S.I. No. 559/2024 - European Union (Resilience of Critical Entities) Regulations 2024

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of 25th October, 2024.

TABLE OF CONTENTS

I, MICHEÁL MARTIN, Minister for Defence, in exercise of the powers conferred on me by section 3 of the European Communities Act 1972 (No. 27 of 1972), for the purpose of giving full effect to Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022¹ , and further effect to Commission Delegated Regulation (EU) 2023/2450 of 25 July 2023² , hereby make the following regulations:

PART 1

PRELIMINARY AND GENERAL

Citation and commencement

1. (1) These Regulations may be cited as the European Union (Resilience of Critical Entities) Regulations 2024.

(2) These Regulations shall come into operation on 17 October 2024.

Interpretation

2. (1) In these Regulations—

“authorised officer” means a person appointed under Regulation 25(1);

“banking sector” means the entities specified at entry no. 3 in column (1) of the Table set out in the Schedule;

“Central Bank” means the Central Bank of Ireland;

“competent authority”, in relation to a critical entity, means the entity designated as a competent authority in the State under Regulation 8(2) in respect of the sectors referred to in that Regulation;

“competent authority in another Member State” means an entity designated as a competent authority by a Member State (other than the State) for the purposes of the Directive;

‘critical entity’ means—

(a) a public or private entity which has been identified in accordance with Regulation 12 as belonging to one of the categories of entities specified in column (3) of the Table set out in the Schedule, and

(b) for the purposes of the public administration sector, the entities specified at entry no. 9 in column (1) of the Table set out in the Schedule;

“critical entities list” means the compiled list of critical entities of the State identified by competent authorities in accordance with Regulation 13;

“Critical Entities Resilience Group” means the group established under Article 19(1) of the Directive;

“Delegated Regulation” means Commission Delegated Regulation (EU) 2023/2450 of 25 July 2023² supplementing Directive (EU) 2022/2557 of the European Parliament and of the Council by establishing a list of essential services;

“digital infrastructure sector” means the entities specified at entry no. 8 in column (1) of the Table set out in the Schedule;

“Directive” means Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022¹ on the resilience of critical entities and repealing Council Directive 2008/114/EC;

“DORA Regulation” means Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022³ on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011;

“drinking water sector” means the entities specified at entry no. 6 in column (1) of the Table set out in the Schedule;

“enactment” means—

(a) an Act of the Oireachtas,

(b) a statute that was in force in Saorstát Éireann immediately before the date of the coming into operation of the Constitution and that continues in force by virtue of Article 50 of the Constitution, or

(c) an instrument made under an Act of the Oireachtas or a statute referred to in paragraph (b);

“energy sector” means the subsectors and entities specified at entry no. 1 in column (1) of the Table set out in the Schedule;

“essential service” means a service which is crucial for the maintenance of vital societal functions, economic activities, public health and safety, or the environment;

“European significance” shall be construed in accordance with Article 17 of the Directive;

“financial market infrastructure sector” means the entities specified at entry no. 4 in column (1) of the Table set out in the Schedule;

“food production, processing and distribution sector” means the entities specified at entry no. 11 in column (1) of the Table set out in the Schedule;

“General Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

“health sector” means the entities specified at entry no. 5 in column (1) of the Table set out in the Schedule;

“incident” means an event which has the potential to significantly disrupt, or that disrupts, the provision of an essential service, including when it affects the national systems that safeguard the rule of law;

“liaison officer” means a person designated by a critical entity under Regulation 16(10);

“Minister” means the Minister for Defence;

“Minister responsible” means the following:

(a) in relation to the exercise by a Minister of the Government of any powers, functions or duties vested in him or her by virtue of any enactment in respect of a sector or subsector, that Minister;

(b) in relation to the administration and business of the public service by virtue of any enactment by a Department of State in respect of a sector or subsector, the Minister of the Government having charge of that Department;

“national risk assessment” means the National Risk Assessment of Ireland prepared by the Minister, from time to time, and published on a website maintained by the Minister, which—

(a) fulfils the requirements of the Member State risk assessment within the meaning of Article 5(1) of the Directive, and

(b) fulfils the requirements of a general risk assessment carried out pursuant to Article 6(1) of Decision No. 1313/2013/EU of the European Parliament and of the Council of 17 December 2013⁵ ;

“National Strategy on the Resilience of Critical Entities” means the national strategy prepared and adopted by the Minister under Regulation 10;

“NIS 2 Directive” means Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022⁶ on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148;

“personal data” has the meaning given to it in Article 4 of the General Data Protection Regulation;

“public administration sector” means the entities specified at entry no. 9 in column (1) of the Table set out in the Schedule;

“railway” has the meaning given to it in section 2 (1) of the Railway Safety Act 2005 (No. 31 of 2005);

“resilience” means a critical entity’s ability to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from an incident;

“risk” means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident;

“risk assessment” means the overall process for determining the nature and extent of a risk by identifying and analysing potential relevant threats, vulnerabilities and hazards which could lead to an incident and by evaluating the potential loss or disruption of the provision of an essential service caused by that incident;

“sector” shall be construed in accordance with the Annex to the Directive;

“significant disruptive effect” shall be construed in accordance with Article 7 of the Directive;

“single point of contact” means the person designated as the single point of contact in the State under Regulation 7;

“single point of contact in another Member State” means the person designated as the single point of contact in a Member State (other than the State) for the purposes of the Directive;

“space sector” means the entities specified at entry no. 10 in column (1) of the Table set out in the Schedule;

“subsector” shall be construed in accordance with the Annex to the Directive;

“transport sector” means the subsectors and entities specified at entry no. 2 in column 1 of the Table set out in the Schedule;

“Union” means the European Union;

“waste water sector” means the subsectors and entities specified at entry no. 7 in column 1 of the Table set out in the Schedule;

“website” means an internet website (including part of such a website)—

(a) to which access is readily available by members of the public, and

(b) where anything published is readily available for inspection by members of the public.

(2) A word or expression that is used in these Regulations and also used in the Directive or the Delegated Regulation has, unless the contrary intention appears, the same meaning in these Regulations as in the Directive or Delegated Regulation, as the case may be.

PART 2

SCOPE OF REGULATIONS

Non-application of Regulations

3. (1) Regulations 9(9), (10) and (12) to (17), 11(7), 15 to 21, 23, 25 to 28 and 30 to 33 shall not apply to critical entities, nor their competent authorities, in the following sectors specified in column (1) of the Table set out in the Schedule, where those entities or authorities have been identified under the measures implementing the NIS 2 Directive in the State or under the DORA Regulation:

(a) 3. Banking;

(b) 4. Financial market infrastructure;

(c) 8. Digital infrastructure.

(2) These Regulations are without prejudice to the measures implementing the NIS 2 Directive in the State.

(3) These Regulations shall not apply to the following:

(a) an entity of the public administration sector in the areas of national security, public security, defence or law enforcement;

(b) the Oireachtas;

(c) a member of the judiciary;

(d) the Central Bank, other than in its capacity as a competent authority of a critical entity.

(4) Regulations 9(9), (10) and (12) to (17), 11(7), 15 to 21, 23, 25 to 28 and 30 to 33 shall not apply to critical entities—

(a) that carry out activities in the areas of national security, public security, defence or law enforcement, including the investigation, detection and prosecution of criminal offences, or

(b) which provide services exclusively to the entities of the public administration sector referred to in paragraph (3)(a).

(5) Nothing in these Regulations shall be construed as prohibiting the adoption or application of a measure or provision, in the State, that achieves a higher level of resilience of critical entities than that specified in these Regulations.

(6) In this Regulation, “member of the judiciary” has the meaning given to it in section 196 of the Taxes Consolidation Act 1997 (No. 39 of 1997).

Safeguarding of essential functions of State

4. (1) Nothing in these Regulations shall prejudice the ability of the State to safeguard its essential functions, including the following:

(a) its national security, including taking action to protect information the disclosure of which is considered by a competent authority concerned to be contrary to the State’s essential security interests;

(b) the maintenance of law and order;

(c) the territorial integrity of the State;

(d) the ability of the State to investigate, detect and prosecute criminal offences.

(2) The critical entities in the public administration sector shall meet the relevant critical entity obligations applicable to the public administration sector in the State not later than 17 June 2027.

PART 3

ADMINISTRATION

Sharing of information

5 (1) Information, including personal data, may be shared by a competent authority, a critical entity or a single point of contact in accordance with these Regulations.

(2) Where a competent authority or a single point of contact shares information in relation to a critical entity, for the purpose of these Regulations, the competent authority or the single point of contact, as the case may be, shall take all reasonable steps, having had regard to the requirements of these Regulations and any representations as to the confidentiality of the information concerned made by an interested party on its disclosure, while respecting the security of the State and other Member States, to protect the confidentiality of the information so shared and the commercial interests of the critical entity to which the information relates.

(3) The obligations on the sharing of information in these Regulations shall not require the disclosure of information which would be contrary to the essential interests of the State’s—

(a) national security,

(b) public security, or

(c) defence.

(4) These Regulations are without prejudice to Union law on the protection of personal data, in particular the General Data Protection Regulation and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 ( S.I. No. 336 of 2011 ).

(5) Where an incident has occurred that results in a personal data breach in connection with any function under these Regulations, the competent authority concerned shall work in close co-operation with the Data Protection Commission in addressing the incident.

(6) A single point of contact, a critical entity or a competent authority shall, in accordance with the law, consult and co-operate, including where necessary by sharing information, with the Garda Siochána in relation to any matter to which these Regulations relate.

Funding of competent authorities and critical entities

6. (1) The Minister responsible for the sector concerned, may provide such assistance, including financial assistance, to the relevant competent authorities as the Minister responsible considers appropriate in relation to the discharge of their functions under these Regulations.

