Summary

  • Ireland's duty to report a significant network security incident runs to the Commission for Communications Regulation, and the enacted 2023 Act does not name the National Cyber Security Centre.
  • The Act says "without undue delay" and states no hours; the 24-hour, 72-hour and 30-day stages came 297 days later in a regulator's decision instrument, and the criminal maximum for silence is a class A fine of €5,000 against an administrative ceiling of €5 million.

On 9 June 2023, a duty began to operate that nobody has to be told about twice. Providers of public electronic communications networks, and of publicly available electronic communications services, must notify the Commission for Communications Regulation of security incidents that have a significant impact on the operation of those networks or services, and they must do it "without undue delay", with follow-up updates on resolution and remediation (Communications Regulation and Digital Hub Development Agency (Amendment) Act 2023, sections 11(1) and 11(4)). Where a particular threat is significant enough, the same providers must tell potentially affected users what protective measures or remedies exist, and where appropriate what the threat is (section 12(1)).

The Act is Number 4 of 2023 and was enacted on 2 March 2023; it did not bite on the day it was signed. The commencement order, S.I. No. 299 of 2023, was made on 6 June 2023 and appointed 9 June 2023 for Parts 2 to 9 to come into operation, with notice published on 13 June 2023. That is 99 days between enactment and operation, which is my arithmetic on the Act's cover date and article 2 of the order. The parliamentary record adds its own wrinkle: the final print is No. 86c of 2022, a Bill whose title changed from Communications Regulation Bill 2022, passed by both Houses on 22 February 2023 — nine days before the statute it became.

Here is the gap that matters to a company deciding what to do at 3am. The statute says "without undue delay" and stops. It nominates no hour, no day, no page limit, no root-cause analysis. Ireland left the clock to the regulator, and the regulator published it on 2 April 2024 in Decision Instrument D08/24: an initial report as soon as possible and within the first 24 hours of the incident, an update within 72 hours if the matter is unresolved, notification when it is resolved, and a comprehensive update including root-cause analysis within 30 calendar days of the significant-incident report. The explanatory discussion at paragraph 140 anchors that first 24-hour window to detection by the provider, which is the only reading that gives a provider a stopwatch it can actually start.

The distance between the two instruments is the story. From commencement on 9 June 2023 to the publication date on the face of D08/24 is 297 days — again my subtraction of two publisher dates. For most of a year, an operator in Ireland was obliged to notify a regulator "without undue delay" against a standard no document in this record quantified. ComReg's own Network Incidents page now points providers to the incident-reporting portal on Data.ComReg and identifies D08/24 as the instrument that sets out how significant security incidents must be reported. The page also restates the obligation in section 11(9): an annual summary of notifications received and actions taken goes to the Minister, the European Commission and ENISA.

Now the price, and this is where Irish drafting rewards a careful reading. Section 11(8)(a) makes a failure to comply with the notification duty an offence, punishable on summary conviction by a class A fine. The Act does not say what a class A fine is worth; the Fines Act 2010 does, in section 3, defining it as a fine not exceeding €5,000. That is a maximum for summary conviction, not a tariff and certainly not an observed penalty in any case — but it is the number attached to silence in the criminal column.

The administrative column is a different instrument entirely. Part 7 carries remedial directions and financial penalties (sections 90(2) and 91(1)(a)–(b)), and section 94(5)(a) fixes the ceiling for a body that is not a natural person at the greater of €5 million and 10 per cent of Irish turnover for the financial year ending in the year immediately before the financial year of the last breach. The route is not automatic: section 92(1) requires High Court confirmation under section 109 before an administrative sanction takes effect, and section 90(3) bars a prosecution for an offence already found as an adjudicated breach. Section 63(3) permits administrative proceedings where ComReg elects against summary prosecution, or after a referral without criminal proceedings. ComReg's Guidelines for Adjudication Proceedings describe referral by an authorised officer with Commission consent, a sanctions menu running from cessation or remediation through financial penalties, refunds and compensation to suspension or withdrawal of authorisation, and confirm that an administrative sanction does not take effect unless the High Court confirms it, with confirmed adjudications published subject to exceptions and redactions.

