Home / Insights / Does NIS2 Apply to Your Business?
Compliance / NIS2
Does NIS2 Apply to Your Business?
A plain-English breakdown of who’s in scope and what the deadlines mean for Irish SMEs.
The EU’s NIS2 Directive significantly widens who is covered by cybersecurity regulation compared to the original NIS Directive, and a lot of Irish SMEs that assume it doesn’t apply to them are wrong.
Who’s actually in scope
NIS2 covers two categories: essential entities and important entities, across 18 sectors including energy, transport, banking, health, digital infrastructure, water, and public administration. Size thresholds generally apply, medium and large organisations in these sectors are typically in scope, with some smaller organisations pulled in too if they play a critical role in a sector’s supply chain.
The part most SMEs miss: NIS2 isn’t just about the businesses directly named in the regulation. If you supply, service, or hold data for an essential or important entity, that entity’s own NIS2 obligations increasingly flow down to you contractually. A logistics company doesn’t need to be critical infrastructure itself to find a large customer suddenly asking for evidence of its cybersecurity controls.
What non-compliance actually costs
Penalties are statutory maximums, not typical outcomes, but they’re real: essential entities face fines up to €10 million or 2% of global annual turnover, whichever is higher. Important entities face up to €7 million or 1.4% of turnover. Directors can also be held personally liable, including temporary management bans in serious cases.
What to do next
The fastest way to know where you stand is a short exposure check, mapping your sector, your customer relationships, and your current security posture against what NIS2 actually requires. Most SMEs find they’re either clearly out of scope, clearly in scope, or in a grey area driven by a specific customer contract, and each of those has a very different action plan.
Want the 5-minute version?
Download the one-page NIS2 exposure checklist and work through the six questions from this article yourself, no reading required.
What to do if you are out of scope on paper
Even if NIS2 does not directly cover your business, it may still reach you through your customers. In-scope organisations must manage supply-chain risk, which in practice means security questionnaires, contract clauses and evidence requests landing on their suppliers. If you serve energy, transport, health, digital infrastructure or public-sector customers, expect to be asked how you handle MFA, patching, incident reporting and backups.
Management accountability is the other shift. Under NIS2, senior management is expected to approve and oversee cybersecurity risk measures, which makes this a board conversation rather than only an IT one. The Directive sets out ten risk-management domains, including incident handling, business continuity and backup, supply-chain security, access control and the use of MFA and encryption.
Ireland’s national legislation was still being finalised at the time of writing, so confirm the current position with the National Cyber Security Centre before relying on any deadline. The practical advice does not change: businesses that already have MFA, tested backups, an incident plan and a documented asset list are in a far better place whichever way their scope question lands.