Ireland software supply chain and AI security rules: a 90-day plan

If you build, buy or run software through an Irish entity, most of the rules that reach your code and your suppliers already apply, even though Ireland has still not passed its NIS2 law. DORA has bound Irish banks, insurers, investment firms and payment firms since 17 January 2025, under Central Bank of Ireland supervision. The EU Cyber Resilience Act reporting duty started on 11 September 2026. GDPR is enforced by the Data Protection Commission, often as lead authority for the EU operations of large US groups. The Regulation of Artificial Intelligence Act 2026 was signed on 21 July 2026 and set up the AI Office of Ireland. The gap is NIS2: the National Cyber Security Bill has not been introduced to the Oireachtas, the 2018 NIS Regulations still apply, and the European Commission has referred Ireland to the Court of Justice over the delay.

This guide takes each regime from its primary source, names the authority that supervises it, explains which of your entities it binds, sets out what it asks of software and open source, and ends with a 30/60/90-day plan that works with any tooling. It is a practical reading of public texts, not legal advice. Your own counsel should confirm whether, and how, each rule applies to you.

Key takeaways

• NIS2 is not yet Irish law. The Oireachtas bills record for 2024, 2025 and 2026 holds no bill with "Cyber" in its title as of 25 October 2026. The NIS Regulations 2018 (S.I. No. 360 of 2018) still bind designated operators of essential services, with a 72 hour incident notification to the CSIRT under Regulation 18. The National Cyber Security Centre (NCSC) says its NIS2 registration and reporting portals will open only once the law is in place.
• Expect a large scope when it lands. Ireland's draft National Cyber Security Strategy (2026) estimates about 4,500 entities across 18 sectors and confirms that cloud and other digital providers with their EU main establishment in Ireland will be supervised from Ireland on behalf of the EU.
• Finance runs on DORA now. The Central Bank of Ireland supervises DORA, takes major ICT incident reports through its portal, collected the 2026 registers of information in March, and will resume its own outsourcing register collection with a 28 February 2027 deadline.
• The CRA reporting clock is live. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform, which routes them to CSIRT-IE. Full product rules, including the SBOM duty, apply from 11 December 2027.
• The DPC fines for weak security and late breach notices. Recent decisions include €91 million (September 2024) and €251 million (December 2024) against Meta Platforms Ireland Limited, and €277,500 in total against Permanent TSB (May 2026), each citing GDPR Article 32 or 25 and Article 33.
• AI Act enforcement is distributed. S.I. No. 366 of 2025 names sectoral market surveillance authorities, with the Central Bank for AI used by financial institutions and the DPC for certain high-risk uses. The 2026 Act created Oifig IS na hÉireann (the AI Office of Ireland) as the single point of contact.
• Safeguard capabilities covered here, all GA: SBOM generation and analysis, SCA and vulnerability management with EPSS and KEV, reachability analysis, policies and gates, the Compliance and GRC suite with framework pages for NIS2, DORA, the EU CRA, the EU AI Act and the Ireland Data Protection Act 2018, TPRM SBOM requests, CSAF and VEX upload, Trust Center, AI-BOM discovery, AI Gateway, MCP Guardrail, agent identity, autonomous remediation (ships switched off), the local runner, Zero AI mode, bring your own model, and private VPC, on-prem and air-gapped deployment.

Who this applies to in Ireland

Ireland has an unusual shape. A small domestic economy sits beside the EU headquarters of many of the largest US technology, pharmaceutical and financial firms. That means two different questions: which Irish rules bind your Irish company, and which EU rules Ireland enforces for the whole Union because your group chose Dublin as its EU home.

Regulated finance. Banks, credit unions, insurers, investment firms, fund managers, payment and e-money institutions and crypto-asset service providers authorised in Ireland are financial entities under DORA (Regulation (EU) 2022/2554). The Central Bank of Ireland is the competent authority. Under the NIS Regulations 2018, the Central Bank is also the competent authority for operators of essential services in banking and financial market infrastructure (Regulation 7(2)).

Critical infrastructure operators and their suppliers. Energy, transport, health, drinking water and digital infrastructure operators designated under the 2018 Regulations already carry security and incident duties. Under NIS2, once transposed, the list grows to 18 sectors, including waste water, ICT service management, public administration, space, postal services, manufacturing, chemicals, food and research. Suppliers feel these rules through contract clauses, questionnaires and audits rather than through the law itself.

Cloud, data centre and digital service providers with an EU main establishment in Ireland. NIS2 applies a main establishment rule to digital infrastructure, managed services and certain digital providers. Ireland's draft strategy says plainly that Ireland will supervise cloud computing and other digital service providers whose main establishment is in the State, on behalf of the EU. Under the 2018 Regulations, digital service providers with their main establishment in Ireland already fall under Irish supervision (Part 5).

