S.I. No. 559/2024 - European Union (Resilience of Critical Entities) Regulations 2024

1. Energy

(a) Electricity

(i) Electricity undertakings as defined in

section 2

(1) of the

Electricity Regulation Act 1999

(No. 23 of 1999), which carry out the function of supply, as defined in Article 2(12) of Directive (EU) 2019/944 of the European Parliament and of the Council of 5 June 2019

16

.

(ii) Distribution system operators as defined in

section 2

(1) of the

Electricity Regulation Act 1999

(No. 23 of 1999).

(iii) Transmission system operators as defined in

section 2

(1) of the

Electricity Regulation Act 1999

(No. 23 of 1999).

(iv) Producers as defined in Article 2(38) of Directive (EU) 2019/944

16

of the European Parliament and of the Council of 5 June 2019.

(v) Nominated electricity market operators as defined in Article 2(8) of the Electricity Regulation.

(vi) Market participants as defined in Article 2(25) of the Electricity Regulation providing aggregation, demand response or energy storage services, as defined in

section 2

(1) of the

Electricity Regulation Act 1999

(No. 23 of 1999).

(b) District heating and cooling

Operators of district heating or district cooling, as defined in Regulation 2 of the European Union (Renewable Energy) Regulations (2) 2022 (

S.I. No. 350 of 2022

).

(c) Oil

(i) Operators of oil transmission pipelines

(ii) Operators of oil production, refining and treatment facilities, storage and transmission.

(iii) Central stockholding entities as defined in Article 2(f) of Council Directive 2009/119/EC of 14 September 2009

17

.

(d) Gas

(i) Supply undertakings as defined in Article 2(29) of the Gas Directive.

(ii) Distribution system operators as defined in Article 2(20) of the Gas Directive.

(iii) Transmission system operators as defined in Article 2(18) of the Gas Directive.

(iv) Natural gas storage system operators as defined in Article 2(32) of the Gas Directive.

(v) LNG system operators as defined in Article 2(34) of the Gas Directive.

(vi) Natural gas undertakings within the meaning of the Gas Directive.

(vii) Operators of natural gas refining and treatment facilities.

(e) Hydrogen

Operators of hydrogen production, storage and transmission.

2. Transport

(a) Air

(i) Air carriers, as defined in Article 3(4) of Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008

18

, as amended, used for commercial purposes.

(ii) Airport managing bodies, as defined in paragraph (2) of Article 2 of Directive 2009/12/EC of the European Parliament and of the Council of 11 March 2009

19

, as amended, and airports, as defined in paragraph (1) of that Article 2, including the core airports of the core network identified in Regulation (EU) 2024/1679 of the European Parliament and of the Council of 13 June 2024

20

, and entities operating ancillary installations contained within airports.

(iii) Traffic management control operators providing air traffic control (ATC) services as defined in Article 2(1) of Regulation (EC) No 549/2004 of the European Parliament and of the Council of 10 March 2004

21

.

(b) Rail

(i) Infrastructure managers as defined in Regulation 2 of the European Union (Regulation of Railways) Regulations 2015 (

S.I. No 249 of 2015

).

(ii) Railway undertakings, as defined in Regulation 2 of the European Union (Regulation of Railways) Regulations 2015 (

S.I. No 249 of 2015

).

(c) Water

(i) Inland, sea and coastal passenger and freight water transport companies, as defined for maritime transport in Annex I to the Ship and Port Facility Regulation, not including the individual vessels operated by those companies.

(ii) Managing bodies of ports as defined in Article 3(1) of Directive 2005/65/EC of 26 October 2005

22

, as amended, including their port facilities, as defined in Article 2(11) of the Ship and Port Facility Regulation and entities operating works and equipment contained within ports.

(iii) Operators of vessel traffic services (VTS) as defined in Article 3(o) of Directive 2002/59/EC of the European Parliament and of the Council of 27 June 2002

23

, as amended.

(d) Road

(i) Road authorities, as defined in Article 2(12) of Commission Delegated Regulation (EU) 2015/962 of 18 December 2014

24

, responsible for traffic management control, other than public entities for whom traffic-management or the operation of intelligent transport systems is a non-essential part of their general activity.

