Read our latest case study on how a Gen-AI-enabled workflow can transform a generic repair activity into a root-cause and product improvement intelligence
The Irish context for the Cyber Resilience Act
The Cyber Resilience Act is an EU regulation, so it applies directly in Ireland without a separate Irish transposition statute. That distinction matters: unlike NIS2, Irish product companies do not need to wait for an Oireachtas Bill before CRA obligations begin to apply.
Atanu
11/6/20262 min read
The Irish context for the Cyber Resilience Act
The Cyber Resilience Act is an EU regulation, so it applies directly in Ireland without a separate Irish transposition statute. That distinction matters: unlike NIS2, Irish product companies do not need to wait for an Oireachtas Bill before CRA obligations begin to apply.
What is already live in Ireland
Since 11 September 2026, manufacturers with products with digital elements available on the EU market must report actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform. The initial early-warning report is due within 24 hours of awareness.
Ireland’s National Cyber Security Centre (NCSC) is the national CSIRT, CSIRT-IE, and the coordinating CSIRT for Article 14 reports from Irish-based manufacturers. It published national guidance on CRA reporting obligations and operates a dedicated helpdesk at cra_helpdesk@ncsc.gov.ie.
This creates a practical first step for Irish SMBs: read the NCSC guidance, identify the person responsible for reporting, and rehearse the internal escalation path before an incident occurs.
NIS2: not yet Irish law
Ireland missed the NIS2 transposition deadline of 17 October 2024. As of the project’s research cut-off, the National Cyber Security Bill had not been introduced in the Oireachtas, and the European Commission referred Ireland to the Court of Justice on 8 July 2026 for failure to transpose the directive.
That means claims that “NIS2 regulates Irish SaaS companies” are premature. NIS2 obligations will depend on the final Irish law, entity classification, sector, and size. Many product-focused SMBs may not be directly in scope even after transposition.
However, NIS2 still matters commercially. Larger customers that are in scope must manage supply-chain cybersecurity risk. They are likely to request SBOMs, vulnerability-management evidence, secure-development practices, incident contacts, and contractual security commitments from suppliers.
Enforcement is still developing
Ireland had not designated a CRA market-surveillance authority as of the research cut-off. The National Cyber Security Strategy 2030, published on 7 October 2026, commits to legislation designating a notifying authority and market-surveillance authority, together with a penalties regime, by Q4 2027.
This reduces immediate enforcement uncertainty, but it does not reduce commercial pressure. Reporting duties are already enforceable in principle, customers are already demanding evidence, and the full CRA application date of 11 December 2027 remains fixed.
Supports available to Irish SMBs
Irish SMBs do not need to start from zero:
NCSC guidance and helpdesk: practical national support for Article 14 reporting questions.
ENISA SME self-assessment tool: a free way to identify gaps in product-security readiness.
Enterprise Ireland Cyber Security Review Grant: supports an external cyber-security review, covering 80% of a €3,000 review.
A sensible Irish roadmap
Inventory products, firmware versions, cloud dependencies, and third-party components.
Determine CRA scope and economic-operator roles.
Implement the Article 14 reporting process immediately.
Use the NCSC helpdesk for technical reporting questions.
Build the Annex I evidence base before the 2027 deadline.
Use the Enterprise Ireland grant to fund an independent gap review.
Prepare customer-facing artefacts: SBOM summary, vulnerability-disclosure policy, support-period statement, and secure-development overview.
For Irish exporters, the opportunity is clear: companies that can demonstrate credible product-security governance will find it easier to win and retain EU customers as CRA expectations spread through supply chains.
If your company is in need of any advice or consultation, feel free to set up an appointment with us.