Software and connected product makers. Any manufacturer that places a product with digital elements on the EU market is covered by the Cyber Resilience Act (Regulation (EU) 2024/2847), wherever it is based. Irish importers and distributors have their own duties.

Organisations that process personal data. Every Irish controller and processor answers to the Data Protection Commission (DPC). For cross-border processing, the DPC is the lead supervisory authority when the main establishment of the group in the EU is in Ireland, which is why so many large GDPR decisions come from Dublin.

Providers and deployers of AI systems. The EU AI Act (Regulation (EU) 2024/1689) applies directly. Ireland's 2025 designation regulations and the 2026 Act decide which Irish authority supervises which use.

Public sector bodies and their suppliers. Government departments, the HSE and local authorities are in scope for NIS2 as public administration once transposed, and are controllers under GDPR today. Suppliers see these rules through tenders and data processing agreements.

Which of your entities does each rule bind?

Many US groups run several Irish companies: an EU headquarters, a sales entity, a data centre company, a regulated payments or insurance firm, and sometimes a research or manufacturing site. The rules do not attach to "the group". They attach to a specific legal person, and getting that wrong is the most common scoping mistake in Ireland. This table is a starting point for your counsel, not a substitute for them.

The rules, regulator by regulator

NIS2 and the National Cyber Security Bill: still not law

The NIS2 Directive (Directive (EU) 2022/2555) had a transposition deadline of 17 October 2024. Ireland missed it. The NCSC's own NIS2 page says the transposition deadline "has not been met" and that the earlier NIS regime "remains in full effect". It records that a Cabinet decision in July 2024 directed priority drafting, and that the heads of the General Scheme of the Bill were published on the Department of the Environment, Climate and Communications website in September 2024.

As of 25 October 2026, the Oireachtas bills database shows no bill with "Cyber" in its title for 2024, 2025 or 2026. In plain terms, the National Cyber Security Bill has not been introduced. In July 2026 the European Commission referred Ireland, together with Spain, France and the Netherlands, to the Court of Justice of the EU for failing to notify full transposition, and asked for financial penalties. The Law Society Gazette reported that the Commission had sent a letter of formal notice in late 2024 and a reasoned opinion in May 2025 before the referral.

Meanwhile, Ireland's draft National Cyber Security Strategy, published for public consultation in 2026 and prepared by the Department of Justice, Home Affairs and Migration, says transposition will come through the National Cyber Security Bill. It estimates about 4,500 entities will come into scope, across 11 sectors of essential entities and 7 more of important entities. It also commits the NCSC to an ICT Supply Chain Security Action Plan, with supply chain risk guidance targeted for Q2 2027 and CyFun based best practice frameworks for Q4 2027.

The NCSC has already put two building blocks on its NIS2 page: a draft set of Risk Management Measures and the Cyber Fundamentals (CyFun) framework, both announced on 24 June 2025. These are not binding on anyone today, but they show what an Irish supervisor will expect, and many in-scope entities are using them as their working baseline.

What this means for you. Do not wait for the Act. NIS2 Article 21 sets ten minimum risk management measures, including supply chain security (Article 21(2)(d)) and security in acquisition, development and maintenance, including vulnerability handling and disclosure (Article 21(2)(e)). Article 23 sets a 24 hour early warning, a 72 hour incident notification and a final report within one month. Article 20 makes management bodies approve the measures and supervise their implementation. The Irish Act cannot go below these, so building to them now is not wasted work.

The NIS Regulations 2018: what applies today

The European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018 (S.I. No. 360 of 2018) transposed the first NIS Directive and still apply. They matter in three ways.

• Who is in. Designated operators of essential services in energy, transport, banking, financial market infrastructure, health, drinking water and digital infrastructure, plus digital service providers (online marketplaces, search engines and cloud computing services) with their EU main establishment in Ireland.
• What they must do. Regulation 17 requires appropriate and proportionate technical and organisational measures to manage risks to network and information systems, and measures to prevent and minimise the impact of incidents. Regulation 21 sets parallel duties for digital service providers.
• When they must report. Regulation 18 requires an operator of essential services to notify the CSIRT of an incident with a significant impact on the continuity of its essential service without delay and no later than 72 hours after becoming aware. Regulation 18(1)(b) adds a duty that is easy to miss: if the operator relies on a third-party digital service provider and an incident at that provider significantly affects the essential service, the operator must notify that too.

Offences under the reporting and related regulations carry, on indictment, fines of up to €500,000 for a body corporate (Regulation 34).