(ii) Operators of Intelligent Transport Systems as defined in Article 4(1) of Directive 2010/40/EU of the European Parliament and of the Council of 7 July 2010

25

, as amended.

(e) public transport

Public service operators as defined in Article 2(d) of Regulation (EC) No 1370/2007 of the European Parliament and of the Council of 23 October 2007

26

, as amended.

3. Banking

Credit institutions as defined in Article 4(1) of Regulation (EU) No 575/2013 of 26 June 2013

27

, as amended.

4. Financial market infrastructure

(i) Operators of trading venues as defined in Article 4(24) of Directive 2014/65/EU of 15 May 2014

28

, as amended.

(ii) Central counterparties (CCPs) as defined in Article 2(1) of Regulation (EU) No 648/2012 of 4 July 2012

29

, as amended.

5. Health

(i) Healthcare providers as defined in Regulation 3 of the European Union (Application of Patients’ Rights in Cross-Border Healthcare) Regulations 2014 (

S.I. No 203 of 2014

).

(ii) EU reference laboratories as referred to in Article 15 of Regulation (EU) 2022/2371 of the European Parliament and of the Council of 23 November 2022

30

.

(iii) Entities carrying out research and development activities of medicinal products, as defined in Article 1(2) of the Medicinal Products Directive.

(iv) Entities manufacturing basic pharmaceutical products and pharmaceutical preparations as referred to in Division 21 of Section C of Annex 1 to NACE Rev. 2.

(v) Entities manufacturing medical devices on the public health emergency critical devices list, within the meaning of Article 22 of Regulation (EU) 2022/123 of the European Parliament and of the Council of 25 January 2022

31

, as amended.

(vi) Entities holding a distribution authorisation within the meaning of Title VII of the Medicinal Products Directive.

6. Drinking water

Suppliers and distributors of water intended for human consumption as defined in Article 2(1)(a) of Directive (EU) 2020/2184 of the European Parliament and of the Council of 16 December 2020

32

, other than distributors for which distribution of water for human consumption is a non-essential part of their general activity of distributing other commodities and goods.

7. Waste water

Undertakings collecting, disposing of, or treating, urban waste water, domestic waste water or industrial waste water, as defined in article 2 of the Urban Waste Water Treatment Regulations 2001 (

S.I. No. 254 of 2001

) respectively, other than undertakings for which collecting, disposing of, or treating, urban waste water, domestic waste water or industrial waste water is a non-essential part of their general activity.

8. Digital infrastructure

(i) Providers of internet exchange points as defined in Article 6(18) of the NIS 2 Directive.

(ii) DNS service providers as defined in Article 6(20) of the NIS 2 Directive, other than operators of root name servers.

(iii) top-level-domain name registries as defined in Article 6(21) of the NIS 2 Directive.

(iv) Providers of cloud computing services as defined in Article 6(30) of the NIS 2 Directive.

(v) Providers of data centre services as defined in Article 6(31) of the NIS 2 Directive.

(vi) Providers of content delivery networks as defined in Article 6(32) of the NIS 2 Directive.

(vii) Trust service providers as defined in Article 3(19) of Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014

33

.

(viii) Providers of electronic communications networks, as defined in Regulation 2(1) of the European Union (Electronic Communications Code) Regulations 2022 (

S.I. No. 444 of 2022

), insofar as their networks are publicly available.

(ix) Providers of electronic communications services, as defined in Regulation 2 of the European Union (Electronic Communications Code) Regulations 2022 (

S.I. No. 444 of 2022

), insofar as their services are publicly available.

9. Public administration

Ministers of the Government.

10. Space

Operators of ground-based infrastructure in the State, owned, managed and operated by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks as defined in Regulation 2 of the European Union (Electronic Communications Code) Regulations 2022 (

S.I. No. 444 of 2022

).

11. Food production, processing and distribution

Food businesses as defined in Article 3(2)of Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002

34

, as amended, that are engaged exclusively in logistics and wholesale distribution and large scale industrial production and processing.

GIVEN under my Official Seal,

15 October, 2024.

MICHEÁL MARTIN,

Minister for Defence.

EXPLANATORY NOTE

(

This note is not part of the Instrument and does not purport to be a legal interpretation.