(2) The Minister responsible for the sector concerned, may provide such assistance, including financial assistance, to a critical entity where the Minister responsible decides it is necessary for meeting the obligations of the entity concerned under these Regulations.

(3) Any assistance provided, under paragraph (1) or (2), by the Minister responsible for the sector concerned shall be subject to the conditions, if any, determined by the Minister responsible providing the assistance to be necessary having regard to the State’s obligations under the Directive.

PART 4

SINGLE POINT OF CONTACT AND COMPETENT AUTHORITIES

Single point of contact

7. (1) Without prejudice to the requirements of sector-specific Union legal acts, the Minister is designated as the single point of contact in the State for the purposes of Article 9(2) of the Directive.

(2) The Minister shall—

(a) liaise with the Critical Entities Resilience Group and the designated single point of contact of other Member States, to ensure cross-border co-operation in relation to the Directive and these Regulations,

(b) liaise and co-operate with each competent authority in accordance with these Regulations, and

(c) require competent authorities in the State to, and where so required the competent authorities shall, provide information in relation to the functioning of the measures for which these Regulations provide.

(3) The Minister shall, not later than three years and nine months after the date of the coming into operation of these Regulations, and at intervals of not more than two years thereafter, submit reports to the European Commission and the Critical Entities Resilience Group in relation to incident notifications made to the competent authorities under these Regulations.

(4) Not later than 90 days after the date of the coming into operation of these Regulations, the Minister shall, in writing, notify the European Commission of the following:

(a) the identities in the State, for the purpose of the Directive, of the following:

(i) competent authorities, and

(ii) the single point of contact;

(b) the tasks and responsibilities, under these Regulations, of the competent authorities and single point of contact;

(c) the contact details of the competent authorities and single point of contact.

(5) The Minister shall, in writing, notify the European Commission as soon as practicable after any change in the identity or contact details, previously notified under paragraph (4), of the entities referred to in clauses (i) and (ii) of paragraph (4)(a).

(6) The Minister shall, in writing, notify the European Commission where a different authority is designated, other than the competent authorities in the State for the purposes of the NIS 2 Directive or the DORA Regulation, as the competent authority in respect of any critical entities in the sectors set out in the entries numbered 3, 4 and 8 in column (1) of the Table set out in the Schedule.

(7) The Minister shall publish, on a website maintained by him or her, as soon as practicable after the date of the coming into operation of these Regulations and after the date of any subsequent change, the identity of the competent authorities, and single point of contact, for the purpose of these Regulations.

(8) Subject to paragraph (9), following the identification of the critical entities under Regulation 12, the Minister shall submit the following information to the European Commission:

(a) a list of essential services in the State where there are any additional essential services as compared to the delegated list of essential services referred to in paragraph (4) of Regulation 11;

(b) the number of critical entities identified for each sector and subsector specified in the Table set out in the Schedule and for each essential service;

(c) any thresholds, which may be presented as such or in aggregated form, applied to specify one or more of the criteria specified in paragraph (3) of Regulation 12.

(9) The Minister shall subsequently submit the information mentioned in subparagraphs (a) to (c) of paragraph (8) whenever necessary and, in any event, not later than 17 July 2030 and, thereafter, at intervals of not less than four years of the anniversary of that date.

(10) The Minister shall notify the European Commission, without delay, of any amendment to the penalties set out in Regulation 30.

Designation of competent authorities

8. (1) Subject to paragraph (2), the Minister may, from time to time, having consulted with the Minister responsible for the sector concerned, designate entities as competent authorities in respect of the sector concerned, in addition to, or in lieu of, the competent authorities specified in paragraph (2), where the Minister is of the opinion that such designation is necessary to ensure the application and enforcement of these Regulations.

(2) For the purposes of these Regulations—

(a) the Commission for Regulation of Utilities is designated as the competent authority in the State on resilience in respect of critical entities in the energy sector specified at entry no. 1 in column (1) of the Table set out in the Schedule,

(b) the Environmental Protection Agency is designated as the competent authority in the State on resilience in respect of critical entities in the following sectors:

(i) the drinking water sector specified at entry no. 6 in column (1) of the Table set out in the Schedule;

(ii) the waste water sector specified at entry no. 7 in column (1) of the Table set out in the Schedule,

(c) the Irish Aviation Authority is designated as the competent authority in the State on resilience in respect of critical entities in the transport/air sector specified at entry no. 2(a) in columns (1) and (2) of the Table set out in the Schedule,

(d) the Commission for Railway Regulation is designated as the competent authority in the State on resilience in respect of critical entities in the following sectors:

(i) the transport/rail sector specified at entry no. 2(b) in columns (1) and (2) of the Table set out in the Schedule;

(ii) the public transport sector specified at entry no. 2(e) in columns (1) and (2) of the Table set out in the Schedule, where those public transport services are provided on a railway,

(e) the Marine Survey Office, under the aegis of the Minister for Transport, is designated as the competent authority in the State on resilience in respect of critical entities in the transport/water sector specified at entry no. 2(c) in columns (1) and (2) of the Table set out in the Schedule,

(f) the National Transport Authority is designated as the competent authority in the State on resilience in respect of critical entities in the following sectors:

(i) the transport/road sector specified at entry no. 2(d) in columns (1) and (2) of the Table set out in the Schedule;

(ii) other than in respect of public transport services provided on a railway, the public transport sector specified at entry no. 2(e) in columns (1) and (2) of the Table set out in the Schedule,

(g) the Central Bank is designated as the competent authority in the State on resilience in respect of critical entities in the following sectors:

(i) the banking sector specified at entry no. 3 in column (1) of the Table set out in the Schedule;

(ii) the financial market infrastructure sector specified at entry no. 4 in column (1) of the Table set out in the Schedule,

(h) the Health Information and Quality Authority is designated as the competent authority in the State on resilience in respect of critical entities in the health sector specified in paragraph (i) in column (3) of entry no. 5 of the Table set out in the Schedule,

(i) the Health Products Regulatory Authority is designated as the competent authority in the State on resilience in respect of critical entities in the health sector specified in paragraphs (iv) to (vi) in column (3) of entry no. 5 of the Table set out in the Schedule,

(j) the Minister of the Government having responsibility, for the time being, for the health sector in the State is designated as the competent authority in the State on resilience in respect of critical entities in the health sector specified in paragraphs (ii) and (iii) in column (3) of entry no. 5 of the Table set out in the Schedule,

(k) the Commission for Communications Regulation is designated as the competent authority in the State on resilience in respect of critical entities in the digital infrastructure sector specified at entry no. 8 in column 1 of the Table set out in the Schedule,

(l) the Minister of the Government having responsibility, for the time being, for the space sector in the State is designated as the competent authority in the State on resilience in respect of the critical entities in the space sector specified at entry no. 10 in column (1) of the Table set out in the Schedule, and

(m) the Minister for Agriculture, Food and the Marine is designated as the competent authority in the State on resilience in respect of critical entities in the food production, processing and distribution sector specified at entry no. 11 in column (1) of the Table set out in the Schedule.

Functions of competent authorities

9. (1) A competent authority shall, in respect of each sector in which it is designated as a competent authority for the purpose of these Regulations—

(a) comply and co-operate with the Minister and the critical entities, in the sector for which it is designated, in accordance with these Regulations, and

(b) apply the measures, and perform its obligations, set out in these Regulations.

(2) Each competent authority, whenever appropriate, and in accordance with Union law and the law of the State, shall consult and cooperate with—

(a) other relevant national authorities, including those in charge of civil protection, law enforcement and the protection of personal data,

(b) critical entities, and

(c) relevant interested parties.

(3) Each competent authority, under these Regulations, shall cooperate and exchange information with competent authorities under the NIS 2 Directive on cybersecurity risks, cyber threats and cyber incidents and non-cyber risks, threats and incidents affecting critical entities, including with regard to relevant measures the competent authority and competent authorities under NIS 2 Directive have taken.

(4) A competent authority shall co-operate, exchange information and good practices as required with the critical entities identified in the sectors specified in the Table set out in the Schedule to which they are identified by the relevant competent authority.

(5) A competent authority shall participate in, and inform, a national risk assessment.

(6) A competent authority shall make available to a critical entity, for which it is competent authority under these Regulations, any information from a national risk assessment which it considers relevant to that critical entity in accordance with Regulation 11, for the purpose of assisting that critical entity with its obligations under these Regulations.

(7) A competent authority shall use the information obtained from the national risk assessment to identify critical entities in the sector for which it is designated as the competent authority in accordance with Regulation 12.

(8) A competent authority shall notify a critical entity of its identification as a critical entity in accordance with Regulation 12.

(9) A competent authority shall co-operate with any advisory mission organised by the European Commission in relation to a critical entity of particular European significance for which it is designated as a competent authority in accordance with Regulation 21.

(10) Where considered necessary by a competent authority, the authority shall request that the European Commission organise an advisory mission in relation to a critical entity of particular European significance in another Member State that it has identified through the national risk assessment in accordance with Regulation 21.

(11) A competent authority shall establish and maintain a list of critical entities in the sectors, for which it is the relevant authority, in accordance with Regulation 13.

(12) Upon request by the Minister, a competent authority shall make available to the Minister any incident notifications it has received from critical entities.

(13) A competent authority may, in relation to those sectors in respect of which it is designated as the competent authority, carry out an assessment, whether by means of an audit or otherwise, of the compliance by a critical entity with its obligations under Regulation 16 and, for that purpose, may appoint an independent person or auditor to carry out the assessment on its behalf.

(14) A competent authority may request a critical entity to, and where requested the critical entity shall, provide the competent authority with the following:

(a) the information necessary for that competent authority to assess the resilience of the critical entity, including documented resilience and security policies;

(b) evidence of the effective implementation by the critical entity, of resilience and security policies including the implementation of any recommendations made on foot of an audit or other assessment.

