Regulations by region

NIS2 is not transposed in Ireland. The regime in force is the European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018 — S.I. No. 360/2018 — and it is stricter than the Directive it transposes in one respect that matters: it sets a hard 72-hour limit where NIS1 said only "without undue delay".

Reporting clocks

7

Near-universal

1

Turn on a status

6

Standards, nothing filed

3

The UK is not under NIS2. Directive (EU) 2022/2555 binds member states and the UK ceased to be one, so there is no 24-hour early warning here and no one-month final report — the regime in force is The Network and Information Systems Regulations 2018 (S.I. 2018/506), and it is a single 72-hour notification. Regulation 8(1) is self-executing, which is the part most often got wrong in the other direction: meet a Schedule 2 threshold and you are "deemed to be designated" as an operator of essential services, and regulation 8(2) then requires you to tell your competent authority in writing. No authority tells you first. The Cyber Security and Resilience Bill would replace these Regulations. Before Parliament. Not law, not assessed, and no deadline here anticipates it.

Reporting clocks

5

Near-universal

1

Turn on a status

4

Standards, nothing filed

4

DORA, the CRA and GDPR are Regulations: they apply directly, so the window, the recipient and the content are the same in every Member State. NIS2 and CER are Directives — they bind Member States rather than companies, so what you owe is your own country's transposing law, and that law sets the recipient, the portal and any national variation. This page is therefore concrete about the first three and cannot be about the other two; the NIS2 clock below says how uneven transposition still is, and a country page is where it gets settled one state at a time.

Reporting clocks

6

Near-universal

1

Turn on a status

5

Standards, nothing filed

3