Why NIS2 matters — and why the clock is already running
The NIS2 Directive sets Europe's baseline for cybersecurity across essential and important sectors — and enforcement is no longer hypothetical. Here is what the law requires, what it costs to ignore it, and where accountability lands.
How we got here
NIS2 has been moving through the EU legislative process for years. The deadlines that matter for Irish organisations have already passed — or are being enforced now.
Proposal published
The European Commission proposes NIS2 as part of the EU Cybersecurity Strategy, recognising that the original NIS Directive no longer matches the threat landscape.
Directive adopted
The European Parliament and the Council formally adopt Directive (EU) 2022/2555 — NIS2.
Enters into force
NIS2 becomes EU law, replacing the original NIS Directive and expanding both the sectors covered and the obligations placed on operators.
Transposition deadline
Member states were required to transpose NIS2 into national law. Ireland's transposition completed after this date, but the Directive's requirements set the direction of travel regardless.
Entities identified
Member states establish their lists of essential and important entities — the population that supervision and enforcement applies to.
Supervision and enforcement
National authorities, coordinated in Ireland by the NCSC, move to registration, supervision and enforcement — including the incident-notification obligations.
The cost of getting it wrong
NIS2 gives national authorities real teeth. The financial and personal exposure is no longer theoretical.
€10m or 2%
Essential entities
The maximum fine is the higher of €10 million or 2% of total worldwide annual turnover.
€7m or 1.4%
Important entities
Important entities face fines of up to the higher of €7 million or 1.4% of worldwide annual turnover.
24 / 72 hrs
Incident notification
Early warning within 24 hours and incident notification within 72 hours of becoming aware of a significant incident, with a final report within one month.
Art. 20
Management liability
Management bodies can be held personally liable for infringements of the risk-management obligations — accountability is not just corporate.
Accountability sits with the board
NIS2 deliberately moves cybersecurity from the IT function to the boardroom. Here is what that means in practice.
Approval is a board duty
Management bodies must approve the cybersecurity risk-management measures an organisation takes and oversee how they are implemented. Cybersecurity can no longer be delegated away entirely.
Personal liability
Members of management bodies can be held liable for failures to meet the risk-management obligations — including, in serious cases for essential entities, a temporary ban from exercising management functions.
Training is mandatory
Management bodies are required to follow cybersecurity training, and to encourage employees at all levels to develop equivalent competence.
Evidence, not assurances
Authorities expect documented governance: policies approved at board level, risk assessments on record, and supplier management you can demonstrate. In an inspection, assurances alone do not satisfy the standard.
The Irish picture
In Ireland, the National Cyber Security Centre (NCSC) is the authority coordinating NIS2 transposition, supervision and enforcement. Ireland transposed the Directive later than the EU's October 2024 deadline, which meant a period of uncertainty for many organisations — but the direction is now settled, and expectations are rising.
Waiting for enforcement to arrive before acting is the most expensive option. Organisations that scope themselves early, understand their obligations and start closing gaps on their own timeline consistently face lower cost and less disruption than those forced to react.
Frequently asked questions
Straight answers to the questions Irish organisations ask us most.
NIS2 covers medium-sized and large organisations operating in the sectors listed in the Directive — from energy, transport, health and water to digital infrastructure, ICT service management and public administration — plus a second group of other critical sectors such as manufacturing, food, chemicals and waste management. Some smaller entities are also covered where their services are critical. Our five-question quick check gives you a fast indication, and a scope assessment settles it definitively.
Find out where you stand
Whether you need a definitive scope decision or a scored view of your readiness across governance, risk, incident response and supply chain, both take minutes — and both are free.