)

These Regulations are made by the Minister for Defence for the purpose of giving full effect to the State’s obligations on the resilience of critical entities under Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022

1

and further effect to the State’s obligations under Commission Delegated Regulation (EU) 2023/2450

2

of 25 July 2023.

1 OJ No. L 333, 27.12.2022, p. 164.

2 OJ No. L 2023/2450, 30.10.2023.

2 OJ No. L 2023/2450, 30.10.2023.

1 OJ No. L 333, 27.12.2022, p. 164.

3 OJ No. L 333, 27.12.2022, p. 1.

4 OJ No. L 119, 04.05.2016, p. 1.

5 OJ No. L 347, 20.12.2013, p. 924.

6 OJ No. L 333, 27.12.2022, p. 80.

7 OJ No. L 124, 20.05.2003, p. 36.

8 OJ No. L 280, 28.10.2017, p. 1.

9 OJ No. L 158, 14.06.2019, p. 1.

10 OJ No. L 88, 31.03.2017, p. 6.

11 OJ No. L 158, 14.06.2019, p. 54.

12 OJ No. L 2024/1788, 15.07.2024.

13 OJ No. L 311, 28.11.2001, p. 67.

14 OJ No. L 293, 24.10.1990, p. 1.

15 OJ No. L 129, 29.04.2004, p. 6.

16 OJ No. L 158, 14.06.2019, p. 125.

16 OJ No. L 158, 14.06.2019, p. 125.

17 OJ No. L 265, 09.10.2009, p. 9.

18 OJ No. L 97, 09.04.2008, p. 72.

19 OJ No. L 70, 14.03.2009, p. 11.

20 OJ No. L 2024/1679, 28.06.2024.

21 OJ No. L 96, 31.03.2004, p. 1.

22 OJ No. L 310, 25.11.2005, p. 28.

23 OJ No. L 208, 05.08.2002, p. 10.

24 OJ No. L 157, 23.06.2015, p. 21.

25 OJ No. L 207, 06.08.2010, p. 1.

26 OJ No. L 315, 03.12.2007, p. 1.

27 OJ No. L 176, 27.06.2013, p. 1.

28 OJ No. L 173, 12.06.2014, p. 349.

29 OJ No. L 201, 27.07.2012, p. 1.

30 OJ No. L 314, 06.12.2022, p. 26.

31 OJ No. L 20, 31.01.2022, p. 1.

32 OJ No. L 435, 23.12.2020, p. 1.

33 OJ No. L 257, 28.08.2014, p. 73.

34 OJ No. L 31, 01.02.2002, p. 1.

1 OJ No. L 333, 27.12.2022, p. 164.

2 OJ No. L 2023/2450, 30.10.2023.

12. (1) A competent authority concerned shall identify the critical entities for the sectors and subsectors specified in columns (1) and (2) of the Table set out in the Schedule not later than 21 months after the date of the coming into operation of these Regulations and shall ensure that those critical entities are notified that they have been identified as critical entities not later than one month after the date of that identification.

(2) In identifying critical entities pursuant to paragraph (1), a competent authority shall take into account the outcomes of the national risk assessment.

(3) A competent authority shall identify an entity as a critical entity in a sector in respect of which the competent authority is designated as the competent authority where that competent authority is satisfied that—

(a) the entity provides one or more essential services,

(b) the entity operates, and its critical infrastructure is located, in the territory of the State, and

(c) an incident would have significant disruptive effects, on the provision by the entity of one or more essential services or on the provision of other essential services in the sectors specified in the Table set out in the Schedule that depend on that or those essential services.