The NCSC and CSIRT-IE

The National Cyber Security Centre is Ireland's national CSIRT (CSIRT-IE) and the operational centre for NIS. It publishes alerts and advisories on critical vulnerabilities, often several a week in 2026, and its CRA page sets out how manufacturers must report. For a software team, the practical point is simple: an NCSC advisory naming a component you ship or run is the moment your inventory is tested.

Finance: DORA and the Central Bank of Ireland

DORA has applied since 17 January 2025. The Central Bank of Ireland is the competent authority, and its DORA pages are the practical source for Irish firms.

• Major ICT-related incidents. Since 17 January 2025, in-scope financial entities have had to report major ICT-related incidents to the Central Bank through the Central Bank Portal, using templates designed by the European Supervisory Authorities. Significant cyber threats may be reported voluntarily. The Central Bank points to Commission Delegated Regulation (EU) 2024/1772 for classification and materiality thresholds, and to Commission Delegated Regulation (EU) 2025/301 for the content and time limits of reports. Under that regulation the initial notification is due within 4 hours of classifying an incident as major and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours of the initial notification, and a final report within one month of the latest intermediate report.
• Register of information. DORA Article 28(3) requires a register of all contractual arrangements with ICT third-party service providers. The Central Bank opened its portal for 2026 register submissions for the month of March 2026, held an industry briefing on 4 February 2026, and on 20 February 2026 flagged an extra step following changes at the EBA.
• Expectations. The Central Bank states that most DORA technical standards have been in place since 17 January 2025, that the subcontracting standard was finalised in July 2025, and that steps to close gaps "should be substantially complete at this stage". Its FAQ adds that DORA is not a one-off exercise.
• Threat-led penetration testing. The Central Bank engages directly with firms in scope of TLPT, through TIBER-IE, and runs an identification exercise each year.
• Domestic outsourcing registers. In 2025 the Central Bank paused its own collection of outsourcing registers while firms prepared DORA registers. It will resume in February 2027 with a deadline of 28 February 2027 and a data reference date of 31 December 2026, limited to firms that submitted in the 2024 cycle. The point is to capture third-party arrangements that the DORA register does not cover.
• Operational resilience guidance. The Central Bank's Cross Industry Guidance on Operational Resilience (first published December 2021) was republished in July 2025 to align with DORA. At the same time the Central Bank withdrew its September 2016 guidance on IT and cybersecurity risk management, because DORA now sets that minimum standard.

For software, the DORA articles that come up most are Article 8 (identify and document ICT assets and their dependencies), Article 9 (protection and prevention), Article 28 (ICT third-party risk and the register) and Article 30 (key contractual provisions).

The Data Protection Commission: GDPR and the Data Protection Act 2018

The DPC was established under section 10 of the Data Protection Act 2018 and is Ireland's GDPR supervisory authority. The Act gives further effect to GDPR in Irish law and sets the DPC's inquiry and sanction procedures. For software teams, three GDPR articles do most of the work.

• Article 32 requires security appropriate to the risk, including the ability to ensure ongoing confidentiality, integrity, availability and resilience.
• Article 33 requires notification of a personal data breach to the DPC without undue delay and, where feasible, within 72 hours, and requires every breach to be documented (Article 33(5)).
• Article 25 requires data protection by design and by default.

Article 28 adds the processor contract terms that carry security duties down your supply chain. The DPC's recent decisions, set out in the incidents section below, show that it fines on each of these articles separately.

The EU AI Act and Ireland's distributed model

The AI Act entered into force on 1 August 2024. The European Commission's AI Act page now gives this timeline: prohibitions and AI literacy duties from 2 February 2025; governance rules and general purpose AI model obligations from 2 August 2025; general application from 2 August 2026; high-risk rules for Annex III use cases from 2 December 2027; and high-risk rules for AI built into products covered by Annex I from 2 August 2028. The later high-risk dates come from the AI Omnibus, which the Commission says entered into force on 27 July 2026.

Ireland chose a distributed model, where existing sectoral regulators supervise AI in their own areas.

• S.I. No. 366 of 2025, the European Union (Artificial Intelligence) (Designation) Regulations 2025, signed on 25 July 2025, designates the Minister for Enterprise, Tourism and Employment as a national competent authority. It names market surveillance authorities for products under Annex I, including the Health and Safety Authority, the Competition and Consumer Protection Commission, ComReg, the Commission for Railway Regulation, the Marine Survey Office and the Health Products Regulatory Authority. It designates the Central Bank of Ireland as market surveillance authority under Article 74(6), which covers AI systems placed on the market, put into service or used by regulated financial institutions, and the Data Protection Commission under Article 74(8), which covers certain high-risk uses in law enforcement, migration and border control, and the administration of justice and democratic processes.
• The Regulation of Artificial Intelligence Act 2026 (Act No. 31 of 2026, An tAcht um an Intleacht Shaorga a Rialáil, 2026) was signed on 21 July 2026. It establishes Oifig IS na hÉireann, the AI Office of Ireland, makes the Office the single point of contact under Article 70(2) (section 42), and requires an AI register of prohibited practices and serious incidents in the State (section 43). It gives market surveillance authorities a graded enforcement toolkit, from notices to prohibition and fines, and lets the Central Bank use its existing administrative sanctions procedure for AI Act breaches. Parts of the Act commence by ministerial order. The AI Office's website reports that the Office was established and its first chief executive appointed on 30 July 2026.