(15) A competent authority may request a critical entity to, and where requested the critical entity shall, undertake any measures considered necessary by the competent authority to ensure the resilience of the critical entity in accordance with Regulation 16.

(16) Following an incident, a competent authority—

(a) shall—

(i) ensure that any necessary measures are taken by the relevant critical entity to prevent a repeat of that incident,

(ii) collect, by inspection, investigation or other appropriate means, the information necessary for a full analysis of the technical, organisational and managerial aspects of the incident,

(iii) conduct an analysis of the incident, and

(iv) take appropriate action to ensure that the critical entity takes any necessary remedial measures, and

(b) may make recommendations to the critical entities concerned on future preventive measures including, if appropriate, in conjunction with the single point of contact.

(17) A critical entity that fails to comply with a request under paragraph (14) or (15) commits an offence.

PART 5

NATIONAL STRATEGY ON RESILIENCE OF CRITICAL ENTITIES

National Strategy on the Resilience of Critical Entities

10. (1) As soon as may be after the coming into operation of these Regulations, the Minister shall prepare a strategy on the resilience of critical entities in the State, which shall be known as the National Strategy on the Resilience of Critical Entities.

(2) The National Strategy on the Resilience of Critical Entities shall set out strategic objectives, and policy and regulatory measures, intended to achieve and maintain a high-level critical entities’ resilience in not fewer than the sectors specified in the Table set out in the Schedule and shall address the following:

(a) strategic objectives and priorities for the purposes of enhancing the overall resilience of critical entities, taking into account cross-border and cross-sectoral dependencies and interdependencies;

(b) a governance framework to achieve the strategic objectives and priorities, including a description of the roles and responsibilities of the different authorities, critical entities and other parties involved in the implementation of the strategy;

(c) a description of measures necessary to enhance the overall resilience of critical entities, including a description of the risk assessment;

(d) a description of the process by which critical entities are identified;

(e) a description of the process supporting critical entities, including measures to enhance cooperation between the public sector and the private sector and between public and private entities;

(f) a list of the main authorities and relevant stakeholders, other than critical entities, involved in the implementation of the strategy;

(g) a policy framework for coordination between the competent authorities under these Regulations and the competent authorities under the NIS 2 Directive for the purposes of information sharing on cybersecurity risks, cyber threats and cyber incidents and non-cyber risks, threats and incidents and the exercise of supervisory tasks;

(h) a description of measures already in place which aim to facilitate the implementation of obligations under these Regulations by small and medium-sized enterprises within the meaning of the Annex to Commission Recommendation 2003/361/EC of 6 May 2003⁷ that the Member State in question has identified as critical entities.

(3) The Minister may provide, in such form and in such manner as he or she considers appropriate, a draft of the proposed National Strategy on the Resilience of Critical Entities to relevant stakeholders, including to the following:

(a) Ministers of the Government;

(b) competent authorities;

(c) critical entities.

(4) Where a draft of the proposed National Strategy on the Resilience of Critical Entities is provided in accordance with paragraph (3), a person may make written submissions or representations to the Minister in relation to the draft within a period of 20 working days of the date on which that draft is provided.

(5) The Minister shall consider any submissions or representations made to him or her under paragraph (4) before adoption of the strategy.

(6) The first National Strategy on the Resilience of Critical Entities shall be adopted not later than 15 months after the date on which these Regulations come into operation and the Minister shall adopt such revised versions, where required, as soon as may be having conducted a review referred to in paragraphs (8) and (9).

(7) The Minister shall cause a copy of the National Strategy on the Resilience of Critical Entities to be laid before each House of the Oireachtas and, not more than five working days after the strategy is so laid before the Houses, the Minister shall cause it to be published on a website, maintained by him or her, in such form and in such manner as the Minister considers appropriate.

(8) The Minister may review the National Strategy on the Resilience of Critical Entities adopted under this Regulation at any time and, in any event, shall review it not later than four years after the date of its first adoption and thereafter not later than on every fourth anniversary of that date.

(9) Where, after carrying out a review referred to in paragraph (8), the Minister decides to revise the National Strategy on the Resilience of Critical Entities, paragraphs (3) to (5), (7) and (8) shall apply, with any necessary modifications, in respect of any such revision.

(10) The Minister may, in preparing the National Strategy on the Resilience of Critical Entities, or any revisions thereto, request the assistance of the Critical Entities Resilience Group, Union-wide supports and international partnerships.

(11) The Minister shall ensure that the National Strategy on the Resilience of Critical Entities and any substantial updates thereto, following a review conducted in accordance with paragraphs (8) and (9), are communicated to the European Commission not later than three months after the date of their adoption.

PART 6

CRITICAL ENTITIES

National risk assessment

11. (1) A national risk assessment shall be carried out by the Minister not later than 15 months after the date of the coming into operation of these Regulations.

(2) For the purposes of a national risk assessment and its obligations under Regulation 12(1), a competent authority may request, and where so requested the entity concerned shall provide, information from an entity which the competent authority believes, based on reasonable grounds, that it requires for the purpose of deciding whether to identify that entity as a critical entity.

(3) The national risk assessment shall account for the relevant natural and man-made risks, including, but not limited to, those of a cross-sectoral or cross-border nature, accidents, natural disasters, public health emergencies and hybrid threats or other antagonistic threats, including terrorist offences as provided for in Criminal Justice (Terrorist Offences) Act 2005 (No. 2 of 2005).

(4) The national risk assessment shall take into account, but shall not be limited to, the following:

(a) the delegated list of essential services established by the Delegated Regulation;

(b) other relevant risk assessments, carried out in accordance with the requirements of the relevant sector-specific Union legal acts, including the following:

(i) Regulation (EU) 2017/1938 of the European Parliament and of the Council of 25 October 2017⁸ , as amended;

(ii) Regulation (EU) 2019/941 of the European Parliament and of the Council of 5 June 2019⁹ ;

(iii) the European Communities (Assessment and Management of Flood Risks) Regulations 2010 ( S.I. No. 122 of 2010 );

(iv) the Chemicals Act (Control of Major Accident Hazards Involving Dangerous Substances) Regulations 2015 ( S.I. No. 209 of 2015 );

(c) the relevant risks arising from the extent to which the sectors specified in the Table set out in the Schedule depend on one another, including—

(i) the extent to which they depend on entities located within other Member States and third countries, and

(ii) the impact that a significant disruption in one sector may have on other sectors, including any significant risks to citizens and the internal market of the Union;

(d) any information on incidents notified in accordance with Regulation 18.

(5) For the purposes of paragraph (4)(c), competent authorities shall cooperate with the competent authorities of other Member States and the competent authorities of third countries, as appropriate.

(6) Competent authorities shall make the relevant elements of the national risk assessment available to the critical entities that they have identified in accordance with Regulation 12.

(7) Competent authorities shall ensure that—

(a) the information provided to critical entities assists those entities in carrying out their risk assessments pursuant to Regulation 15, including sector-specific risks and identified risks affecting the critical entity in line with national policy, and

(b) critical entities, in taking measures relating to their resilience pursuant to Regulation 16, including measures as outlined in the National Strategy on the Resilience of Critical Entities, are in compliance with their obligations under these Regulations.

(8) Not later than three months after the date of carrying out the national risk assessment, the Minister shall provide the European Commission with relevant information on the types of risks identified following, and the outcomes of, the national risk assessment in relation to the sectors and subsectors specified in the Table set out in the Schedule.

(9) A national risk assessment may be carried out at any time and, in any event, shall be carried out not later than the time specified in paragraph (1) and thereafter not later than every fourth anniversary of the date of the immediately preceding risk assessment.

(10) An entity providing an essential service that fails to comply with a request made under paragraph (2) commits an offence.

(11) In this Regulation, “internal market of the Union” shall be construed in accordance with Article 26 of the Treaty on the Functioning of the European Union;

Identification of critical entities

12. (1) A competent authority concerned shall identify the critical entities for the sectors and subsectors specified in columns (1) and (2) of the Table set out in the Schedule not later than 21 months after the date of the coming into operation of these Regulations and shall ensure that those critical entities are notified that they have been identified as critical entities not later than one month after the date of that identification.

(2) In identifying critical entities pursuant to paragraph (1), a competent authority shall take into account the outcomes of the national risk assessment.

(3) A competent authority shall identify an entity as a critical entity in a sector in respect of which the competent authority is designated as the competent authority where that competent authority is satisfied that—

(a) the entity provides one or more essential services,

(b) the entity operates, and its critical infrastructure is located, in the territory of the State, and

(c) an incident would have significant disruptive effects, on the provision by the entity of one or more essential services or on the provision of other essential services in the sectors specified in the Table set out in the Schedule that depend on that or those essential services.

(4) In determining the significance of a disruptive effect insofar as it relates to the provision by a critical entity of an essential service in the State, a competent authority—

(a) may take into account factors specific to the sector to which the critical entity providing the service belongs and any other criteria as specified, from time to time, by the Minister in—

(i) the National Strategy on the Resilience of Critical Entities, or

(ii) guidelines published under Regulation 22, and

(b) in every case, shall take into account the following:

(i) the number of users relying on the essential service provided by the entity concerned;

(ii) the extent to which other sectors and subsectors specified in columns (1) and (2) of the Table set out in the Schedule depend on the essential service in question;

(iii) the impact that incidents could have, in terms of degree and duration, on economic and societal activities, the environment, public safety and security, or the health of the population, in the State;

(iv) the entity’s market share in the market for the essential service concerned;

(v) the geographic area that could be affected by an incident, including any cross-border impact, taking into account the vulnerability associated with the degree of isolation of certain types of geographic areas, such as insular regions, remote regions or mountainous areas;

(vi) the importance of the entity in maintaining a sufficient level of the essential service, taking into account the availability of alternative means for the provision of that essential service.

