IrelandNational Cyber Security Bill, Cybersecurity Risk-Management Measures
Head 29, General Scheme, National Cyber Security Bill 2024
In committee, dated , as of .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
Where it has got to
The text described here is General Scheme (Heads of Bill) of the National Cyber Security Bill 2024, published .
Locally, this stage is pre-legislative scrutiny of the General Scheme, before formal introduction as a Bill.
The stage above is recorded at www.oireachtas.ie.
An earlier round of pre-legislative scrutiny by the Joint Committee on Transport and Communications on produced no published report before the 33rd Dail was dissolved; the Joint Committee on Justice, Home Affairs and Migration received a fresh briefing on to resume that scrutiny of the same General Scheme.
The Government's Autumn 2026 Legislation Programme, with its status as of , lists the Bill for priority publication with work ongoing, and no National Cyber Security Bill appears in the Oireachtas legislation listing as of . On the European Commission referred Ireland to the Court of Justice of the European Union for failing to notify complete transposition of the Directive.
What it requires
- As drafted, it would reach your service where you are an essential or important entity under the Bill's Schedules I and II, which name an online marketplace, online search engine or cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, drinking water and digital infrastructure, and public administration) are reached too, by declaring that you are an essential or important entity.
- Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or services, with your management board approving and overseeing those measures.
These lines are LexLint's reading of the law's text. Also read by: National Cyber Security Centre (NCSC), Department of Justice, Home Affairs and Migration (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Under Head 36A(14) an essential entity, and under Head 37A(14) an important entity, that without reasonable excuse fails to comply with a compliance notice served to enforce Head 29 commits an offence, and Head 43 extends an offence by a body corporate to a director, manager or other officer who consented, connived or was wilfully negligent. The General Scheme's own financial penalty for the infringement of Head 29 is administrative, imposed by an adjudicator under Heads 44 to 44AW, and Head 41 exempts a public body designated under Head 23 from Head 37B.
Penalty structure
The General Scheme's penalty provision sets the maximum financial penalty for an essential entity's infringement of Head 15 or Head 29 at the greater of EUR 10,000,000 or at least 2 percent of worldwide turnover in the preceding financial year, and a lower tier for an important entity at the greater of EUR 7,000,000 or at least 1.4 percent, mirroring NIS2 Article 34(4) and (5); Head 41 exempts a public body designated under Head 23 from these penalties.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The National Competent Authority the General Scheme would designate per sector under Head 17, with the National Cyber Security Centre serving as the State's CSIRT and single point of contact.
Settledness
- As of
- Guidance link
- https://www.ncsc.gov.ie/nis2/
- Guidance body
- National Cyber Security Centre (NCSC), Department of Justice, Home Affairs and Migration
- Open questions
- Will the enacted Act retain the General Scheme's personal liability for a director or executive on a finding of gross negligence, given NIS2 Article 34 and Recital 128 do not require a Member State to impose personal civil or criminal liability on a natural person for an entity's infringement?
What this law does
Head 29 of the General Scheme would require every essential and important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems it uses for its operations or services, and to prevent or minimise the impact of an incident, transposing NIS2 Article 21.
Head 28 would require the entity's management board to approve and oversee those measures and would hold the board liable for an infringement; the same Head's own explanatory note states that an organisation's management and executives can be found personally liable where gross negligence is found following a cybersecurity incident.
Head 25 would exempt an entity from these measures to the extent an equivalent sector-specific EU regime, such as the Digital Operational Resilience Act for a banking or financial-market-infrastructure entity, already imposes at least equivalent risk-management duties. The General Scheme has undergone pre-legislative scrutiny. As of October 2026 the Government's Autumn 2026 Legislation Programme lists the Bill with work ongoing.
When LexLint raises it
When your app profile says your app operates a social platform, handles health records or runs an essential service.
Back to the example · Lint your app
Page updated .