Ireland’s Cybersecurity Bill Would Make Boards Accountable Under NIS2

Summary

Ireland’s forthcoming National Cyber Security Bill is expected to implement NIS2, placing cybersecurity oversight and accountability on management boards. The article outlines board-scoping, training and documentation steps, draft penalties, and the bill’s expected 2026

Key points

• NIS2 Article 20 requires management boards to approve and oversee organizational cybersecurity risk measures and take responsibility for them.
• Ireland’s draft National Cyber Security Bill would implement NIS2; its General Scheme includes board obligations under Head 28.
• The article advises organizations to identify which directors and senior executives fall within the definition of a management board and document that assessment.
• Boards are expected to receive ongoing cybersecurity training covering organizational duties, third-party risks and frameworks such as ISO 27001 and NIST.
• The draft bill proposes fines of up to €10 million or 2% of global turnover for essential entities, and up to €7 million or 1.4% for important entities.
• The draft includes personal-liability provisions for directors or senior officers in cases involving wilful neglect or consent, and provides for supervisory engagement and audits.
• Ireland received a European Commission notice over missing the October 2024 transposition deadline; the bill is expected to be introduced in 2026.

Countries