NIS2 significantly broadens its coverage. In addition to traditional critical infrastructure, it now includes many more “essential” and “important” entities, such as key manufacturing, waste, food, digital, and other services. This brings thousands of Irish and EU organisations into scope for the first time. To determine if your organisation is affected, check if your sector is listed in the annexes and whether you meet the size or importance thresholds, such as turnover or staff levels. Review the latest official guidance and consult legal or compliance experts as needed to assess your status and take appropriate action.

 

Even businesses not formally in scope are experiencing indirect pressure, as larger customers, public bodies, and critical infrastructure operators increasingly require NIS2-level controls throughout their supply chains.

 

The directive makes cybersecurity a board-level responsibility, requiring management to approve the security strategy and oversee risk management. It also introduces specific liabilities for board members. In cases of serious non-compliance, individuals on the management body may face administrative fines, temporary disqualification from management roles, or other personal legal consequences, depending on the severity and national implementation. This highlights the need for active board engagement, ongoing oversight, and prompt action to address risks and incidents.