For software and supply chain teams, the AI Act articles to know are Article 11 and Annex IV (technical documentation, including the system's components and versions), Article 15 (accuracy, robustness and cybersecurity for high-risk systems), Article 25 (responsibilities along the AI value chain) and Article 73 (serious incident reporting).

The EU Cyber Resilience Act for Irish makers and importers

The CRA entered into force on 10 December 2024. Reporting obligations under Article 14 have applied since 11 September 2026; the main obligations apply from 11 December 2027. The NCSC's CRA page sets out the reporting sequence for Ireland:

• an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident;
• a fuller notification within 72 hours of awareness;
• a final report within 14 days after a corrective measure is available for an actively exploited vulnerability, or within one month of the 72 hour notification for a severe incident.

Reports go through ENISA's Single Reporting Platform, which routes them to CSIRT-IE and ENISA. The NCSC is clear that only platform submissions satisfy the duty, with an email fallback only when ENISA has declared the platform offline. Two points on that page catch software teams out. If the exploited vulnerability sits in a third-party component inside your product, you, as the final manufacturer, must report once you confirm your product is affected. And products placed on the market before December 2027 are exempt from the design rules but fully subject to reporting if they are still on the EU market.

From 11 December 2027, Annex I Part II requires manufacturers to identify and document components, including by drawing up a software bill of materials covering at least top-level dependencies, and to remediate vulnerabilities without delay. Ireland has not yet designated its CRA market surveillance authority; the draft strategy targets legislation for that, and for a penalties regime, by Q4 2027. The Commission published practical CRA guidance on 27 July 2026.

What the rules ask of software and open source

Across these regimes the same handful of demands keep coming back. This table maps each to the rule behind it and the evidence a supervisor or auditor usually asks for.

Two Irish specifics are worth adding. First, the Central Bank will want the DORA register and, for firms in its 2024 cycle, a domestic outsourcing register in February 2027, so third-party data has to be kept in a form that feeds both. Second, if your EU main establishment is in Ireland, a single DPC inquiry can examine processing across the Union, so evidence needs to cover the group's EU systems rather than only the Irish office.

Real public incidents in or affecting Ireland

These examples come from primary publications by Irish authorities. They are summarised as the authorities describe them, without conclusions beyond what the sources say.

DPC fine against Meta Platforms Ireland Limited, €91 million, 27 September 2024. The inquiry began in April 2019 after the company notified the DPC that certain user passwords had been stored in plaintext on internal systems. The DPC found infringements of Article 33(1) (failure to notify), Article 33(5) (failure to document), Article 5(1)(f) and Article 32(1) (security of processing), and issued a reprimand and a €91 million fine.

DPC fines against Meta Platforms Ireland Limited, €251 million, 17 December 2024. Two inquiries followed a breach reported in September 2018 that affected about 29 million Facebook accounts worldwide, about 3 million of them in the EU and EEA, through exploitation of user tokens. The decisions found infringements of Articles 33(3) and 33(5) (incomplete notification and documentation, €8 million and €3 million) and Articles 25(1) and 25(2) (data protection by design and by default, €130 million and €110 million). The DPC's deputy commissioner linked the case to the failure to build in data protection "throughout the design and development cycle". For software teams this is the clearest Irish statement that design flaws in platform code are a GDPR matter, not only an engineering one.

DPC decision on Permanent TSB, 8 May 2026. Breaches first reported in May 2022 arose when people holding certain customer information called the bank's Open24 contact centre, posed as customers, and changed account details. The DPC found that security protocols were not followed, and found infringements of Article 5(1)(f), Article 32(1) and Article 33(1). It reprimanded the bank and fined it €250,000 for the security failures and €27,500 for late notification. This one is not about code, but it shows the DPC treating the 72 hour breach clock as a separate, fineable duty.

