Where transposition currently stands

NIS2 came into effect on 17th October 2024. Ireland missed that deadline and has still not transposed the directive. The vehicle is the National Cyber Security Bill, approved for priority drafting in July 2024, with the General Scheme published on 30th August 2024. The Bill remains unenacted.

On 8th July 2026 the European Commission referred Ireland to the Court of Justice of the EU over incomplete transposition, alongside Spain and France, seeking daily fines until each country transposes. The Minister for Justice has said he expects to notify transposition by the end of 2026.

Until the Bill is enacted, the NIS1 framework continues to apply, implemented in Ireland through S.I. 360/2018. That covers a much smaller population of operators than NIS2 will.

Government estimates put roughly 4,500 to 6,000 organisations in scope once the legislation passes.

The competent authority map

The General Scheme designates competent authorities’ sector by sector, with the NCSC as lead national authority and national CSIRT. Note that these designations sit in a draft General Scheme rather than enacted law and could change in the final Bill.

Sector	Designated competent authority
Energy, drinking water, wastewater	Commission for Regulation of Utilities (CRU)
Digital infrastructure, ICT service management, space, digital providers	Commission for Communications Regulation (ComReg)
Banking and financial markets	Central Bank of Ireland
Aviation	Irish Aviation Authority
Rail	Commission for Rail Regulation
Maritime	Minister for Transport
Road	National Transport Authority
Health	Health sector agencies
All sectors, lead authority and CSIRT	National Cyber Security Centre (NCSC)

 

The Minister may designate additional competent authorities. Under the General Scheme these authorities will have audit and inspection rights, including unannounced inspection powers, alongside enforcement powers including the issuing of compliance notices.

The Bill also introduces a self-registration requirement. In-scope organisations will need to assess their own status and register with the NCSC within a set period after the system goes live, rather than waiting to be told they are in scope.

What the CRU is

The Commission for Regulation of Utilities is Ireland’s independent energy and water regulator, established in 1999 and formerly known as the Commission for Energy Regulation. It has around 196 staff and an annual budget of roughly €29.4 million, and reports to the Department of Climate, Energy and the Environment.

Its existing remit covers security of energy supply, network delivery, competition in electricity generation and gas supply, energy safety, and economic regulation of Uisce Éireann for water and wastewater services. It licenses and monitors electricity generators and sets network revenue allowances.

One point worth drawing out for an Irish audience: the CRU jointly regulates the all-island Single Electricity Market with the Utility Regulator in Northern Ireland and has done since 2007. That cross-border relationship already exists, which matters given that NI operators sit under UK NIS Regulations rather than NIS2.

The essential character of the CRU is that it is an economic and safety regulator being handed a cybersecurity supervisory role. That is precisely what happened to Ofgem in 2018, which is what makes the comparison useful.

The Ofgem precedent, in detail

Ofgem was designated under the UK Network and Information Systems Regulations 2018 as a competent authority for the downstream gas and electricity sectors in Great Britain, acting jointly with the government department now known as DESNZ. It has since built a dedicated Cyber Regulatory Directorate to carry out the function.

The supervisory model Ofgem developed has several distinct components, and this is the part most useful to an audience wondering what supervision will actually feel like.

• Assessment against the NCSC Cyber Assessment Framework, with a target CAF Profile set for operators of essential services to work towards
• A self-assessment and improvement report submitted by the operator
• An improvement plan agreed with the regulator, tracking progress towards the target profile
• An assurance programme covering assurance strategy, programme plan and activity reporting
• Assurance activity under Regulation 16 including audit, operational exercising and technical testing, carried out by approved cyber security consultancies rather than by the regulator directly
• A published inspection framework and defined compliance reporting timelines
• Published enforcement guidelines and penalty policy, covering enforcement notices, penalty notices and alternative tools

Two observations worth making on the call. First, this took years to build. Ofgem’s first competent authority guidance was published in November 2018 and the guidance is now at version 3.0, published January 2026, with the assurance approach revised again in 2025. Supervision arrived gradually rather than switching on with the legislation.

Second, enforcement is a chain rather than a single event. Assessment leads to evidence requests, which lead to required improvements, which lead to formal enforcement only where progress is insufficient. That is a more useful thing for an audience to understand than the headline fine figure.