(5) A competent authority concerned shall inform critical entities of their obligations under these Regulations and the date from which those obligations apply to them.

(6) Competent authorities shall inform critical entities in the sectors specified at the entries numbered 3, 4 and 8 in column (1) of the Table set out in the Schedule that they have no obligations under Regulations 9(9), (10) and (12) to (17), 11(7), 15 to 21, 23, 25 to 28 and 30 to 33.

(7) For the critical entities concerned, these Regulations shall apply from the date that is 10 months after the date of the notification referred to in paragraph (1).

(8) Competent authorities designated under Regulation 8 shall notify the competent authorities designated for the purpose of the NIS 2 Directive of the identity of the critical entities that they have identified under this Regulation not later than one month after that identification and such notification shall specify, where applicable, that the critical entities concerned are entities in the sectors specified at the entries numbered 3, 4 and 8 in column (1) of the Table set out in the Schedule and, as such, have no obligations under Regulations 9(9), (10) and (12) to (17), 11(7), 15 to 21, 23, 25 to 28 and 30 to 33.

(9) Where a competent authority proposes to identify an entity as critical entity, the competent authority shall notify the entity, in writing, accordingly, and shall—

(a) state the reasons why the entity is proposed to be identified,

(b) specify the category of sector and, where appropriate, subsector, and the essential service in respect of which the entity is to be so identified, and

(c) give the entity an opportunity to make representations, in writing, to the competent authority in respect of the proposed identification, not later than 15 working days after the date of the notification.

(10) The competent authority shall consider any representations made by an entity under paragraph (9) and shall, not later than 20 working days after the earlier of—

(a) the date of receipt of the representations, or

(b) the expiration of the period referred to in paragraph (9)(c),

decide whether to identify the entity as a critical entity in respect of a particular category of sector, subsector or essential service.

(11) Where a competent authority decides to identify an entity as a critical entity, the authority shall notify the entity concerned in writing stating—

(a) that the entity concerned is so identified,

(b) the category of sector and, where appropriate, subsector and the essential service in respect of which the entity concerned is so identified, and

(c) where the entity concerned has made representations in accordance with paragraph (9), the reasons why the entity is so identified.

(12) A competent authority shall promptly enter particulars of an entity identified by it as a critical entity in the critical entities list maintained by it under Regulation 13.

Critical entities list

13. (1) For the purpose of identifying a person, or other entity, as a critical entity, each competent authority shall establish and maintain—

(a) a list containing particulars of critical entities in each sector in respect of which that competent authority is designated as the competent authority, and

(b) a list of critical entities which that authority is satisfied are essential for the maintenance of critical societal activities or critical economic activities in the State.

(2) For each critical entity on the critical entities list, the relevant competent authority shall record the following:

(a) the name of the entity;

(b) the address of the entity;

(c) the name of its designated liaison officer within the meaning of Regulation 16(10);

(d) the contact information for its liaison officer.

(3) The list of identified critical entities maintained under Regulation 13 shall be reviewed and updated by the competent authority concerned from time to time and, in any event, not later than 17 July 2030 and, thereafter, not later than every fourth anniversary of that date.

(4) Where updates, mentioned in paragraph (3), lead to the identification of additional critical entities, the obligations set out in Regulation 12 shall apply to the competent authority in relation to those additional critical entities.

(5) Subsequent to a review and update under paragraph (3), the competent authority shall ensure that entities that are no longer identified as critical entities are notified, in writing, in due time that they are no longer —

(a) identified as critical entities, and

(b) subject to the obligations of a critical entity under these Regulations from the date of receipt of the notification.

Cancellation of identification as critical entity on request of critical entity

14. (1) A critical entity that is of the view that it is no longer appropriate for it to be identified as a critical entity in respect of a particular category of sector or subsector, or essential service, may notify the competent authority concerned in writing—

(a) setting out the reasons and grounds why the critical entity has formed that view, and

(b) requesting that it should no longer be identified as a critical entity in respect of a particular category of sector or subsector, or essential service, as the case may be.

(2) Where a competent authority proposes to refuse a request for cancellation of identification made to it under paragraph (1), it shall notify the critical entity concerned in writing accordingly, giving the critical entity an opportunity to make representations in writing to the competent authority in respect of the proposal not later than 15 working days after the date of the notification of the proposal.

(3) The competent authority shall consider any representations made by the entity concerned in accordance with paragraph (2) and shall, not later than 20 working days after the earlier of—

(a) the date of receipt of the representations, or

(b) the expiration of the period referred to in paragraph (2),

decide whether to make the cancellation.

(4) Where the competent authority decides to make a cancellation of identification, pursuant to a notification made to it under paragraph (1), as soon as possible, it shall notify the critical entity concerned in writing that they are no longer—

(a) identified as critical entities, and

(b) subject to the obligations of a critical entity under these Regulations from the date of receipt of the notification.

(5) Where the competent authority concerned decides to make a cancellation of identification, pursuant to a notification under paragraph (1), the competent authority shall promptly amend the critical entities list maintained by it under Regulation 13 accordingly.

Critical entity risk assessments

15. (1) Notwithstanding the date referred to in Regulation 12(5), critical entities shall carry out a critical entity risk assessment—

(a) not later than nine months after the date of receipt of the notification referred to in Regulation 12(1),

(b) whenever a relevant new risk has been identified which had not previously been assessed in such an assessment, and

(c) not later than every fourth anniversary of the date of the assessment carried out under subparagraph (a).

(2) The critical entity risk assessment, mentioned in paragraph (1), shall be carried out on the basis of the national risk assessment, and other relevant sources of information, in order to assess all relevant risks that could disrupt the provision of their essential services.

(3) A critical entity risk assessment, mentioned in paragraph (1), shall account for all the relevant natural and man-made risks which could lead to an incident, including those of a cross-sectoral or cross-border nature, accidents, natural disasters, public health emergencies and hybrid threats and other antagonistic threats, including terrorist offences as provided for in Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017¹⁰ .

(4) A critical entity risk assessment, mentioned in paragraph (1), shall take into account the extent to which other sectors as specified in the Table set out in the Schedule depend on the essential service provided by the critical entity concerned and the extent to which that critical entity depends on essential services provided by other entities in such other sectors, including, where relevant, in neighbouring Member States and third countries.

(5) Where a critical entity has carried out other risk assessments or drawn up documents pursuant to obligations, other than under these Regulations, that are relevant for its critical entity risk assessment, mentioned in paragraph (1), it may use those assessments and documents to meet the requirements set out in this Regulation.

(6) When exercising its supervisory functions, the competent authority may declare an existing risk assessment carried out by a critical entity that addresses the risks and extent of dependence referred to in paragraph (4) as compliant, in whole or in part, with the obligations under this Regulation.

(7) A critical entity that fails to comply with paragraph (1) commits an offence.

Resilience and security requirements in respect of critical entities

16. (1) Critical entities shall take appropriate and proportionate technical, security and organisational measures to ensure their resilience, based on the following:

(a) the National Strategy on the Resilience of Critical Entities;

(b) a national risk assessment;

(c) the relevant information provided in any risk assessment of the relevant competent authority;

(d) the outcomes of a critical entity risk assessment, which shall include the measures mentioned in paragraph (2);

(e) guidelines, if any, prepared and published by the Minister under Regulation 22.

(2) The measures referred to in paragraph (1)(d) shall include the measures necessary for the following purposes:

(a) to prevent incidents from occurring, duly considering disaster risk reduction and climate adaptation measures;

(b) to ensure adequate physical protection of their premises and critical infrastructure, duly considering, including other things, fencing, barriers, perimeter monitoring tools and routines, detection equipment and access controls;

(c) to respond to, resist and mitigate the consequences of incidents, duly considering the implementation of—

(i) risk and crisis management procedures, and

(ii) protocols and alert routines;

(d) to recover from incidents, duly considering business continuity measures and the identification of alternative supply chains, in order to resume the provision of the essential service;

(e) subject to paragraph (3), to ensure adequate employee security management, duly considering measures such as—

(i) setting out categories of personnel who exercise critical functions,

(ii) establishing access rights to premises, critical infrastructure and sensitive information,

(iii) setting up procedures for background checks in accordance with Regulation 17 and designating the categories of persons who are required to undergo such background checks, and

(iv) laying down appropriate training requirements and qualifications;

(f) to raise awareness about the measures referred to in subparagraphs (a) to (e) among relevant personnel, duly considering training courses, information materials and exercises.

(3) For the purposes of the paragraph (2)(e), critical entities shall take into account the personnel of external service providers when setting out categories of personnel who exercise critical functions.

(4) Critical entities shall have in place, and apply, a resilience plan or equivalent document which describes the measures taken pursuant to paragraph (1) and where critical entities have already adopted such plan or document, or taken measures pursuant to obligations laid down in other legal acts that are relevant for the measures referred to in paragraph (1), they may use those plans, documents and measures to meet the requirements set out in this Regulation.

(5) When exercising its supervisory functions, a competent authority may declare existing resilience-enhancing measures taken by a critical entity that address, in an appropriate and proportionate manner, the technical, security and organisational measures referred to in paragraph (1) as compliant, in whole or in part, with the obligations under this Regulation.

