork anchored by the 2018 NIS1 Regulations (S.I. 360/2018) and sector-specific rules such as DORA for financial entities, with the NCSC acting as national CSIRT and lead competent authority. The NIS2 Directive transposition is delayed — the General Scheme of the National Cyber Security Bill 2024 was published on 30 August 2024, Ireland missed the EU's 17 October 2024 deadline and received a formal infringement notice from the European Commission, and the Bill is expected to be introduced to the Oireachtas in 2026. Until enactment, NIS1 obligations continue to apply, while NCSC has issued draft Risk Management Measures guidance (June 2025) to prepare in-scope entities for NIS2.
NIS2 & cybersecurity law in Ireland
In Ireland, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.
- Framework
- the NIS2 Directive (EU) 2022/2555, transposed into national law
- Approach
- cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities
- Applies to
- medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration
- Incident reporting
- an early warning within 24 hours and a full notification within 72 hours to the national CSIRT
- Maximum fine
- up to €10 million or 2% of global annual turnover for essential entities
- Oversight
- the national competent authority and CSIRT designated under NIS2
NIS2 is a directive, so Ireland implements it through national law; exact scope and deadlines can vary slightly by transposition.
NIS2 in Ireland: FAQ
Yes. As an EU member, Ireland has transposed the NIS2 Directive (EU) 2022/2555 into national law, covering essential and important entities in critical sectors.
Medium and large organisations in sectors such as energy, transport, banking, health, water, digital infrastructure and public administration.
An early warning within 24 hours of becoming aware and a fuller incident notification within 72 hours to the national CSIRT.
Up to €10 million or 2% of global annual turnover for essential entities, with lower ceilings for important entities.
Key points
S.I. No. 360/2018 transposes the NIS1 Directive and remains in force, designating competent authorities (Minister for Environment, Climate and Communications, Central Bank, CRU, ComReg, IAA, HSE) and the NCSC as Ireland's CSIRT, with incident-notification duties for operators of essential services and digital service providers.
The General Scheme of the National Cyber Security Bill 2024 was published on 30 August 2024 but was not enacted by the EU's 17 October 2024 deadline; Ireland received a formal notice from the European Commission with possible referral to the CJEU, and the Bill is scheduled for introduction to the Oireachtas in 2026.
The EU Digital Operational Resilience Act applied from 17 January 2025 and is implemented nationally by the European Union (Digital Operational Resilience) Regulations 2025 (S.I. No. 20/2025); the Central Bank of Ireland supervises in-scope financial entities and can impose administrative sanctions, including fines up to €10 million or 10% of annual turnover.
Under the NIS2 model to be transposed, significant incidents must be reported to CSIRT-IE/NCSC with a 24-hour early warning, a 72-hour incident notification and a final report within one month; DORA imposes a parallel major ICT-related incident reporting regime for financial entities to the Central Bank.
The National Cyber Security Centre (within the Department of Environment, Climate and Communications) is the lead competent authority and national CSIRT; it published draft NIS2 Risk Management Measures guidance on 24 June 2025 and Cyber Governance Guidance for management boards, built around its Cyber Fundamentals (CyFun) framework.
Alongside the NCSC as lead authority, sectoral oversight falls to the Commission for Regulation of Utilities (energy/water), Central Bank of Ireland (banking/financial market infrastructure/DORA), ComReg (electronic communications), Irish Aviation Authority (aviation) and National Transport Authority (transport); this split will continue under the National Cyber Security Bill.
Timeline - major decisions & events
Ireland's National Cyber Security Centre released its most detailed national cyber risk review to date, warning of escalating nation-state activity (notably China- and Russia-aligned actors), supply-chain risk, and cascading cross-sector impacts. It frames the threat picture driving Ireland's expanding cybersecurity obligations.
Department of Justice / NCSC (gov.ie) ↗The EU Digital Operational Resilience Act (Regulation 2022/2554) became directly applicable, imposing ICT risk-management, incident-reporting, resilience-testing and third-party oversight duties on banks, insurers, investment firms and others. The Central Bank of Ireland is the competent supervisor, including for Threat-Led Penetration Testing.
Central Bank of Ireland ↗The EU deadline to transpose the NIS2 Directive (EU 2022/2555) lapsed while Ireland was still drafting its enabling legislation, leaving the expanded obligations not yet in domestic force. It marked a compliance gap that the National Cyber Security Bill is intended to close.
NCSC Ireland ↗The government published the heads of the Bill to transpose NIS2, placing the NCSC on a statutory footing for the first time, designating sectoral competent authorities, and introducing tight incident-reporting timelines (24-hour early warning). It expands regulatory scope from roughly 450 to several thousand entities.
Department of Justice (gov.ie) ↗Ireland's Health Service Executive suffered the most significant cyberattack on an Irish state body, shutting down nationwide health IT for weeks with recovery costs exceeding €100m. The incident reshaped national cyber resilience priorities and investment in the NCSC.
Health Service Executive ↗Ireland's second national strategy set out a broader framework for protecting critical infrastructure, growing the NCSC, and deepening EU/international cooperation, building on operational experience since 2015. It guided the country's cyber policy through the NIS1 era and the HSE attack response.
NCSC Ireland ↗S.I. No. 360/2018 implemented the original NIS Directive, imposing security and 72-hour incident-notification duties on Operators of Essential Services and Digital Service Providers, with fines up to €500,000. This established Ireland's first sector-wide statutory cybersecurity obligations.
Irish Statute Book ↗Ireland's first dedicated cybercrime statute created offences for unauthorised access, interference and interception of information systems, fulfilling obligations under the Budapest Convention and EU Directive 2013/40/EU. It gave law enforcement new search-and-seizure powers for cyber offences.
Irish Statute Book ↗The government formally established the National Cyber Security Centre (building on CSIRT-IE) and published Ireland's first National Cyber Security Strategy (2015-2017). This created the institutional foundation for national incident response and critical-infrastructure protection.
NCSC Ireland ↗Ireland - other topics
Cybersecurity in other countries
Last verified 10/1/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →