NIS2 in Ireland: the National Cyber Security Bill and what it means for your hosting provider

A practical guide for Irish businesses that host a website, online shop or SaaS application and want to understand what NIS2 means for them. Position as of 30.09.2026.

Short answer

NIS2 is Directive (EU) 2022/2555. Member States had to transpose it by 17 October 2024. In Ireland the transposing law is the National Cyber Security Bill, and we could not confirm on a primary source that it has been enacted as of 30.09.2026.
The European Commission sent Ireland a reasoned opinion on 7 May 2025 and, on 8 July 2026, referred Ireland to the Court of Justice of the EU for not notifying transposition measures.
Annex I of the Directive lists cloud computing service providers, data centre service providers and B2B managed service providers as covered sectors. Whether a particular company is in scope depends on its sector and size, so check it against the final Irish law.
Under the Directive, significant incidents are reported with an early warning within 24 hours, a notification within 72 hours and a final report within one month. These duties sit with the regulated entity, not automatically with its hosting provider.

Where the Irish law stands

The Government published the General Scheme of the National Cyber Security Bill on 30 August 2024. The Oireachtas Library & Research briefing of June 2025 describes the Bill as the vehicle for transposing NIS2 and for giving the National Cyber Security Centre (NCSC) a statutory footing.

Because the final text and its commencement date can still change, this page does not quote Irish section numbers, penalties or registration deadlines. Read the current Bill on oireachtas.ie and the NCSC guidance on gov.ie before you act on a specific date.

What the Directive already says

Even before the Irish law commences, the Directive shows the direction of travel. Article 20 makes the management body of an in-scope entity responsible for approving and overseeing cybersecurity risk-management measures. Article 21 requires technical and organisational measures that explicitly include supply chain security, which is where your hosting provider comes in.

Article 23 sets the 24-hour, 72-hour and one-month reporting sequence. Irish transposition may add detail, so treat these as the baseline rather than the final Irish rule.

What this means if you rent hosting

If your company ends up in scope, your hosting provider becomes a supplier you must be able to describe: where the servers are, how backups work, who to call during an incident and what contract covers personal data. If you are out of scope, the same questions are still a sensible baseline for any production system.

Three Irish scenarios

Dublin software company with EU customers

A SaaS team runs its application on a VPS. Before the law commences, it writes down its hosting supplier, backup routine and an incident contact list, so the 24-hour and 72-hour clocks do not start from a blank page.

Cork web agency hosting client sites

The agency is not sure whether its clients or its own business will be in scope. It keeps a supplier register for its hosting, asks each client to confirm their own status, and does not assume that an EU host covers anyone's legal duties.

Galway online shop on cPanel

The owner checks the sector and size criteria once the final Irish law is published. Until then, updates, backups and a tested restore are the practical steps that do not depend on the outcome.

Common mistakes

Assuming "our host is in the EU, so we are covered". Obligations belong to the entity in scope, not to its supplier.
Quoting a transposition date or penalty from a blog post instead of the enacted text or the Commission tracker.
Having no incident procedure. Twenty-four hours is too short to decide who reports, to whom and with which logs.
Not keeping a record of suppliers: contract, data processing agreement, backup description and incident contacts.

How 4hosting helps

Infrastructure in EU datacentres (Frankfurt). The servers are not in Ireland; 4hosting is an EU hosting provider serving the Irish market.
A data processing agreement under Article 28 GDPR and standard contractual clauses for transfers, plus alignment with ISO 27001. This is alignment, not an ISO 27001 certificate.
Included monthly DevOps, programming and cybersecurity hours in your plan, for example Hardening & Compliance, WAF & DDoS, SIEM & Incident Response and CI/CD & Monitoring. Hours are requested from the client panel and do not roll over.
DDoS protection at L3/L4 up to 1.5 Tbps and free white-glove migration.
4hosting holds no NIS2, ISO or SOC 2 certification, does not certify your compliance and does not sign legal compliance on your behalf. We do not state here whether 4hosting itself falls within NIS2 scope.

FAQ

Is NIS2 already law in Ireland?

The Directive applies as EU law, but Ireland's transposing National Cyber Security Bill could not be confirmed as enacted on a primary source as of 30.09.2026. The Commission referred Ireland to the Court of Justice of the EU on 8 July 2026 for failing to notify transposition.

Does NIS2 apply to every Irish website?

No. The Directive covers entities in listed sectors that meet size criteria. Check your sector and size against the final Irish law or ask a legal adviser.

Does 4hosting certify my NIS2 compliance?

No. 4hosting provides infrastructure in Frankfurt, a data processing agreement and DevOps and security services. Your compliance remains your responsibility.