(6) The resilience plan or equivalent document, mentioned in paragraph (4), shall be made available by the critical entity concerned to the relevant competent authority, upon written request, and shall include the following:

(a) an assessment of potential risks for the critical entity concerned;

(b) a list of mitigation measures for the potential risks, mentioned in subparagraph (a), and details of a system for implementing them;

(c) a demonstration that incident scenarios have been identified and that the necessary measures have been taken to prevent such incidents and to limit their consequences on society;

(d) a demonstration that adequate precautions have been taken into account in the design, construction, operation and maintenance of any installation, storage facility, equipment and infrastructure connected with its operation;

(e) a demonstration that internal emergency plans have been drawn up and include information to enable an external emergency plan to be prepared;

(f) a demonstration that adequate precautions have been taken into account in the design and operation of supply chains.

(7) A critical entity shall prepare a resilience plan or equivalent document, mentioned in paragraph (4), not later than 10 months after the date that they are notified of their identification as a critical entity for the purpose of these Regulations.

(8) A critical entity shall ensure that the policy set out in its resilience plan or equivalent document, mentioned in paragraph (4), is properly implemented by appropriate means and structures, proportionate to the complexity of the organisation or the activities of the critical entity concerned.

(9) A critical entity shall review and where necessary update its resilience plan or equivalent document, mentioned in paragraph (4)—

(a) following an incident,

(b) at any time, at the initiative of the critical entity concerned,

(c) at the request of the relevant competent authority,

(d) where justified by new facts or by new technological knowledge about resilience matters, including knowledge arising from analysis of incidents or, as far as possible, occurrences which do not, as such, amount to incidents, and

(e) by developments in the knowledge available on the assessment of threats.

(10) A critical entity shall designate a liaison officer or equivalent as the point of contact with the relevant competent authority.

(11) With the agreement of the critical entity concerned, the Minister may request the European Commission to organise an advisory mission to that critical entity, in accordance with the arrangements set out in Regulation 21.

(12) A critical entity that fails to comply with paragraph (1), (3), (4), (6), (7), (8), (9) or (10) commits an offence.

Background checks

17. (1) The Minister shall make arrangements, or have arrangements made on his or her behalf, having consulted any other Minister of the Government that he or she considers appropriate having had regard to the requirements of these Regulations, for the submission and completion of background checks under these Regulations.

(2) The arrangements referred to in paragraph (1), shall specify the conditions under which a critical entity is permitted, having taken into account the national risk assessment and having formed the belief, based on reasonable grounds, that it is necessary for its obligations under these Regulations, to submit requests for background checks on persons who—

(a) hold sensitive roles in, or for the benefit of, the critical entity, in particular in relation to the resilience of the critical entity,

(b) are authorised to directly or remotely access its premises, information or control systems, including in connection with the security of the critical entity, or

(c) are under consideration for recruitment to positions that fall under the criteria set out in subparagraph (a) or (b).

(3) Requests referred to in paragraph (2) shall be assessed within a reasonable timeframe and processed in accordance with national law and procedures and relevant and applicable Union law, including the General Data Protection Regulation and the Data Protection Act 2018 (No. 7 of 2018).

(4) Background checks, for the purpose of this Regulation, shall be—

(a) proportionate and strictly limited to what is necessary, and

(b) carried out for the sole purpose of evaluating a potential security risk to the critical entity concerned.

(5) A background check, for the purpose of this Regulation, shall at a minimum—

(a) corroborate the identity of the person who is the subject of the background check, and

(b) check the criminal record of that person with regards to offences which would be relevant for a specific position.

Incident notification by critical entities

18. (1) Subject to paragraph (2), critical entities shall, in writing, notify their competent authority, without undue delay, of incidents that significantly disrupt, or have the potential to significantly disrupt, the provision of essential services.

(2) Subject to paragraphs (8) and (9), other than where operationally unable to do so, critical entities shall submit an initial notification under paragraph (1) to their competent authority, not later than 24 hours after becoming aware of an incident, followed, not later than one month after the date of becoming so aware, where relevant, by a detailed report as outlined by the national resilience policy.

(3) In order to determine the significance of a disruption, referred to in paragraph (1), the following parameters shall, in particular, be taken into account by the critical entity concerned:

(a) the number and proportion of users affected by the disruption;

(b) the duration of the disruption;

(c) subject to paragraph (4), the geographical area affected by the disruption, taking into account whether the area is geographically isolated.

(4) Where an incident of disruption in a notification, made to it under paragraph (1), has, or might have, a significant impact on the continuity of the provision of essential services to, or in, six or more Member States (including the State), the competent authority concerned in the State, shall, via the Minister, notify the European Commission of that incident.

(5) Following a notification made to it by a critical entity under paragraph (1), the competent authority concerned shall notify the incident, without undue delay to—

(a) the Minister, and

(b) the Minister responsible for the sector concerned.

(6) A notification under paragraph (1) or (5)—

(a) shall include any available information necessary to enable the competent authority or the Minister, as the case may be, to understand the nature, cause and possible consequences of the incident, including any available information necessary to determine any cross-border impact of the incident, and

(b) shall not subject critical entities to increased liability.

(7) Without limitation of paragraph (6), a notification shall include, at a minimum, the following:

(a) the name of the critical entity concerned;

(b) the full address of the critical entity concerned;

(c) the affected essential service provided by the critical entity concerned;

(d) the location, and full address, of the essential service affected;

(e) a full description of the incident that has occurred;

(f) details of other essential services that may be affected by the incident;

(g) whether the incident might have a significant impact on critical entities and the continuity of the provision of essential services to, or in, one or more other Member States.

(8) The detailed report referred to paragraph (2) shall include the following information as soon as the information becomes available:

(a) the information mentioned in subparagraphs (a) to (g) of paragraph (7);

(b) the circumstances of the incident;

(c) the data available for assessing the effects of the incident on operations of the critical entity concerned;

(d) the immediate mitigation measures taken;

(e) the measures taken to mitigate the medium and long-term effects of the incident;

(f) the steps taken to prevent any recurrence of such an incident.

(9) The critical entity shall update the information provided, in the detailed report mentioned in paragraph (2), if further investigation reveals additional facts which alter that information or the conclusions drawn.

(10) On the basis of the information provided by a critical entity in a notification under paragraph (1), the relevant competent authority, via the Minister, shall inform the single point of contact of other affected Member States where the incident has or might have a significant impact on critical entities and the continuity of the provision of essential services to, or in, one or more other Member States.

(11) Where the Minister sends, or receives, information pursuant to paragraph (10), he or she shall, in accordance with Union law and the law of the State, treat that information in a way that respects its confidentiality and protects the security and commercial interest of the critical entity concerned.

(12) As soon as possible following a notification as referred to in paragraph (1), the competent authority concerned shall provide the critical entity concerned with relevant follow-up information, including information that could support that critical entity’s effective response to the incident in question.

(13) The Minister responsible for the sector concerned shall inform the public of a notification made under paragraph (1), where he or she determines that it would be in the public interest to do so.

(14) A critical entity that fails to comply with paragraph (1) commits an offence.

PART 7

CRITICAL ENTITIES OF PARTICULAR EUROPEAN SIGNIFICANCE

Identification of critical entities of particular European significance

19. (1) A critical entity shall be considered a critical entity of particular European significance where it—

(a) has been identified as a critical entity pursuant Regulation 12,

(b) provides the same or similar essential services to, or in, six or more Member States (whether or not including the State), and

(c) has been notified pursuant to paragraph (3) of Article 17 of the Directive.

(2) A critical entity, following the notification referred to in Regulation 12(1), shall inform its competent authority—

(a) the fact that it provides essential services to, or in, six or more Member States,

(b) the names of the Member States in which it provides those essential services to, or in, and

(c) the nature of the essential services that it provides to, or in, each of those Member States.

(3) The competent authority, informed by a critical entity concerned under paragraph (2), shall inform the Minister, without undue delay, of the existence of a critical entity in the State of potential particular European significance.

(4) The Minister shall notify the Minister responsible for the sector concerned and the European Commission, without undue delay, of the identity of the critical entity concerned, and of the information they provided, under paragraph (2).

(5) Following identification of the critical entity in the State of potential particular European significance, the Minister, shall consult with—

(a) the Minister responsible for the sector concerned,

(b) the critical entity concerned, and

(c) the competent authority of the entity concerned.

(6) On completion of the consultations mentioned in paragraph (5), the Minister shall consult with—

(a) the European Commission, and

(b) the competent authorities of the Member States to, or in, which the entity concerned provides essential services.

(7) Once the European Commission informs the competent authority of its decision to consider a critical entity as a critical entity of particular European significance, the competent authority shall—

(a) forward that notification to the critical entity without undue delay, and

(b) inform that critical entity—

(i) that it is considered to be a critical entity of particular European significance,

(ii) its obligations under this Part, and

(iii) the date from which those obligations apply to it.

(8) This Regulation shall apply to a critical entity of particular European significance concerned from the date of receipt of the notification referred to in paragraph (7).

Co-operation with other Member States

20. (1) Whenever appropriate, the Minister may consult with the single point of contact of other Member States regarding critical entities for the purpose of ensuring that the Directive is applied in a consistent manner.

(2) Such consultations shall take place, in particular, regarding critical entities that—

(a) use critical infrastructure which is physically connected between two, or more, Member States (whether or not including the State);

(b) are part of corporate structures that are connected with, or linked to, critical entities in other Member States, or

(c) have been identified as critical entities in one Member State and provide essential services to, or in, other Member States (whether or not including the State in each instance).

(3) The consultations, under this Regulation, shall aim at enhancing the resilience of critical entities and, where possible, reducing the administrative burden on them.

Advisory missions

21. (1) Where a critical entity identified under Regulation 12 is considered by the European Commission to be one of particular European significance, the Minister, having consulted with the Minister responsible for the sector concerned, may request the European Commission to organise an advisory mission to assess the measures that the critical entity concerned has put in place to meet its obligations under these Regulations.