NCSC advisories on critical vulnerabilities, 2026. The NCSC's advisories list shows a steady run of critical alerts through 2026, including global targeting of firewalls and VPN gateways (18 June 2026), critical remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619 (21 October 2026), and a critical GitLab vulnerability (23 October 2026). The PHP advisory gives a CVSS score of 9.2 and records that the flaw was not in the KEV catalogue at publication. For any Irish team running PHP, the first question on 21 October was which applications and images carried an affected runtime; our PHP2Shell explainer covers the technical detail.

Ireland's own NIS2 referral, July 2026. Not an incident, but a public event that affects Irish organisations: the Commission's referral to the Court of Justice means the transposition timeline is now a matter of EU enforcement, which makes a sudden Bill, with short preparation time, more likely rather than less.

The personas who own the problem

The CISO or head of information security. Needs a defensible position for the board on three fronts at once: DORA supervision today, CRA reporting since September, and NIS2 duties that could arrive with little notice. Trigger points are a Central Bank supervisory letter, a DPC inquiry letter, a major ICT incident, and board sign-off under NIS2 Article 20 once the Act lands. What they need is one evidence set that answers all three regimes.

The head of AppSec or VP of Engineering. Owns the SBOMs, the vulnerability backlog and the release process. The CRA turns "we patch when we can" into a 24 hour clock for exploited vulnerabilities in shipped products, including in third-party components. Trigger points are an NCSC advisory, a customer's CRA questionnaire and the December 2027 product rules. They need an inventory that answers "are we affected" in minutes and a gate that stops known exploited components shipping.

GRC and regulatory affairs. In a Central Bank regulated firm, this team owns the DORA register, the incident classification process and the Central Bank relationship. In a tech group's EU headquarters, it owns the NIS2 scoping question. Trigger points are the March register window, the 28 February 2027 outsourcing register deadline and any request from the Central Bank. They need evidence mapped clause by clause, with dates.

Procurement and vendor risk. Holds the contracts that DORA Article 30 and GDPR Article 28 govern. Trigger points are renewals, new ICT providers and the register refresh. They need supplier SBOMs or attestations, a list of which suppliers support critical or important functions, and a way to chase evidence without a spreadsheet war.

The Data Protection Officer. Owns the 72 hour breach clock and the record of breaches under Article 33(5). Trigger points are any incident touching personal data and any DPC engagement. They need to know within hours which systems and components were affected.

The EU entity's directors. In many US groups the Irish board is small and part-time. NIS2 Article 20 and DORA Article 5 put accountability on the management body. They need short, clear reporting that shows what was approved, when, and what changed.

A practical 30/60/90-day plan

This plan works with whatever tools you have today. Where Safeguard can help, it is covered in the next section.

Days 1 to 30: scope, inventory and ownership

1. Map entities to regimes. List every Irish legal entity in the group and, for each, mark whether it is a DORA financial entity, a designated operator of essential services or digital service provider under the 2018 Regulations, a likely NIS2 entity, a CRA manufacturer, importer or distributor, a GDPR controller or processor (and whether it is the EU main establishment), and an AI provider or deployer. Use the entity table above as the template.
2. Name owners. One accountable owner per regime per entity, with a deputy. Write down who files a CRA report, who files a DORA major incident report, and who notifies the DPC.
3. Build the software inventory. Generate SBOMs in SPDX or CycloneDX for every product and service you ship or run, at least for systems supporting critical or important functions. Include container images and AI components such as models and SDKs.
4. Pull the supplier list. Start from the DORA register if you have one. Add every ICT supplier that touches the in-scope systems, and flag those supporting critical or important functions.
5. Draft the clocks. Put every reporting deadline into one runbook: 72 hours under the 2018 Regulations, the DORA 4 and 24 hour initial notice, GDPR's 72 hours, the CRA's 24 hours, and NIS2's 24 hours ready for when the Act lands.

A simple decision table for the first hour of any security event:

Days 31 to 60: vulnerability handling and suppliers

1. Set triage rules. Rank vulnerabilities by exploitation (CISA KEV and EPSS), by whether your code actually reaches the vulnerable function, and by the criticality of the system. Write the rule down so you can show a supervisor why one item was fixed today and another next month.
2. Put a gate in CI. Block releases that carry components with known exploited vulnerabilities, or warn and record an exception with an owner and an expiry date.
3. Publish a disclosure contact. The CRA and NIS2 both expect a way for researchers to report vulnerabilities. A security.txt file and a monitored mailbox are the minimum.
4. Request supplier evidence. Ask critical suppliers for SBOMs, vulnerability handling commitments and incident notice terms, and record the replies. Check contracts against DORA Article 30 and GDPR Article 28.
5. Rehearse the NCSC advisory test. Pick the last critical NCSC advisory and time how long it takes to answer: which products, which versions, which customers, and which reports, if any, are due.