Where the parallel holds and where it does not

• Holds: an economic regulator taking on cybersecurity supervision of operators it already licenses and monitors on other grounds
• Holds: the likely shape of supervision, being framework assessment, self-assessment, improvement planning, and third party assurance rather than the regulator inspecting everything itself
• Holds: the gradual build, with guidance evolving over several years rather than arriving complete
• Does not hold: the framework itself. Ofgem uses the NCSC Cyber Assessment Framework, which is a UK instrument. Ireland has the NCSC’s draft Risk Management Measures and, separately, Cyber Fundamentals as a voluntary structured route.
• Does not hold: the legal basis. UK NIS Regulations 2018 transpose NIS1, not NIS2. The obligations differ, particularly on governance accountability and supply chain.
• Does not hold: Ofgem is a joint competent authority with a government department. The General Scheme designates the CRU alongside the NCSC as lead authority, which is a different arrangement.

What we do not know

• The CRU has published no consultation, guidance, strategy or statement on how it will supervise NIS2. Nothing describing its intended approach exists in the public domain as of August 2026.
• It is not known whether the CRU will adopt a framework-based assessment model, whether it will use the NCSC’s Risk Management Measures directly, or whether it will develop sector-specific guidance of its own.
• It is not known how the CRU will resource the function, or whether it will build a dedicated directorate as Ofgem did.
• It is not known whether existing NIS1 operators regulated under S.I. 360/2018 will transition into the new regime differently to newly in-scope organisations.
• The competent authority designations themselves sit in a draft General Scheme. They are widely expected to carry through, but the Bill has not been published in final form.

The safe framing for the session is that Ireland knows who its regulators will be but not yet how they will supervise, and that the Ofgem model is the closest available guide to what a utilities regulator does when handed this job. That is both accurate and genuinely useful. Anything stronger risks being contradicted by someone in the room who deals with the CRU regularly.

Useful supporting points

• The NCSC published Guidance on Cyber Governance for Management Board Members in NIS2 Entities on 7th July 2026, stating that NIS2 assigns cybersecurity risk management accountability to the highest level of executive management.
• Article 20 of NIS2, covering management body accountability, appears as Head 28 of the General Scheme.
• NIS2 penalties run to a maximum of €10 million or 2% of global annual turnover for essential entities.
• Obligations are already reaching Irish organisations through contracts and supply chains, as customers and partners in member states that have transposed push incident reporting and control requirements onto Irish suppliers regardless of Irish law.
• Belgium transposed on 5th February 2026 and the Netherlands approved its implementing law in July 2026, so Irish organisations supplying into either market are already dealing with counterparties operating under a live regime.

Suggested framing for the CRU segment

A structure that avoids overclaiming while still being useful:

• Here is who supervises what in Ireland, and it is already decided
• Here is what none of them have started doing yet, and why
• Here is what an economic regulator did when handed this job in a neighbouring jurisdiction, in detail
• Here is what that suggests about the direction of travel, framed as reasonable expectation rather than announced policy
• Here is what an organisation can usefully do now regardless of which model emerges, which is where Cyber Fundamentals and the Risk Management Measures come in

Sources

Topic	Source
Competent authority designations	Arthur Cox, Are you cyber ready? Key points of the NIS2 Directive
Transposition status and CJEU referral	European Commission referral, 8 July 2026, reported July 2026
Scope estimate of 4,500 to 6,000 entities	Reported July 2026
CRU remit, budget and staffing	cru.ie and public records
Single Electricity Market joint regulation	cru.ie, What we do
Ofgem competent authority designation	Ofgem Competent Authority Guidance for DGE in GB, November 2018
Ofgem CAF profile, improvement plans, assurance	NIS Guidance for Downstream Gas and Electricity OES in GB v3.0, January 2026
Ofgem Regulation 16 assurance activity	Ofgem NIS Security Assurance Guidance (Concept) for DGE Sector, April 2025
NCSC board governance guidance	NCSC Ireland, 7th July 2026
Article 20 as Head 28	IAPP, May 2026
NIS1 implementation in Ireland	S.I. 360/2018