(2) Where an essential service is being provided in the State by a critical entity of particular European significance in another Member State, the Minister may request the European Commission to organise an advisory mission for the purposes mentioned in paragraph (1).

(3) On receipt of a reasoned request from the European Commission, or from one or more Member States to, or in which, an essential service is provided, the Minister shall provide the following to the Commission:

(a) the relevant parts of the critical entity risk assessment;

(b) a list of relevant measures taken in accordance with Regulation 16;

(c) supervisory or enforcement actions, including assessments of compliance or orders issued, that its competent authority has undertaken pursuant to these Regulations in respect of that critical entity.

(4) A competent authority concerned and a critical entity concerned shall, through the Minister, receive the report of an advisory mission.

(5) The competent authority and the critical entity concerned shall take into account the report referred to in paragraph (4) and provide information through the Minister to the European Commission and the Member States to, or in, which the essential service is provided on the measures it has taken pursuant to that report.

(6) Each advisory mission shall consist of experts from the State, experts from the Member States to, or in, which the essential service is provided and European Commission representatives.

(7) The Minister may propose candidates to be part of an advisory mission.

(8) Critical entities of particular European significance shall provide advisory missions with access to information, systems and facilities relating to the provision of their essential services necessary for carrying out the advisory mission concerned.

(9) A critical entity that fails to comply with paragraph (8) commits an offence.

PART 8

GUIDANCE

Guidance

22. (1) For the purpose of providing practical guidance as regards compliance by critical entities and competent authorities with their obligations under these Regulations, the Minister may, from time to time and following consultation with such persons (if any) as he or she considers appropriate, prepare and publish guidelines.

(2) The guidelines, referred to in paragraph (1), shall specify the date on which they are to come into operation.

(3) The Minister may, following consultation with such persons (if any) as he or she considers appropriate, amend or revoke guidelines published under this Regulation.

(4) The Minister shall publish on a website maintained by him or her—

(a) the guidelines referred to in paragraph (1), and

(b) where guidelines prepared and published under paragraph (1) have been amended, the guidelines as amended.

(5) The Minister may prepare, and publish, guidelines for the purpose of providing practical guidance to the critical entities or the competent authorities in respect of the performance by such bodies of their functions.

(6) Guidelines prepared under this Regulation may include, but are not limited, to, the procedures to be followed for the purpose of the following:

(a) risk assessment;

(b) mitigation;

(c) reporting;

(d) incident response.

PART 9

IMPLEMENTATION AND ENFORCEMENT

Inspections, supervision and enforcement

23. (1) Competent authorities may—

(a) conduct on-site inspections of the critical infrastructure and the premises that the critical entity uses to provide its essential services, and off-site supervision of measures taken by critical entities in accordance with Regulation 16;

(b) conduct or order audits in respect of critical entities.

(2) Competent authorities may require that critical entities provide, within a reasonable time limit set by those authorities—

(a) the information necessary to assess whether the measures taken by those entities to ensure their resilience meet the requirements set out in Regulation 16;

(b) evidence of the effective implementation of those measures, including the results of an audit conducted by an independent and qualified auditor selected by that entity and conducted at its expense.

(3) When requiring the information referred to in paragraph (2), the competent authority concerned shall state the purpose of the requirement and specify the information required.

(4) Without prejudice to the possibility to impose penalties in accordance with Regulation 30, competent authorities may, following the supervisory actions referred to in paragraph (1) or the assessment of the information referred to in paragraph (2), require, in writing, the critical entities concerned to take the necessary and proportionate measures to remedy any identified infringement of these Regulations, within a reasonable time limit set by those authorities, and to provide those authorities with information on the measures taken.

(5) The requirement referred to in paragraph (4) shall take into account, in particular, the seriousness of the infringement.

(6) A competent authority under these Regulations that assesses the compliance of a critical entity pursuant to this Regulation shall inform the competent authorities concerned under NIS 2 Directive.

(7) For the purposes of paragraph (6), the competent authorities under these Regulations may request the competent authorities under NIS 2 Directive to exercise their supervisory and enforcement powers in relation to an entity under that Directive that has been identified as a critical entity under these Regulations.

(8) Competent authorities under these Regulations shall co-operate and exchange information with the competent authorities under NIS 2 Directive or the DORA Regulation, as appropriate.

Safeguards

24. (1) The functions provided for in these Regulations can only be exercised subject to appropriate safeguards.

(2) The safeguards, referred to in paragraph (1), shall guarantee, in particular, that such exercise takes place in an objective, transparent and proportionate manner, and that the rights and legitimate interests of the critical entities affected, such as the protection of trade and business secrets, are duly safeguarded, and, in any case, consistent with the principles of fair procedures.

PART 10

AUTHORISED OFFICERS

Appointment of authorised officers

25. (1) A competent authority may, in relation to those sectors in respect of which it is designated as the competent authority, appoint such and so many persons as it thinks fit to be authorised officers for the purposes of these Regulations and of ensuring compliance by—

(a) critical entities in those sectors with their requirements, or

(b) other entities providing an essential service in those sectors.

(2) A competent authority may terminate the appointment of an authorised officer under this Regulation, whether or not the appointment was for a fixed period.

(3) The appointment as an authorised officer under paragraph (1) ceases—

(a) if it is terminated under paragraph (2),

(b) if it is for a fixed period, on the expiry of that period, or

(c) if the person appointed is an officer or employee of the appointing competent authority, on the person ceasing to be such an officer or employee.

(4) An authorised officer appointed under this Regulation shall be furnished with a warrant of his or her appointment and shall, when exercising any power conferred on him or her under these Regulations, if requested by a person affected, produce the warrant of appointment or a copy of it to that person together with a form of personal identification.

Powers of authorised officers

26. (1) An authorised officer appointed under Regulation 25 shall, for the purposes of any or all of these Regulations and of ensuring compliance with their requirements or, where Regulation 19 applies, of assisting a competent authority in another Member State in accordance with that Regulation, have power to do any or all of the following:

(a) subject to paragraph (3), at all reasonable times enter and examine any place owned or operated by—

(i) a critical entity,

(ii) a critical entity of particular European significance, referred to in Regulation 19,

(iii) a person on behalf of an entity referred to in clause (i) or (ii), or

(iv) an entity providing an essential service,

for the purpose of, in relation to critical entity or an entity providing an essential service, assessing the compliance by that critical entity or entity providing an essential service with its obligations, or the obligations of the State, under these Regulations and the effects of such compliance on its resilience, or assisting a competent authority in another Member State under Regulation 19;

(b) for the purposes mentioned in subparagraph (a), to search and inspect the place, any process being carried out and any books, documents or records or things found at that place to the extent to which the place, process, books, documents or records or things relate to the resilience of that critical entity or entity providing an essential service, as the case may be;

(c) at a place referred to in subparagraph (a), request, inspect, review and examine any books, documents or records in respect of the resilience of a person referred to in subparagraph (a)(i) to (iv) which the authorised officer may reasonably require for the purpose of any search, examination, investigation, inspection, assessment or inquiry under these Regulations;

(d) require any person in charge of, or employed in, a place referred to in subparagraph (a) to produce to the authorised officer such books, documents or records (and in the case of such information in a non-legible form to reproduce it in a permanent legible form) that are in the person’s power, possession or control or to give to the authorised officer such information as the officer may reasonably require in relation to any entries in such books, documents or records;

(e) to inspect and take copies of or extracts from any such books, documents or records (including in the case of information in non-legible form a copy of or an extract from such information in a permanent legible form) or require that such a copy be provided;

(f) interview any person whom the authorised officer reasonably believes to be able to give to the authorised officer information or records relevant to any search, examination, investigation, inspection, assessment or inquiry under these Regulations and require the person to answer such questions as the authorised officer may ask relative to the search, examination, investigation, inspection, assessment or inquiry and to sign a declaration of the truth of the answers;

(g) require any person to afford the authorised officer such facilities and assistance within the person’s power, control or responsibilities as are reasonably necessary to enable the authorised officer to exercise any of the powers conferred on him or her by these Regulations.

(2) When performing a function under these Regulations, an authorised officer may, subject to any warrant under paragraph (5), be accompanied by such number of authorised officers or members of the Garda Síochána as he or she considers appropriate.

(3) An authorised officer shall not, other than with the consent of the occupier, enter a private dwelling unless the officer has obtained a warrant from the District Court under paragraph (5) authorising such entry.

(4) Where an authorised officer in the exercise of his or her powers under these Regulations is prevented from entering any place, an application may be made to the District Court under paragraph (5) for a warrant authorising such entry.

(5) If a judge of the District Court is satisfied on the sworn information of an authorised officer that there are reasonable grounds for suspecting that there is information required by an authorised officer under this Regulation held in any place or any part thereof, or that there is a record or thing which an authorised officer requires to inspect for the purposes of these Regulations, and that such inspection is likely to disclose evidence of a contravention of these Regulations, the judge may issue a warrant authorising an authorised officer, accompanied by such other authorised officers or members of the Garda Síochána as may be necessary at any time or times within one month of the date of issue of the warrant, on production of the warrant, if requested, to enter the place, if necessary by reasonable force, and perform the functions or exercise all or any of the powers conferred on an authorised officer under these Regulations.

(6) An application under paragraph (5) shall be made to the judge of the District Court in whose District Court district the place concerned is situated.

(7) A person shall not—

(a) obstruct or interfere with an authorised officer or a member of the Garda Síochána in the exercise of the powers conferred on such officer or member by these Regulations or a warrant under paragraph (5),

(b) without reasonable excuse, fail or refuse to comply with a request from or requirement of or to answer a question asked by an authorised officer or such member pursuant to a power conferred by these Regulations, or

(c) make a statement or give information to an authorised officer or such member that the person knows is false or misleading in a material respect.