Days 61 to 90: evidence, AI and management sign-off

1. Assemble the evidence pack. For each regime, one folder: policies, inventories, SBOMs, gate results, exceptions, supplier evidence, incident runbook and test results, all dated.
2. Inventory AI. List models, AI SDKs, prompts, agents and MCP servers in use. Classify each use against the AI Act risk tiers and note which Irish authority would supervise it under S.I. No. 366 of 2025.
3. Prepare for NIS2. Gap-assess against the NCSC's draft Risk Management Measures and CyFun. Decide which entity will register and who will sign off, so you are ready when the portal opens.
4. Prepare the February 2027 register. If you submitted an outsourcing register in 2024, plan the 31 December 2026 data cut now.
5. Brief the board. A short paper: what applies, what is in place, what is open, what is coming (NIS2, CRA December 2027, AI Act December 2027 and August 2028), and the decisions you need.

Common mistakes

• Treating "NIS2 is not Irish law yet" as "nothing applies". DORA, the CRA, GDPR, the AI Act and the 2018 NIS Regulations all apply now.
• Scoping the group, not the entity. A DORA duty sits with the authorised firm, not with the group IT company that serves it. A NIS2 main establishment duty may sit with your EU headquarters, not your data centre company.
• Forgetting third-party components in CRA reports. The NCSC is explicit that the final manufacturer reports exploited vulnerabilities in integrated components once it confirms it is affected.
• Running the DORA register and the outsourcing register as separate projects. The Central Bank's February 2027 collection asks for arrangements outside DORA; keep one source of supplier truth.
• Missing the notification fine. The DPC fines late or incomplete breach notices separately from security failures, as all three decisions above show.
• Assuming the AI Act is all about 2027. Prohibitions, AI literacy and general purpose model duties already apply, and the AI register under the 2026 Act records incidents in the State.
• Writing the incident runbook for one regime. One event can trigger the CRA, DORA, GDPR and NIS reports at once, each with its own clock and recipient.

How Safeguard does this

Everything in the plan above works without Safeguard. This section shows how the same steps run in Safeguard, using only what Safeguard's offering and documentation describe. Every capability named here is generally available (GA). Commands are shown as the docs show them; they were not run for this guide.

1. Switch on the Irish and EU framework pages. In the Compliance and GRC suite (GA), the EU NIS2 Directive, EU DORA, EU Cyber Resilience Act and EU AI Act pages are on in a workspace unless you switch them off under Compliance › Manage. The Ireland Data Protection Act 2018 page is off until you switch it on there. Each page lists requirements a scan decides, plus policy templates, and the EU pages also list catalogue controls you evidence with tests, uploads, policies or attestations. These are Safeguard's own mappings to the texts, not the regulator's numbering, and they do not replace the Irish authorities' own guidance.
2. Generate SBOMs on every scan. SBOM generation and analysis (GA) produces SPDX and CycloneDX, and SCA with deep transitive dependency scanning (GA) builds the full component inventory. On the Ireland page, each scan of a product is checked against GDPR Articles 32, 5(1)(f), 30, 28 and 33 as given effect by the 2018 Act: for example whether components have known versions, identifiable suppliers and integrity hashes, and whether versions are pinned. On the DORA page, scans are checked against Articles 8, 9, 17 to 19 and 28, and on the CRA page against Annex I Part II, including whether the SBOM enumerates the product's components.
3. Scan without sending source code. For teams that will not grant repository access, the local runner (GA) is part of the Safeguard CLI. The runner docs describe the machine polling the platform for work, running each scan locally and uploading only the SBOM and findings, never the source code. For headless use the docs show:

# Start without the terminal UI and serve assistant turns for this workspace
safeguard runner start --workspace ./path/to/repo
# Is it running, and what is it doing
safeguard runner status
# Drain in-flight work and stop
safeguard runner stop

4. Prioritise what is exploited and reachable. Vulnerability management (GA) matches components against advisories and adds EPSS and CISA KEV context. Reachability analysis (GA) ranks the vulnerable code paths your application actually calls. When an NCSC advisory names a component, this is how you go from "do we use it" to "which products, which versions, and which ones matter first", which is the input to a CRA early warning decision.
5. Gate releases and record exceptions. Policies and gates (GA) are created under Settings › Policies with a visual builder or YAML, as the policies and gates docs describe. Each policy's action is Block (the gate fails), Warn (the gate passes with a warning) or Notify (the gate passes and a notification is sent). Approval runs through exceptions: a developer requests one with a business justification and an expiry, approvers decide, and the decision is recorded. In CI, the docs show a job failing when a gate fails:

