NIS2 in Ireland: the obligation arrives through your customers, not the regulator

By Eoghan Kenny · 19 October 2026

Ireland has not transposed the NIS2 Directive into national law, and on 8 July 2026 the European Commission referred it, together with Spain, France and the Netherlands, to the Court of Justice of the European Union, seeking lump sum and daily penalties until transposition is notified. For most software companies operating here, this is the wrong detail to focus on. The directive's practical reach into the software sector runs through commercial contracts rather than national enforcement, and that route has been open since October 2024 regardless of what Dublin has legislated.

The transposition delay changes enforcement, not obligation

A directive binds organisations through national law, so until the National Cyber Security Bill passes there is no Irish statute setting out NIS2 duties, no national registration portal and no Irish regulator issuing NIS2 penalties. The absence of those mechanisms is genuine and it is temporary.

What the delay has not altered is the baseline against which everything else is measured. The transposition deadline fell on 17 October 2024, twenty three member states have since passed national legislation, and the customers you serve in those markets are already operating under it. Their obligations became yours the moment they were written into a supply agreement.

Scope is narrow, but supply chain duties are not

NIS2 applies directly to essential and important entities in named sectors, among them energy, transport, banking, health, water, digital infrastructure and public administration. Ireland's transposition is expected to expand the regulated population from roughly 450 entities under NIS1 to between 4,500 and 6,000, which is a tenfold increase but still a small fraction of the economy. A business to business software company is rarely among them.

Article 21 is where the reach extends. In-scope entities must manage the security risks of their supply chain, including the security practices of their direct suppliers, which converts a regulatory duty on them into a contractual requirement on you. The consequence is that the first NIS2 conversation most software companies have is not with a regulator but with a customer's procurement team, working through questions that were not in the previous renewal.

What customers are asking suppliers to demonstrate

The ten measures set out in Article 21 account for most of what appears in supplier clauses. In practice, the requests cluster around six areas: a risk analysis and information security policy with evidence of review rather than one-off authorship; incident handling fast enough to support the customer's own notification deadlines; business continuity and backup management; assessment of your own suppliers; policies on cryptography, access control and asset management; and demonstrable security training.

The overlap with ISO 27001 controls is substantial, which means an organisation running a working management system can answer most of this from records it already maintains. An organisation without one is drafting policy under procurement pressure, and that is where quality problems originate.

Notification timing is the binding constraint

The operational difficulty is timing rather than documentation. Article 23 gives an in-scope entity 24 hours to submit an early warning after becoming aware of a significant incident, 72 hours for a fuller notification and one month for a final report.

Where an incident at a supplier affects the customer's service, the customer cannot meet those deadlines without being told in time, so supplier contracts set an internal notification window measured in hours. Meeting it requires someone reachable outside working hours, a defined escalation route and a decision rule for what counts as reportable, applied by whoever is on call rather than referred upward. Most organisations find the gap sits here rather than in the policy library.

Two different questions, depending on where you sit

For organisations likely in scope directly, the obligations have been binding since October 2024 and the absence of an Irish statute does not suspend them. The National Cyber Security Centre already operates as competent authority and has published board level cyber governance guidance built around the Cyber Fundamentals framework, which is the reasonable standard to work to in the interim.

For the larger group that falls outside scope, the question is narrower and more immediate: can a supply chain security clause be answered from records you already keep, or would answering it mean assembling them? That is the same question a security questionnaire asks, and the same one an ISO 27001 surveillance audit asks. Organisations that find all three uneventful are not those holding the most documentation, but those where ownership, review dates and evidence sit alongside the work itself.

Common questions

Does NIS2 apply in Ireland yet?

The directive has been binding since October 2024, but Ireland has not yet transposed it into national law. The National Cyber Security Bill is the intended vehicle. On 8 July 2026 the Commission referred Ireland to the Court of Justice for failing to notify full transposition.

Is my SaaS company in scope of NIS2?

Probably not directly. NIS2 names essential and important entities in specific sectors, and most business to business software companies fall outside those lists. They are reached instead through the supply chain security obligations of customers who are in scope.

What does NIS2 require of suppliers?

Suppliers are not regulated by NIS2, but in-scope customers must manage supplier risk under Article 21. In practice that produces contractual commitments on incident notification, access control, continuity, encryption and training, each supported by evidence.

How quickly do incidents have to be reported?

An in-scope entity has 24 hours for an early warning, 72 hours for a fuller notification and one month for a final report. Supplier contracts typically set a shorter internal deadline so the customer can meet its own.

Does ISO 27001 cover NIS2?

Not formally, as they are different instruments. The Article 21 measures overlap substantially with ISO 27001 controls, so an organisation running a working management system can answer most supplier questions from what it already maintains.

Get started

How mature is your compliance today?

Our team built a free, practical health check so you can see your maturity across governance, risk, evidence, ownership and operations, which one is holding you back, and what to do about it first. Start the Health Check.