(8) A statement or admission made by a person pursuant to a requirement under paragraph (1)(d) or (f) shall not be admissible in proceedings brought against that person for an offence (other than an offence under paragraph (9)(a)).

(9) A person who—

(a) contravenes paragraph (7),

(b) falsely represents himself or herself to be an authorised officer,

(c) prevents any person from answering any question to which an authorised officer may require an answer under this Regulation, or

(d) fails to comply with a bona fide request, instruction or direction from an authorised officer in the exercise of his or her functions under this Regulation,

commits an offence.

(10) In this Regulation—

“place” means any structure, premises, land or other location or part of such place, and includes any container, railway wagon, vessel, aircraft, motor or other vehicle;

“person in charge”, in relation to a place, means—

(a) the person under whose direction and control the activities at that place are being conducted, or

(b) the person whom the authorised officer has reasonable grounds for believing is in control of that place;

“record” includes any memorandum, book, report, statement, register, plan, chart, map, drawing, specification, diagram, pictorial or graphic work or other document, any photograph, film or recording (whether of sound or images or both), any form in which data (including data that constitute personal data) are held, any form (including machine-readable form) or thing in which information is held or stored manually, mechanically or electronically, and anything that is a part or copy, in any form, of any of, or any combination of, the foregoing.

Compliance notice

27. (1) Where a competent authority is of the opinion that a provision of these Regulations is not being, or has not been, complied with by a critical entity, the competent authority or an authorised officer appointed by the competent authority concerned may serve a notice (in this Regulation, referred to as a compliance notice) on that critical entity.

(2) A compliance notice—

(a) shall state that the competent authority or the authorised officer, as the case may be, is of the opinion referred to in paragraph (1),

(b) shall state the reason for the opinion, referred to in paragraph (1), of the competent authority or the authorised officer as the case may be,

(c) shall identify the provision of these Regulations in respect of which that opinion is held,

(d) shall require the person on whom it is served to take such action as is specified in the notice to remedy the non-compliance or suspected non-compliance,

(e) may require that the person provide the competent authority or the authorised officer, as the case may be, with information at such intervals as are specified in the notice in relation to the progress made in remedying the non-compliance or suspected non-compliance,

(f) shall inform the person of the requirement to confirm compliance with the notice as referred to in paragraph (6),

(g) shall inform the person of the right to appeal the notice and the requirements of paragraph (9),

(h) shall include an address for service of an appeal,

(i) shall be signed and dated by the competent authority or the authorised officer, as the case may be, and

(j) shall state that if the person on whom it is served fails to comply with the notice, the person commits an offence and shall be liable on conviction to the penalty referred to in Regulation 30.

(3) Subject to paragraph (4), a compliance notice under this Regulation shall be complied with within such period as may be specified in the notice which period shall not be less than 14 working days after the date of the notice.

(4) Upon the written application of the person on whom a compliance notice is served, the period specified in the notice as the period within which that notice must be complied with may be extended by and at the discretion of the competent authority or the authorised officer, as the case may be, and, where the period is so extended, the compliance notice shall be complied within such extended time period.

(5) A compliance notice may include directions—

(a) as to the action to be taken to remedy the non-compliance to which the notice relates, and

(b) to bring the notice to the attention of any person who may be affected by the non-compliance or to the notice of the public generally.

(6) A person on whom a compliance notice has been served shall confirm in writing to the competent authority or the authorised officer, as the case may be, that the compliance notice has been complied with as soon as practicable after so complying and, in any case, not later than seven working days after the date specified in the notice by which it is to be complied with or, where the period of time has been extended under paragraph (4), the date specified in accordance with the extension.

(7) Where a person on whom a compliance notice has been served so confirms in writing under paragraph (6) that the compliance notice has been complied with, the competent authority or the authorised officer, as the case may be, shall, on being so satisfied, not later than one month after the date of receipt of such confirmation, serve notice on the person concerned of compliance with the compliance notice.

(8) A person aggrieved by a compliance notice may, not later than 14 working days after the date on which the notice is served on the person, appeal against the notice to a judge of the Circuit Court for the circuit in which the notice was served and, in determining the appeal, the judge may, if he or she is satisfied that it is reasonable to do so, confirm, vary or cancel the notice.

(9) Notice of an appeal under paragraph (8) shall contain a statement of the grounds upon which the appeal is made and shall be lodged by the appellant with the appropriate office of the Circuit Court not later than 14 working days after the date upon which the compliance notice was served on the appellant.

(10) A copy of the notice by which a person makes an appeal shall be given by the appellant to the competent authority or authorised officer, as the case may be, concerned not later than 72 hours before the hearing of the appeal.

(11) The competent authority or the authorised officer, as the case may be, shall be entitled to appear, be heard and adduce evidence on the hearing of an appeal under paragraph (8) and at a hearing of any application referred to in paragraph (17).

(12) Where an appeal is made and the compliance notice is not cancelled, the person on whom the compliance notice was served shall comply with the notice by the later of—

(a) the day immediately after the end of the period of 14 working days after the date of the determination of the appeal and the confirmation of the notice,

(b) the date of the withdrawal of the appeal, or

(c) the day specified in the compliance notice or, where the period of time has been extended under paragraph (4), the day specified in accordance with the extension.

(13) Where no appeal is made, the person on whom the compliance was served shall comply with the notice by the later of—

(a) the day immediately after the end of the period within which an appeal may be made, or

(b) the day specified in the compliance notice or, where the period of time has been extended under paragraph (4), the day specified in accordance with the extension.

(14) A competent authority or an authorised officer, as the case may be, may, where he or she considers it appropriate to do so, by notice in writing to the person on whom a compliance notice was served, withdraw the compliance notice.

(15) A person on whom a compliance notice is served who fails to comply with, or causes or permits another person to contravene, the notice commits an offence.

(16) Where a person fails to comply with a compliance notice under this Regulation, the competent authority or the authorised officer, as the case may be, may, having given notice to the person concerned, apply to the judge of the Circuit Court for the circuit in which the notice was served for an order requiring the person to comply with the terms of the notice and the judge hearing the matter may, if he or she is satisfied that it is reasonable to do so—

(a) confirm the order sought,

(b) make such other order as it thinks fit, or

(c) refuse to make any order.

(17) A person on whom a compliance notice has been served shall not—

(a) pending the determination of an appeal, deal with a product, place, machinery, equipment or other thing to which the notice relates, other than in accordance with the terms of the compliance notice, or

(b) if the notice is confirmed or varied on appeal, deal with a product, place, machinery, equipment or other thing to which the notice relates, other than in accordance with the terms of the compliance notice as confirmed or varied.

(18) A person who contravenes paragraph (17) commits an offence.

(19) It shall be a defence in a prosecution for an offence under paragraph (15) or (18) for a person to show—

(a) that the person took all reasonable steps to ensure compliance with the relevant compliance notice, or

(b) it was not reasonably possible for the person to comply with the notice.

(20) This Regulation shall not operate to prevent or restrict—

(a) the entitlement of any person to bring proceedings for the purpose of securing compliance with these Regulations, or

(b) the bringing or prosecuting of any proceedings for an offence under these Regulations.

PART 11

INFORMATION NOTICES

Information notices

28. (1) A competent authority, or an authorised officer appointed under Part 10, may, by notice served on a critical entity or an entity providing an essential service, require the critical entity or entity providing an essential service to furnish, in writing, within such period as may be specified in the notice and, if applicable, in the format or manner specified in the notice, such information specified in the notice that the competent authority may reasonably require for the proper performance by the competent authority of its functions under these Regulations.

(2) An information notice under this Regulation shall—

(a) specify the purpose for which it is being served,

(b) inform the person on whom the information notice is served that he or she may appeal against a requirement specified in the notice to the Circuit Court in accordance with this Regulation, and

(c) state that if the person on whom the information notice is served fails to comply with the notice, that person commits an offence.

(3) Upon the written application of the person on whom an information notice under this Regulation is served, the period specified in the information notice may be extended by, and at the discretion of, the competent authority or the authorised officer, as the case may be.

(4) A person on whom an information notice under this Regulation is served may, within seven working days of the day on which the notice is served on the person, appeal against a requirement specified in the notice to a judge of the Circuit Court for the circuit in which the notice was served and in determining the appeal the judge may, if he or she is satisfied that it is reasonable to do so, confirm, vary or cancel the notice.

(5) A person who appeals under paragraph (4) shall at the same time notify the competent authority or authorised officer, as the case may be, of the appeal and the grounds for the appeal

(6) The competent authority or authorised officer, as the case may be, shall be entitled to appear, be heard and adduce evidence on the hearing of an appeal made under paragraph (4).

(7) Where, on the hearing of an appeal under this Regulation, an information notice is confirmed or varied, the judge by whom the appeal is heard may, on the application of the appellant, suspend the operation of the notice for such period as in the circumstances of the case the judge considers appropriate.

(8) Subject to paragraph (9), a person on whom an information notice under this Regulation is served shall comply with the notice not later than—

(a) the end of the period specified in the notice, or

(b) where the period referred to in subparagraph (a) is extended under paragraph (3), the end of that extended period.

(9) Where an appeal is brought under this Regulation, and the information notice to which the appeal relates is confirmed or varied or the appeal is withdrawn, the person on whom the notice is served shall comply with the notice not later than—

(a) the day immediately after the day on which the notice is confirmed or varied or the appeal is withdrawn,

(b) the end of the period specified in the notice,

(c) where the period referred to in subparagraph (b) has been extended under paragraph (3), the end of that extended period, or

(d) where the operation of the notice has been suspended under paragraph (7), the end of the period of suspension,

whichever occurs later.

(10) A person on whom an information notice under this Regulation has been served and who fails to comply with, or causes or permits another person to contravene, a provision or a requirement of this Regulation commits an offence.