safeguard ci scan --wait --fail-on-gate <gate>

6. Collect evidence from suppliers. TPRM (GA) keeps the vendor directory with risk tiers. Its SBOM requests let you send single or bulk requests from a template that sets SPDX or CycloneDX format and a deadline, track status from Sent through Viewed, In Progress and Submitted to Validated or Rejected, and send automatic reminders seven days before the deadline, at the deadline and as an escalation seven days after. That trail supports a DORA register entry, a GDPR Article 28 supervision record or a NIS2 Article 21(2)(d) control.
7. State what is and is not affected. CSAF and VEX upload (GA) lets you hold and share exploitability statements, which helps when an Irish customer, the Central Bank or CSIRT-IE asks whether a published vulnerability affects your product.
8. Fix, with a human in charge. Autonomous remediation (GA) can open tested, policy gated fix pull requests, singly or in bulk. It ships switched off, with every category set to Manual, so your team decides what runs on its own.
9. Inventory and govern AI. AI-BOM discovery (GA) inventories AI assets across code, cloud and connected SaaS, including models, ML dependencies, notebooks, prompts, vector stores, agents, MCP servers and inference endpoints. AI Gateway (GA) evaluates LLM traffic against guardrails for prompt injection, jailbreak and PII egress. MCP Guardrail (GA) generates guardrail proxy URLs for MCP servers, and agent identity (GA) tracks which agent holds what access, at what level. These map to the AI inventory step in the plan and to the Annex IV documentation an Irish market surveillance authority could ask for.
10. Share posture with customers. Trust Center (GA) publishes your compliance status, controls, policies, subprocessors and documents on a public page you manage under Compliance › Trust Center, which helps when Irish banks, public bodies and EU customers send questionnaires.
11. Choose where it runs. Safeguard's SaaS is multi-region across US, EU and Gov regions; no Ireland-specific region is offered or implied. Safeguard's EU region is in Frankfurt, Germany, so data stays in the EU. For residency, the GA options are private VPC or dedicated tenancy, full on-prem, and fully air-gapped with the AI models running inside your environment and signed offline snapshot delivery. Zero AI mode (GA) runs the whole platform deterministically with no LLM in the loop, and bring your own model (GA) is available for teams with an approved model list. Safeguard states that customer code, SBOMs and telemetry are not used to train shared models.

Safeguard's own posture wording is limited to what its Trust Center says: SOC 2 Type II audit in progress, and designed for FedRAMP High. Safeguard does not claim any Irish or EU certification, approval or designation, and is not an authority under any regime described here.

What Safeguard does not do

• It does not make you compliant. It helps you produce and keep the evidence. Whether an entity is in scope, whether an incident is major or significant, and whether a vulnerability is reportable are decisions for you, your counsel and your authorities.
• It does not file or register for you. CRA notices on the ENISA platform, DORA reports and registers on the Central Bank Portal, breach notices to the DPC, CSIRT notifications under the 2018 Regulations and any future NIS2 registration stay with your team.
• It does not write your contracts or legal analysis. DORA Article 30 clauses, GDPR Article 28 terms and the entity scoping question need your legal team.
• It does not fix vendor appliances or hosted services. When the vulnerability is in a firewall, VPN or SaaS product you buy, the fix comes from that vendor; Safeguard helps you track the request and keep the evidence.
• It does not replace incident response. Containment, forensics, customer communication and the call centre and fraud controls at issue in decisions like the Permanent TSB one remain your processes and tools.
• It does not offer in-country hosting in Ireland. If data must stay in your own environment, use the on-prem, air-gapped or local runner options. Safeguard's EU region is in Frankfurt, Germany, so data stays in the EU.

FAQ

Has Ireland transposed NIS2?

No. As of 25 October 2026 the National Cyber Security Bill has not been introduced to the Oireachtas, and the NCSC says the 2018 NIS Regulations remain in full effect. The European Commission referred Ireland to the Court of Justice in July 2026 over the delay.

What NIS rules apply in Ireland today?

The NIS Regulations 2018 (S.I. No. 360 of 2018). Designated operators of essential services must take appropriate security measures (Regulation 17) and notify the CSIRT of significant incidents within 72 hours (Regulation 18). Digital service providers with their EU main establishment in Ireland have parallel duties.

Who will supervise NIS2 in Ireland?

The Bill will name the competent authorities. The draft National Cyber Security Strategy describes a forum of national competent authorities and says Ireland will supervise cloud and other digital providers whose EU main establishment is in the State. Until the Act is passed, treat any list of named authorities as provisional.

Who supervises DORA in Ireland?

The Central Bank of Ireland. It receives major ICT-related incident reports and registers of information through the Central Bank Portal, runs TLPT through TIBER-IE, and will resume its domestic outsourcing register collection with a 28 February 2027 deadline.