(4) In determining the significance of a disruptive effect insofar as it relates to the provision by a critical entity of an essential service in the State, a competent authority—

(a) may take into account factors specific to the sector to which the critical entity providing the service belongs and any other criteria as specified, from time to time, by the Minister in—

(i) the National Strategy on the Resilience of Critical Entities, or

(ii) guidelines published under Regulation 22, and

(b) in every case, shall take into account the following

(i) the number of users relying on the essential service provided by the entity concerned;

(ii) the extent to which other sectors and subsectors specified in columns (1) and (2) of the Table set out in the Schedule depend on the essential service in question;

(iii) the impact that incidents could have, in terms of degree and duration, on economic and societal activities, the environment, public safety and security, or the health of the population, in the State;

(iv) the entity’s market share in the market for the essential service concerned;

(v) the geographic area that could be affected by an incident, including any cross-border impact, taking into account the vulnerability associated with the degree of isolation of certain types of geographic areas, such as insular regions, remote regions or mountainous areas;

(vi) the importance of the entity in maintaining a sufficient level of the essential service, taking into account the availability of alternative means for the provision of that essential service.

(5) A competent authority concerned shall inform critical entities of their obligations under these Regulations and the date from which those obligations apply to them.

(6) Competent authorities shall inform critical entities in the sectors specified at the entries numbered 3, 4 and 8 in column (1) of the Table set out in the Schedule that they have no obligations under Regulations 9(9), (10) and (12) to (17), 11(7), 15 to 21, 23, 25 to 28 and 30 to 33.

(7) For the critical entities concerned, these Regulations shall apply from the date that is 10 months after the date of the notification referred to in paragraph (1).

(8) Competent authorities designated under Regulation 8 shall notify the competent authorities designated for the purpose of the NIS 2 Directive of the identity of the critical entities that they have identified under this Regulation not later than one month after that identification and such notification shall specify, where applicable, that the critical entities concerned are entities in the sectors specified at the entries numbered 3, 4 and 8 in column (1) of the Table set out in the Schedule and, as such, have no obligations under Regulations 9(9), (10) and (12) to (17), 11(7), 15 to 21, 23, 25 to 28 and 30 to 33.

(9) Where a competent authority proposes to identify an entity as critical entity, the competent authority shall notify the entity, in writing, accordingly, and shall—

(a) state the reasons why the entity is proposed to be identified,

(b) specify the category of sector and, where appropriate, subsector, and the essential service in respect of which the entity is to be so identified, and

(c) give the entity an opportunity to make representations, in writing, to the competent authority in respect of the proposed identification, not later than 15 working days after the date of the notification.

(10) The competent authority shall consider any representations made by an entity under paragraph (9) and shall, not later than 20 working days after the earlier of—

(a) the date of receipt of the representations, or

(b) the expiration of the period referred to in paragraph (9)(c),

decide whether to identify the entity as a critical entity in respect of a particular category of sector, subsector or essential service.

(11) Where a competent authority decides to identify an entity as a critical entity, the authority shall notify the entity concerned in writing stating—

(a) that the entity concerned is so identified,

(b) the category of sector and, where appropriate, subsector and the essential service in respect of which the entity concerned is so identified, and

(c) where the entity concerned has made representations in accordance with paragraph (9), the reasons why the entity is so identified.

(12) A competent authority shall promptly enter particulars of an entity identified by it as a critical entity in the critical entities list maintained by it under Regulation 13

.

Critical entities list

13. (1) For the purpose of identifying a person, or other entity, as a critical entity, each competent authority shall establish and maintain—

(a) a list containing particulars of critical entities in each sector in respect of which that competent authority is designated as the competent authority, and

(b) a list of critical entities which that authority is satisfied are essential for the maintenance of critical societal activities or critical economic activities in the State.

(2) For each critical entity on the critical entities list, the relevant competent authority shall record the following

(a) the name of the entity;

(b) the address of the entity;

(c) the name of its designated liaison officer within the meaning of Regulation 16(10);

(d) the contact information for its liaison officer.

(3) The list of identified critical entities maintained under Regulation 13 shall be reviewed and updated by the competent authority concerned from time to time and, in any event, not later than 17 July 2030 and, thereafter, not later than every fourth anniversary of that date.

(4) Where updates, mentioned in paragraph (3), lead to the identification of additional critical entities, the obligations set out in Regulation 12 shall apply to the competent authority in relation to those additional critical entities.

(5) Subsequent to a review and update under paragraph (3), the competent authority shall ensure that entities that are no longer identified as critical entities are notified, in writing, in due time that they are no longer —

(a) identified as critical entities, and

(b) subject to the obligations of a critical entity under these Regulations from the date of receipt of the notification.