So one failure has two prices separated by a factor of a thousand, and the cheap one is the criminal one. That inversion is not a drafting accident so much as a statement of regulatory preference: the €5,000 summary offence is a formality a district court can dispose of, while the €5 million ceiling exists to be negotiated in a High Court confirmation hearing whose outcome is published. The deterrent that reaches a board is not section 11(8)(a). It is the risk of being taken down the Part 7 route, where the number is set by reference to turnover and the finding becomes a public document.

The National Cyber Security Centre sits oddly in this architecture, and the oddity is visible only if you read the text rather than the press coverage. The Act defines a CSIRT — a computer security incident response team — as a departmental incident-response unit in section 5, and permits ComReg to consult, cooperate, exchange information with and obtain assistance from it in section 16(1)(a). What the enacted pages inspected for this article do not do is name the National Cyber Security Centre, and no section expressly assigning that named body general functions was identified in the text read. Across that enactment PDF, cover and section pages included, the Centre is absent. That is a bounded finding about one document, not a claim about the Irish state's institutional map: the Centre describes itself, on its CSIRT-IE page, as the body within the NCSC that provides assistance to constituents responding to cyber security incidents at a national level for Ireland, principally serving government bodies and critical national infrastructure providers, and lists incident monitoring, warnings, response, risk analysis and participation in the CSIRTs network among its responsibilities. That page is undated and does not identify the 2023 Act as the source of any of it.

What a third party can actually check is thin, and measurable. ComReg's Network Operations Annual Report 2024, in section 2.5, records 15 incidents reported to ComReg in 2024, compared with 16 in 2023, and 32,574,831 user hours lost in 2024 against 22,818,885 in 2023. The 2023 report supplies the earlier comparator and the method: 16 incidents notified during 2023 against 12 in 2022, with the incidents reported onward to ENISA drawn from notifications through the incident-reporting portal that also carries the updates. Set the two years side by side and the aggregate count falls by one while the recorded hours of harm rise by 9,755,946 — roughly 43 per cent higher, my arithmetic on the two published figures.

Do not divide one by the other. The reports do not state that the user-hours total is drawn only from incidents reported to ComReg, so an average hours-per-incident figure would be an invention dressed as diligence. The defensible observation is narrower and worse: the one number that moves in public, and that a journalist, insurer or counterparty can quote, is a count that went down while the harm it is meant to summarise went up by nearly half. Whether that means fewer incidents, better reporting, a change in what counts, or a shift in how outage hours are totted up is not established by anything in these two documents.

The framework is not frozen either. Consultation 25/84, dated 5 December 2025, proposes changes to weather-related reporting templates, to reporting frequency and times, and to the geographic assessment of incident significance, after the experience of Storm Éowyn. Those are proposals; the final disposition was not established here, and the same cover labels the document version FINAL, which is its own small lesson in reading instruments rather than their filenames.

This is where the piece departs from what BTW has already published on the same directory entry for the National Cyber Security Centre. The two existing briefings on that object concern a single comment that could execute code inside a UK government workflow, and Switzerland's plan for a standalone cybersecurity law. Neither tests an Irish statutory incident chain. What is new here is the chain itself: a duty that runs to a regulator rather than to the agency whose name it is usually filed under, a clock that lives in a decision instrument published 297 days after the duty commenced, a criminal maximum of €5,000 sitting underneath an administrative ceiling of €5 million gated by the High Court, and an annual aggregate that moved in the wrong direction against its own harm measure.

Where does that leave the operator, the insurer and the counterparty? With three things a lawyer can use and one that nobody can. The duty, the recipient and the escalation route are readable, dated and citable. The clock is readable but sits in a regulator's instrument, which means it is a decision that can be revised — as 25/84 shows — rather than a statutory constant a board can plan around for a decade. The ceiling is readable and enormous.

What is not readable is any per-provider record: across the Act, D08/24, the adjudication guidelines and the two annual reports reviewed for this article, no section 11 prosecution, sanction or High Court-confirmed adjudication against a named provider was established. That is an absence in the material read, not proof of a clean record, and it is the sentence that should make a compliance committee ask who would know.

Ireland built the reporting instrument. It is commenced, it is priced, and it is checkable at the level of a national total. The accountability it leaves an outsider is a count — one that fell by a single incident in the year the recorded harm rose by nearly 43 per cent.