Does NIS2 Apply to Your Business?

The EU’s NIS2 Directive significantly widens who is covered by cybersecurity regulation compared to the original NIS Directive, and a lot of Irish SMEs that assume it doesn’t apply to them are wrong.

Who’s actually in scope

NIS2 covers two categories: essential entities and important entities, across 18 sectors including energy, transport, banking, health, digital infrastructure, water, and public administration. Size thresholds generally apply, medium and large organisations in these sectors are typically in scope, with some smaller organisations pulled in too if they play a critical role in a sector’s supply chain.

The part most SMEs miss: NIS2 isn’t just about the businesses directly named in the regulation. If you supply, service, or hold data for an essential or important entity, that entity’s own NIS2 obligations increasingly flow down to you contractually. A logistics company doesn’t need to be critical infrastructure itself to find a large customer suddenly asking for evidence of its cybersecurity controls.

What non-compliance actually costs

Penalties are statutory maximums, not typical outcomes, but they’re real: essential entities face fines up to €10 million or 2% of global annual turnover, whichever is higher. Important entities face up to €7 million or 1.4% of turnover. Directors can also be held personally liable, including temporary management bans in serious cases.

What to do next

The fastest way to know where you stand is a short exposure check, mapping your sector, your customer relationships, and your current security posture against what NIS2 actually requires. Most SMEs find they’re either clearly out of scope, clearly in scope, or in a grey area driven by a specific customer contract, and each of those has a very different action plan.