Cancellation of identification as critical entity on request of critical entity

14. (1) A critical entity that is of the view that it is no longer appropriate for it to be identified as a critical entity in respect of a particular category of sector or subsector, or essential service, may notify the competent authority concerned in writing—

(a) setting out the reasons and grounds why the critical entity has formed that view, and

(b) requesting that it should no longer be identified as a critical entity in respect of a particular category of sector or subsector, or essential service, as the case may be.

(2) Where a competent authority proposes to refuse a request for cancellation of identification made to it under paragraph (1), it shall notify the critical entity concerned in writing accordingly, giving the critical entity an opportunity to make representations in writing to the competent authority in respect of the proposal not later than 15 working days after the date of the notification of the proposal.

(3) The competent authority shall consider any representations made by the entity concerned in accordance with paragraph (2) and shall, not later than 20 working days after the earlier of—

(a) the date of receipt of the representations, or

(b) the expiration of the period referred to in paragraph (2),

decide whether to make the cancellation.

(4) Where the competent authority decides to make a cancellation of identification, pursuant to a notification made to it under paragraph (1), as soon as possible, it shall notify the critical entity concerned in writing that they are no longer—

(a) identified as critical entities, and

(b) subject to the obligations of a critical entity under these Regulations from the date of receipt of the notification.

(5) Where the competent authority concerned decides to make a cancellation of identification, pursuant to a notification under paragraph (1), the competent authority shall promptly amend the critical entities list maintained by it under Regulation 13 accordingly.

Critical entity risk assessments

15. (1) Notwithstanding the date referred to in Regulation 12(5), critical entities shall carry out a critical entity risk assessment—

(a) not later than nine months after the date of receipt of the notification referred to in Regulation 12(1),

(b) whenever a relevant new risk has been identified which had not previously been assessed in such an assessment, and

(c) not later than every fourth anniversary of the date of the assessment carried out under subparagraph (a).

(2) The critical entity risk assessment, mentioned in paragraph (1), shall be carried out on the basis of the national risk assessment, and other relevant sources of information, in order to assess all relevant risks that could disrupt the provision of their essential services.

(3) A critical entity risk assessment, mentioned in paragraph (1), shall account for all the relevant natural and man-made risks which could lead to an incident, including those of a cross-sectoral or cross-border nature, accidents, natural disasters, public health emergencies and hybrid threats and other antagonistic threats, including terrorist offences as provided for in Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017

10

.

(4) A critical entity risk assessment, mentioned in paragraph (1), shall take into account the extent to which other sectors as specified in the Table set out in the Schedule depend on the essential service provided by the critical entity concerned and the extent to which that critical entity depends on essential services provided by other entities in such other sectors, including, where relevant, in neighbouring Member States and third countries.

(5) Where a critical entity has carried out other risk assessments or drawn up documents pursuant to obligations, other than under these Regulations, that are relevant for its critical entity risk assessment, mentioned in paragraph (1), it may use those assessments and documents to meet the requirements set out in this Regulation.

(6) When exercising its supervisory functions, the competent authority may declare an existing risk assessment carried out by a critical entity that addresses the risks and extent of dependence referred to in paragraph (4) as compliant, in whole or in part, with the obligations under this Regulation.

(7) A critical entity that fails to comply with paragraph (1) commits an offence.

Resilience and security requirements in respect of critical entities

16. (1) Critical entities shall take appropriate and proportionate technical, security and organisational measures to ensure their resilience, based on the following

(a) the National Strategy on the Resilience of Critical Entities;

(b) a national risk assessment;

(c) the relevant information provided in any risk assessment of the relevant competent authority;

(d) the outcomes of a critical entity risk assessment, which shall include the measures mentioned in paragraph (2);

(e) guidelines, if any, prepared and published by the Minister under Regulation 22.

