European Union (NIS) Regulations 2018, Security Requirements
S.I. No. 360/2018, Regs. 17 and 21
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 18 September 2018.
A sector security regimes rule binding public and private bodies.
As of 12 September 2026.
What it requires
- This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2) and a designated operator of essential services in the energy, transport, banking, financial market infrastructure, health, drinking water supply and distribution, or digital infrastructure sectors under Schedule 1; the operator-of-essential-services sector and designation class is a role no activity in this vocabulary expresses, so it is not separately flagged here.
- Take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems you use and to prevent or minimise the impact of an incident on the continuity of your service.
- As a relevant digital service provider, additionally take into account the security of your systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards, and keep documentation sufficient for the competent authority to verify your compliance.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Regulations 17 and 21 create no offence of their own; a person who fails to comply with a compliance notice or an information notice issued to enforce them, under Regulation 30 or 31, or who obstructs an authorised officer under Regulation 29, commits an offence under Regulation 34.
Penalty structure
Regulation 34 makes a person guilty of an offence under Regulation 18, 22, 29, 30, 31 or 33 (not Regulation 17 or 21 directly) liable, on summary conviction, to a class A fine, or, on conviction on indictment, to a fine not exceeding EUR 50,000 for an individual or EUR 500,000 for a person other than an individual.
- Rule
- Fixed only
- As of
- 12 September 2026
- Currency
- EUR
- Fixed cap
- 500,000
Who enforces it
Enforcement body
The Minister (or, for the banking and financial-market-infrastructure sectors, the Central Bank of Ireland) as competent authority under Regulations 7 and 8, acting through an authorised officer appointed under Regulation 28.
What it reaches
Obligation class
Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Regulation 17 requires a designated operator of essential services (an undertaking the Minister or the Central Bank of Ireland designates in the energy, transport, banking, financial market infrastructure, health, drinking water supply and distribution, or digital infrastructure sectors listed in Schedule 1) to take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems it uses and to prevent or minimise the impact of an incident on the continuity of its service.
Regulation 21 imposes the equivalent duty on a relevant digital service provider, an online marketplace, online search engine or cloud computing service under Schedule 2, and additionally requires it to take into account the security of its systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards.
These Regulations transpose the original NIS Directive (Directive (EU) 2016/1148) and, according to the National Cyber Security Centre, remain in full effect pending the National Cyber Security Bill's transposition of its successor, NIS2, and cover the most critical operators in the State in the meantime.
When LexLint raises it
operates_social_platform
Read the law
Statutory Instrument text, Irish Statute Book, S.I. No. 360 of 2018