Ireland's Government has again promised to prioritise publication of the National Cyber Security Bill in its Autumn 2026 legislative programme. The bill would transpose the EU's NIS2 Directive and put the National Cyber Security Centre (NCSC) on a statutory footing. The delay has become costly, but speed is not a reason to enact the surveillance and blocking powers in the 2024 General Scheme as drafted.
The case for acting fast
The strongest argument for the Government is simple. NIS2 (Directive (EU) 2022/2555) required transposition by 17 October 2024. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice. It asked the Court to impose a lump sum and daily penalties until transposition is notified. Letters of formal notice went out on 28 November 2024 and reasoned opinions on 7 May 2025. The Department of Justice has told the press that it expects publication in the autumn. Minister Jim O'Callaghan expects to notify transposition by the end of 2026.
The security case is real too. Essential and important entities need clear, enforceable risk-management and incident-reporting duties, and a cyber agency that depends on administrative arrangements rather than statute is a weak foundation. A sovereign state should be able to respond when hostile actors attack critical infrastructure. Nothing below argues against the NIS2 core.
What the General Scheme goes beyond
The trouble is that the bill is not only NIS2 transposition. According to the Irish Examiner's September 2024 report, the draft lets the NCSC seek emergency powers where there is a "pressing national security threat". The NCSC could go to the High Court ex parte, behind closed doors, to apply devices on public communication networks and data centres for a fixed period. The court "shall grant" the request where it is satisfied that there are real and persistent risks to the security of the State, to public-sector data integrity or to the continuity of essential services. NCSC director Richard Browne was quoted as saying this "essentially means the entire Irish IP address space".
The Irish Council for Civil Liberties (ICCL) and Digital Rights Ireland told the Oireachtas Justice Committee on 25 November 2025 about the powers in heads six to ten. As the Law Society Gazette reported, they said the NCSC could:
- scan publicly accessible networks for vulnerabilities without the owner's consent;
- block access to a domain name, which they call "an internet death penalty";
- store all network traffic of public-sector bodies for up to 18 months and collect metadata about private communications on public networks;
- compel messaging providers and data-centre operators to install surveillance devices.
The Gazette also reports that "national security" is not defined in the bill.
That last point matters most. High Court approval is a real safeguard, but a court can only test a statutory standard. If the trigger is undefined, an ex parte hearing with no adversarial party will test little. The Government's own position, as the Gazette's coverage frames it, is that High Court involvement supplies sufficient safeguards. It is better than ministerial discretion. It is not the same as a bounded power.
Why this is also an innovation problem
Broad powers over internet traffic carry costs for the sector the State wants to attract. Ireland hosts data centres and the European operations of large platforms, and operators weigh legal certainty heavily. A regime that can compel equipment installation in data centres and block domains on an undefined threshold raises compliance risk for hosting and infrastructure providers. It also makes encrypted-messaging providers a target for compulsion. Ireland is also building research capacity: Research Ireland's new Rinn network has about €460m committed over eight years. The reputational signal sent by open-ended surveillance powers works against that investment.
Proportionality is also a legal question. EU law requires interferences with communications privacy to be necessary and proportionate. Passing NIS2 transposition quickly and badly invites litigation that would delay the very security outcomes the Commission wants.
What a proportionate bill would contain
The fix is not to abandon the NCSC's emergency tools. It is to make them narrow and reviewable.
- Define the trigger. Replace "national security" with a specific standard tied to an identified attack on essential services, with evidence set out in the application.
- Separate NIS2 duties from new powers. Pass the transposition core on the accelerated timetable the Court of Justice referral demands. Give the surveillance and blocking heads their own scrutiny, rather than letting the deadline carry them through.
- Narrow blocking. Domain blocking should be limited to named malicious infrastructure, be time-limited, and be challengeable by affected parties. It should not extend to whole services.
- Shorten retention and add oversight. Traffic storage should be limited to what a specific threat requires, with deletion deadlines, independent oversight and later disclosure to affected parties where possible.
- Add a sunset and reporting. Emergency powers should lapse unless renewed, and the NCSC should report annually on how often they are used.
The bottom line
Ireland has a genuine compliance failure, and the Commission is asking the Court for financial penalties. The Government is right to say it wants to publish the bill. But the 2024 General Scheme should be treated as a first draft, not a finished text to be rushed through. Pairing strong NIS2 obligations with tightly bounded emergency powers would meet the Commission's deadline and still protect an open internet.