(2) The measures referred to in paragraph (1)(d) shall include the measures necessary for the following purposes

(a) to prevent incidents from occurring, duly considering disaster risk reduction and climate adaptation measures;

(b) to ensure adequate physical protection of their premises and critical infrastructure, duly considering, including other things, fencing, barriers, perimeter monitoring tools and routines, detection equipment and access controls;

(c) to respond to, resist and mitigate the consequences of incidents, duly considering the implementation of—

(i) risk and crisis management procedures, and

(ii) protocols and alert routines;

(d) to recover from incidents, duly considering business continuity measures and the identification of alternative supply chains, in order to resume the provision of the essential service;

(e) subject to paragraph (3), to ensure adequate employee security management, duly considering measures such as—

(i) setting out categories of personnel who exercise critical functions,

(ii) establishing access rights to premises, critical infrastructure and sensitive information,

(iii) setting up procedures for background checks in accordance with Regulation 17 and designating the categories of persons who are required to undergo such background checks, and

(iv) laying down appropriate training requirements and qualifications;

(f) to raise awareness about the measures referred to in subparagraphs (a) to (e) among relevant personnel, duly considering training courses, information materials and exercises.

(3) For the purposes of the paragraph (2)(e), critical entities shall take into account the personnel of external service providers when setting out categories of personnel who exercise critical functions.

(4) Critical entities shall have in place, and apply, a resilience plan or equivalent document which describes the measures taken pursuant to paragraph (1) and where critical entities have already adopted such plan or document, or taken measures pursuant to obligations laid down in other legal acts that are relevant for the measures referred to in paragraph (1), they may use those plans, documents and measures to meet the requirements set out in this Regulation.

(5) When exercising its supervisory functions, a competent authority may declare existing resilience-enhancing measures taken by a critical entity that address, in an appropriate and proportionate manner, the technical, security and organisational measures referred to in paragraph (1) as compliant, in whole or in part, with the obligations under this Regulation.

(6) The resilience plan or equivalent document, mentioned in paragraph (4), shall be made available by the critical entity concerned to the relevant competent authority, upon written request, and shall include the following

(a) an assessment of potential risks for the critical entity concerned;

(b) a list of mitigation measures for the potential risks, mentioned in subparagraph (a), and details of a system for implementing them;

(c) a demonstration that incident scenarios have been identified and that the necessary measures have been taken to prevent such incidents and to limit their consequences on society;

(d) a demonstration that adequate precautions have been taken into account in the design, construction, operation and maintenance of any installation, storage facility, equipment and infrastructure connected with its operation;

(e) a demonstration that internal emergency plans have been drawn up and include information to enable an external emergency plan to be prepared;

(f) a demonstration that adequate precautions have been taken into account in the design and operation of supply chains.

(7) A critical entity shall prepare a resilience plan or equivalent document, mentioned in paragraph (4), not later than 10 months after the date that they are notified of their identification as a critical entity for the purpose of these Regulations.

(8) A critical entity shall ensure that the policy set out in its resilience plan or equivalent document, mentioned in paragraph (4), is properly implemented by appropriate means and structures, proportionate to the complexity of the organisation or the activities of the critical entity concerned.

(9) A critical entity shall review and where necessary update its resilience plan or equivalent document, mentioned in paragraph (4)—

(a) following an incident,

(b) at any time, at the initiative of the critical entity concerned,

(c) at the request of the relevant competent authority,

(d) where justified by new facts or by new technological knowledge about resilience matters, including knowledge arising from analysis of incidents or, as far as possible, occurrences which do not, as such, amount to incidents, and

(e) by developments in the knowledge available on the assessment of threats.

(10) A critical entity shall designate a liaison officer or equivalent as the point of contact with the relevant competent authority.

(11) With the agreement of the critical entity concerned, the Minister may request the European Commission to organise an advisory mission to that critical entity, in accordance with the arrangements set out in Regulation 21.

(12) A critical entity that fails to comply with paragraph (1), (3), (4), (6), (7), (8), (9) or (10) commits an offence.

Background checks

17. (1) The Minister shall make arrangements, or have arrangements made on his or her behalf, having consulted any other Minister of the Government that he or she considers appropriate having had regard to the requirements of these Regulations, for the submission and completion of background checks under these Regulations.

(2) The arrangements referred to in paragraph (1), shall specify the conditions under which a critical entity is permitted, having taken into account the national risk assessment and having formed the belief, based on reasonable grounds, that it is necessary for its obligations under these Regulations, to submit requests for background checks on persons who—

(a) hold sensitive roles in, or for the benefit of, the critical entity, in particular in relation to the resilience of the critical entity,

(b) are authorised to directly or remotely access its premises, information or control systems, including in connection with the security of the critical entity, or

(c) are under consideration for recruitment to positions that fall under the criteria set out in subparagraph (a) or (b).