How fast must an Irish financial entity report a major ICT incident?

Under Commission Delegated Regulation (EU) 2025/301, the initial notification is due within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it, then an intermediate report within 72 hours and a final report within one month. Reports go to the Central Bank through its portal.

How do I report a CRA vulnerability in Ireland?

Through ENISA's Single Reporting Platform, which routes reports to CSIRT-IE. An early warning is due within 24 hours of becoming aware of an actively exploited vulnerability, a fuller notification within 72 hours, and a final report within 14 days of a fix being available.

Who enforces the AI Act in Ireland?

Several sectoral regulators under S.I. No. 366 of 2025, including the Central Bank for AI used by financial institutions and the DPC for certain high-risk uses, coordinated by Oifig IS na hÉireann, the AI Office of Ireland, established under the Regulation of Artificial Intelligence Act 2026.

Does an Irish subsidiary of a US company fall under the DPC?

If it is a controller or processor in Ireland, yes. If it is the group's main establishment in the EU, the DPC is usually the lead supervisory authority for the group's cross-border processing across the EU, which is why many large GDPR decisions come from Dublin.

Does the CRA apply to software made outside the EU?

Yes, if the product is placed on the EU market. The manufacturer carries the obligations wherever it is based, and Irish importers and distributors have their own duties. Reporting applies now; the product rules apply from 11 December 2027.

Can we keep source code in Ireland while using a security platform?

You can keep it inside your own environment. Options include running scans locally and sending only results, or deploying the whole platform on-prem or air-gapped. Check whether a vendor's hosted service offers the region your contracts require; Safeguard's SaaS regions are US, EU and Gov.

Most of the work in this guide is about knowing what you run and fixing it quickly once a vulnerability is public. The block below describes how Safeguard closes the gap between a fix existing and that fix running in your builds, including when upstream has not shipped one yet.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real CLI session. You install the CLI, run safeguard to open the interactive terminal and ask it to "fix the lodash CVE in this repo". It reads the finding and the advisory, asks before any command that changes something, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. The same flow is how an Irish product team closes a vulnerability named in an NCSC advisory, with a person approving each change.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with its device code, then scans from the terminal. This is the option for Central Bank regulated firms and public bodies that will not let source code leave their network.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. For teams preparing their AI Act inventory, it shows what scoped agent access looks like in practice.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Oireachtas API: bills for 2026
• Oireachtas API: bills for 2025
• Oireachtas API: bills for 2024
• NCSC: NIS2
• NCSC: Cyber Resilience Act reporting obligations
• NCSC: alerts and advisories
• NCSC advisory: PHP critical vulnerabilities, 21 October 2026 (PDF)
• S.I. No. 360 of 2018, NIS Regulations (Irish Statute Book)
• Draft National Cyber Security Strategy for public consultation, 2026 (PDF)
• Law Society Gazette: Ireland referred to CJEU over cyber bill
• Central Bank of Ireland: DORA
• Central Bank of Ireland: DORA communications and publications
• Central Bank of Ireland: reporting major ICT-related incidents
• Central Bank of Ireland: DORA FAQ
• Central Bank of Ireland: operational resilience
• Central Bank of Ireland: outsourcing registers
• Data Protection Act 2018 (Irish Statute Book)
• DPC: press releases
• DPC: Meta fined €91 million
• DPC: Meta fined €251 million
• DPC: decision on Permanent TSB
• Regulation of Artificial Intelligence Act 2026 (Irish Statute Book)
• S.I. No. 366 of 2025, AI designation regulations (Irish Statute Book)
• Department of Enterprise, Tourism and Employment: publication of the AI Bill
• Department of Enterprise, Tourism and Employment: EU AI Act
• AI Office of Ireland
• European Commission: AI Act
• European Commission: Cyber Resilience Act
• Safeguard docs: Ireland Data Protection Act 2018
• Safeguard docs: EU NIS2
• Safeguard docs: EU DORA
• Safeguard docs: EU Cyber Resilience Act
• Safeguard docs: EU AI Act
• Safeguard docs: Local Runner
• Safeguard docs: Policies and Gates
• Safeguard docs: TPRM SBOM Requests
• Safeguard docs: AI-BOM Discovery
• Safeguard docs: Trust Center
• Safeguard docs: Air-Gapped Deployment

Related reading: Ireland's data centre grid rules (CRU/2025236), CRA Article 14 vulnerability reporting, the ENISA single reporting platform, NIS2 supply chain evidence, DORA third-party ICT risk and the Denmark country guide.

To try the flows above, download Safeguard and read the Safeguard documentation.

Last reviewed: 25 October 2026. Product capabilities change; check docs.safeguard.sh for the current state.