(11) It shall be a defence in a prosecution for an offence under paragraph (10) for a person to show, in respect of the provision or requirement of this Regulation to which the prosecution relates—

(a) that the person took all reasonable steps to ensure compliance with that provision or requirement, or

(b) that it was not reasonably possible for the person to comply with that provision or requirement.

(12) A person who, in purported compliance with a requirement in an information notice under this Regulation, furnishes information to the competent authority or authorised officer, as the case may be, that he or she knows to be false or misleading in a material respect commits an offence.

(13) A competent authority or an authorised officer, as the case may be, where the authority or officer considers it appropriate to do so, by notice in writing to the person on whom an information notice was served, withdraw that notice.

PART 12

FINAL PROVISIONS

Service of documents, etc.

29. (1) Subject to paragraphs (2) and (3), a notice, direction, certificate or any other document (in this Regulation, referred to as a document) that is required to be served on a person under these Regulations shall be in writing and addressed to the person concerned by name, and may be so served to the person in one or more of the following ways:

(a) by delivering it to the person;

(b) by leaving it at the address at which the person ordinarily carries on business;

(c) by sending it by pre-paid registered post addressed to the person at the address at which the person ordinarily carries on business;

(d) if an address for the service of documents has been furnished by the person, by leaving it at, or sending it by pre-paid registered post addressed to that party at that address;

(e) by sending it by means of electronic mail or a facsimile machine, to a device or facility for the reception of electronic mail or facsimiles located at the address at which the person concerned carries on business or, if an electronic address or facsimile number address for the service of documents has been furnished by the person concerned, that electronic address or facsimile machine, but only if—

(i) the recipient’s facility for the reception of electronic mail generates a message confirming a receipt of the electronic mail, or

(ii) the sender’s facsimile machine generates a message confirming successful delivery of the total number of pages of the document;

and it is also given in one of the other ways mentioned in subparagraphs (a) to (d);

(f) if the address at which the person ordinarily resides cannot be ascertained by reasonable enquiry and the notice relates to a premises, by delivering it to the premises or by affixing it in a conspicuous position on or near the premises.

(2) For the purposes of this Regulation, a company formed and registered under the Companies Act 2014 (No. 38 of 2014) or an existing company within the meaning of that Act shall be deemed to be ordinarily resident at its registered office, and every other body corporate and every unincorporated body shall be deemed to be ordinarily resident at its principal office or place of business.

(3) Where a document under these Regulations is to be served on a person who is the owner or occupier of land or property and the name of the person cannot be ascertained by reasonable inquiry, it may be addressed to the person by using the words “the owner” or, as the case may require, “the occupier”.

(4) Where an opinion, finding, statement or decision of a competent authority is contained in a document which—

(a) purports to have been made by or at the direction of that competent authority, and

(b) is produced in evidence by an officer of the competent authority or by an authorised officer in any proceedings,

such document shall be admissible in evidence and shall be evidence of any such opinion, finding, statement or decision in such proceedings without further proof.

Penalties

30. (1) A person that commits an offence under Regulation 9(17), 11(10), 15(7), 16(12), 18(14), 21(9), 26(9), 27(15) or (18) or 28(10) or (12) shall be liable—

(a) on summary conviction, to a class A fine, or

(b) on conviction on indictment, to a fine not exceeding—

(i) in the case of an individual, €50,000, and

(ii) in the case of a person other than an individual, €500,000.

(2) Notwithstanding section 10 (4) of the Petty Sessions (Ireland) Act 1851 , summary proceedings for an offence under these Regulations may be instituted at any time within 12 months of the date of the alleged commission of the offence.

Costs of prosecutions

31. (1) Where a critical entity is convicted of an offence under these Regulations, the court shall, unless it is satisfied that there are special and substantial reasons for not doing so, order the critical entity concerned to pay to the prosecutor a sum equal to the costs and expenses, measured by the court, reasonably incurred by the prosecutor in relation to the prosecution of the offence.

(2) An order for costs and expenses, referred to in paragraph (1), shall be in addition to, and not instead of, any fine or penalty the court may impose.

Prosecution of offences: critical entities

32. (1) Proceedings in relation to summary offence under these Regulations may be brought and prosecuted by a competent authority referred to in paragraph (2) of Regulation 8 or as designated by the Minister under paragraph (1) of that Regulation.

(2) Where an offence under these Regulations is committed by a body corporate and is proven to have been so committed with the consent, connivance or approval of, or to have been attributable to the wilful neglect on the part of, any person, being a director, secretary or other officer of the body corporate or a person who was purporting to act in any such capacity, that person, as well as the body corporate, commits an offence and is liable to be proceeded against and punished as if he or she was guilty of the first-mentioned offence.

(3) Where the affairs of a body corporate are managed by its members, paragraph (2) applies in relation to the acts and defaults of a member in connection with the functions of management as if the member were a director or manager of the body corporate.

Hearing of proceedings otherwise than in public

33. Where a court is satisfied that it is desirable that the whole or part of proceedings relating to an application or an appeal under these Regulations be heard otherwise than in public because of the nature or the circumstances of the case or having regard to the interests of justice, then the court may make an order that the proceedings shall, in whole or part, be heard otherwise than in public.

Review of Regulations by Minister

34. (1) The Minister shall, not earlier than six years and not later than seven years after the date of the coming into operation of these Regulations, having consulted with the Minister responsible for, and the competent authority concerned with, the sector concerned, conduct a review of the operation of these Regulations.

(2) Having conducted the review mentioned in paragraph (1), the Minister shall prepare a report in writing of the findings of the review and shall cause copies of the report to be laid before each House of the Oireachtas.

SCHEDULE

Regulations 2(1), 3(1), 7(6) & (8), 8(2), 9(4), 10(2), 11(4) & (8), 12(1), (3), (4), (6) & (8) and 15(4)

SECTORS, SUBSECTORS AND CATEGORIES OF ENTITIES

In this Schedule—

“Electricity Regulation” means Regulation (EU) 2019/943 of the European Parliament and of the Council of 5 June 2019¹¹ on the internal market for electricity, as amended;

“Gas Directive” means Directive (EU) 2024/1788 of the European Parliament and of the Council of 13 June 2024¹² on common rules for the internal markets for renewable gas, natural gas and hydrogen, amending Directive (EU) 2023/1791 and repealing Directive 2009/73/EC);

“Medicinal Products Directive” means Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001¹³ on the Community code relating to medicinal products for human use, as amended;

“NACE Rev. 2” means the common basis for statistical classifications of economic activities within the European Community set out in the Annex to Council Regulation (EEC) No. 3037/90 of 9 October 1990¹⁴ on the statistical classification of economic activities in the European Community, as amended;

“Ship and Port Facility Regulation” means Regulation (EC) No 725/2004 of the European Parliament and of the Council of 31 March 2004¹⁵ on enhancing ship and port facility security, as amended.

TABLE

GIVEN under my Official Seal,

15 October, 2024.

MICHEÁL MARTIN,

Minister for Defence.

EXPLANATORY NOTE

(This note is not part of the Instrument and does not purport to be a legal interpretation.)

These Regulations are made by the Minister for Defence for the purpose of giving full effect to the State’s obligations on the resilience of critical entities under Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022¹ and further effect to the State’s obligations under Commission Delegated Regulation (EU) 2023/2450² of 25 July 2023.

1 OJ No. L 333, 27.12.2022, p. 164.

2 OJ No. L 2023/2450, 30.10.2023.

2 OJ No. L 2023/2450, 30.10.2023.

1 OJ No. L 333, 27.12.2022, p. 164.

3 OJ No. L 333, 27.12.2022, p. 1.

4 OJ No. L 119, 04.05.2016, p. 1.

5 OJ No. L 347, 20.12.2013, p. 924.

6 OJ No. L 333, 27.12.2022, p. 80.

7 OJ No. L 124, 20.05.2003, p. 36.

8 OJ No. L 280, 28.10.2017, p. 1.

9 OJ No. L 158, 14.06.2019, p. 1.

10 OJ No. L 88, 31.03.2017, p. 6.

11 OJ No. L 158, 14.06.2019, p. 54.

12 OJ No. L 2024/1788, 15.07.2024.

13 OJ No. L 311, 28.11.2001, p. 67.

14 OJ No. L 293, 24.10.1990, p. 1.

15 OJ No. L 129, 29.04.2004, p. 6.

16 OJ No. L 158, 14.06.2019, p. 125.

16 OJ No. L 158, 14.06.2019, p. 125.

17 OJ No. L 265, 09.10.2009, p. 9.

18 OJ No. L 97, 09.04.2008, p. 72.

19 OJ No. L 70, 14.03.2009, p. 11.

20 OJ No. L 2024/1679, 28.06.2024.

21 OJ No. L 96, 31.03.2004, p. 1.

22 OJ No. L 310, 25.11.2005, p. 28.

23 OJ No. L 208, 05.08.2002, p. 10.

24 OJ No. L 157, 23.06.2015, p. 21.

25 OJ No. L 207, 06.08.2010, p. 1.

26 OJ No. L 315, 03.12.2007, p. 1.

27 OJ No. L 176, 27.06.2013, p. 1.

28 OJ No. L 173, 12.06.2014, p. 349.

29 OJ No. L 201, 27.07.2012, p. 1.

30 OJ No. L 314, 06.12.2022, p. 26.

31 OJ No. L 20, 31.01.2022, p. 1.

32 OJ No. L 435, 23.12.2020, p. 1.

33 OJ No. L 257, 28.08.2014, p. 73.

34 OJ No. L 31, 01.02.2002, p. 1.

1 OJ No. L 333, 27.12.2022, p. 164.

2 OJ No. L 2023/2450, 30.10.2023.