NIS2 revamps Ireland’s cybersecurity landscape: Old regulators, new powers

The NIS2 Directive has significantly reshaped the cybersecurity landscape across the EU. Since the implementation deadline in October 2024, EU Member States have been working to incorporate new standards into their national laws, fostering a dynamic and rapidly evolving regulatory environment. Recently, Ireland’s National Cyber Security Centre (NCSC) published the draft NIS2 Risk Management Measures (RMM) Guidance, which outlines the minimum requirements for essential and important entities.  Ireland has also joined the Cyber Fundamentals Framework (CyFun), originally developed in Belgium, as a scheme co-owner. The CyFun framework offers a structured, risk-based methodology for essential and important entities, assisting them in organising and demonstrating their NIS2 security measures.

While Ireland has not yet implemented the NIS2 Directive, the legislative process is now at an advanced stage, with the NCSC expecting the National Cyber Security Bill to be transposed into law by the end of the year. As implementation is steadily advancing, it is important to consider how it will impact businesses operating in and through Ireland.

NIS2’s overall goal is to achieve a high common level of cybersecurity across the EU. Part of this approach requires Member States to establish one or more Competent Authorities responsible for cybersecurity and enforcement. To ensure smooth cross border compliance, a Single Point of Contact on cybersecurity responsible for liaising with other Member States is also required.

Ireland’s NIS2 Strategy: NCSC as Central Liaison with Sectoral Oversight

Interestingly, Ireland’s proposed implementing legislation takes a different approach to what is outlined in the NIS2 Directive. The NCSC will serve as the Single Point of Contact and act as the Lead Competent Authority, providing advice, guidance, and support to a range of Competent Authorities, each of which will oversee enforcement within their respective sectors. This approach contrasts with Belgium and France for example, where the Centre for Cyber Security Belgium (CCB) and the French Cyber Security Agency (ANSSI) serve as the central authority for all cybersecurity matters. Ireland’s NCSC will act as an overseer. An explanatory note in the Heads of Bill acknowledges that this role does not exist within the NIS2 Directive and “was taken as a policy decision after engagement with the other competent authorities in agreement with the NCSC”.

Regulator Overview

Article 8 of the NIS2 Directive mandates the designation of Competent Authorities, providing for robust oversight and enforcement. Article 27 requires businesses within the scope of the NIS2 Directive to register with these authorities, ensuring compliance and accountability. The full list of National Competent Authorities along with their designated sectors, as set out in head 17 of the draft Bill is as follows:

Main Establishment & Considerations for Digital Service Providers

The main establishment provision within the NIS2 Directive aims to reduce jurisdictional conflicts and regulatory overlap in the digital services space by creating a ‘one-stop-shop’ for incident reporting obligations. The main benefit derived from these provisions is that entities can report incidents to a single Member State rather than multiple jurisdictions, streamlining compliance and reducing the reporting burden for entities in the midst of large-scale cyber incidents.

Digital Service Providers looking to avail of the main establishment concept within the NIS2 Directive should note that the Commission for Communications Regulation (ComReg) will be responsible for this sector in Ireland. ComReg has been noticeably proactive in issuing guidance and developing resources in relation to the NIS2 Directive, indicating that it is preparing to play a significant role in enforcement – this will be welcomed by many businesses, given Ireland’s considerable importance as the European or EMEA headquarters for many of the world’s major tech companies.

Established in 2002, ComReg is a mature, well-resourced statutory body which is responsible for regulating electronic communications and the postal sector in Ireland. ComReg has been instrumental in ensuring compliance throughout the most critical sectors in the Irish economy. Until recently, ComReg was under the leadership of Helen Dixon, who formerly led the Data Protection Commission and was instrumental in its transformation from a small, regionally based office to one of the world’s most influential data protection regulators.

Conclusion

As Ireland moves closer to full implementation of the NIS2 Directive, we are embracing a distinctive regulatory model that balances central coordination with sector-specific oversight. The NCSC’s role as both the Single Point of Contact and Lead Competent Authority reflects a pragmatic approach tailored to Ireland’s regulatory landscape. With the publication of the draft RMM Guidance and Ireland’s co-ownership of the CyFun framework, the groundwork is being laid for a more structured and resilient cybersecurity regime.

Proactive engagement with sectoral regulators, especially ComReg for digital services, will be essential to ensure compliance and to leverage the benefits of streamlined reporting and guidance. Digital services providers can expect a well-resourced, tough but fair regulator capable of engaging with both multinational and national businesses. Some digital services providers may be classified as highly critical and subject to stricter enforcement, including proactive measures such as audits. The specifics of enforcement will become clear once the NIS2 Directive is transposed.

As the National Cyber Security Bill nears enactment, organisations should prepare for a more robust and coordinated cybersecurity environment that aligns with the EU’s broader vision of digital resilience and cross-border cooperation. For further information, please do not hesitate to get in touch with one of the authors or your usual DLA Piper contact.