NIS2
NIS2, read from the Directive itself.
Ireland had not transposed NIS2 by 1 November 2026. Eurus reads Directive (EU) 2022/2555 itself and says so in every verdict: whether a business is essential, important or out of scope, and on which provision.
Who it covers
The Directive reaches businesses by sector and by size.
Check whether NIS2 applies to you
By sector
Annex I lists sectors of high criticality, among them energy, transport, banking, health, digital infrastructure and business-to-business ICT service management. Annex II lists other critical sectors, among them postal services, waste, chemicals, food, manufacturing and digital providers.
By size
In those sectors it reaches medium and large businesses: 50 or more staff, or an annual turnover and a balance sheet both over €10 million. Some, such as DNS service providers and trust service providers, are covered whatever their size.
Essential or important
A business in Annex I above the medium ceilings (250 or more staff, or a turnover over €50 million and a balance sheet over €43 million) is essential; the rest in scope are important. The duties are the same; the supervision and the maximum fines differ (Article 34).
What it asks
Measures, approved by management
Article 21 asks for cybersecurity risk-management measures, among them risk analysis, incident handling, business continuity and backups, supply chain security, multi-factor authentication and training. Under Article 20 the management body approves them, oversees them and is accountable for them.
An early warning in 24 hours
Under Article 23, a significant incident is reported to the CSIRT or the competent authority within 24 hours of becoming aware of it.
A notification in 72 hours
An incident notification follows within 72 hours of becoming aware of it, with a first assessment of its severity and impact.
A final report in a month
A final report follows no later than one month after the incident notification.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyHow Eurus handles it
The scoping questions place a business in Annex I or II and apply the size ceilings, and each verdict names its provision. Only a significant NIS2 incident starts NIS2's clocks, and they run from awareness, beside GDPR's 72 hours for a personal data breach.
For a business of 5 to 50 staff
FourWinds, who make Eurus, work hands-on with Irish businesses of 5 to 50 staff, and wrote a guide to this law for them.
Start here
See it on a business of your own.
Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.