(3) Requests referred to in paragraph (2) shall be assessed within a reasonable timeframe and processed in accordance with national law and procedures and relevant and applicable Union law, including the

General Data Protection Regulation and the Data Protection Act 2018

(No. 7 of 2018).

(4) Background checks, for the purpose of this Regulation, shall be—

(a) proportionate and strictly limited to what is necessary, and

(b) carried out for the sole purpose of evaluating a potential security risk to the critical entity concerned.

(5) A background check, for the purpose of this Regulation, shall at a minimum—

(a) corroborate the identity of the person who is the subject of the background check, and

(b) check the criminal record of that person with regards to offences which would be relevant for a specific position.

Incident notification by critical entities

18. (1) Subject to paragraph (2), critical entities shall, in writing, notify their competent authority, without undue delay, of incidents that significantly disrupt, or have the potential to significantly disrupt, the provision of essential services.

(2) Subject to paragraphs (8) and (9), other than where operationally unable to do so, critical entities shall submit an initial notification under paragraph (1) to their competent authority, not later than 24 hours after becoming aware of an incident, followed, not later than one month after the date of becoming so aware, where relevant, by a detailed report as outlined by the national resilience policy.

(3) In order to determine the significance of a disruption, referred to in paragraph (1), the following parameters shall, in particular, be taken into account by the critical entity concerned

(a) the number and proportion of users affected by the disruption;

(b) the duration of the disruption;

(c) subject to paragraph (4), the geographical area affected by the disruption, taking into account whether the area is geographically isolated.

(4) Where an incident of disruption in a notification, made to it under paragraph (1), has, or might have, a significant impact on the continuity of the provision of essential services to, or in, six or more Member States (including the State), the competent authority concerned in the State, shall, via the Minister, notify the European Commission of that incident.

(5) Following a notification made to it by a critical entity under paragraph (1), the competent authority concerned shall notify the incident, without undue delay to—

(a) the Minister, and

(b) the Minister responsible for the sector concerned.

(6) A notification under paragraph (1) or (5)—

(a) shall include any available information necessary to enable the competent authority or the Minister, as the case may be, to understand the nature, cause and possible consequences of the incident, including any available information necessary to determine any cross-border impact of the incident, and

(b) shall not subject critical entities to increased liability.

(7) Without limitation of paragraph (6), a notification shall include, at a minimum, the following

(a) the name of the critical entity concerned;

(b) the full address of the critical entity concerned;

(c) the affected essential service provided by the critical entity concerned;

(d) the location, and full address, of the essential service affected;

(e) a full description of the incident that has occurred;

(f) details of other essential services that may be affected by the incident;

(g) whether the incident might have a significant impact on critical entities and the continuity of the provision of essential services to, or in, one or more other Member States.

(8) The detailed report referred to paragraph (2) shall include the following information as soon as the information becomes available

(a) the information mentioned in subparagraphs (a) to (g) of paragraph (7);

(b) the circumstances of the incident;

(c) the data available for assessing the effects of the incident on operations of the critical entity concerned;

(d) the immediate mitigation measures taken;

(e) the measures taken to mitigate the medium and long-term effects of the incident;

(f) the steps taken to prevent any recurrence of such an incident.

(9) The critical entity shall update the information provided, in the detailed report mentioned in paragraph (2), if further investigation reveals additional facts which alter that information or the conclusions drawn.

(10) On the basis of the information provided by a critical entity in a notification under paragraph (1), the relevant competent authority, via the Minister, shall inform the single point of contact of other affected Member States where the incident has or might have a significant impact on critical entities and the continuity of the provision of essential services to, or in, one or more other Member States.

(11) Where the Minister sends, or receives, information pursuant to paragraph (10), he or she shall, in accordance with Union law and the law of the State, treat that information in a way that respects its confidentiality and protects the security and commercial interest of the critical entity concerned.

(12) As soon as possible following a notification as referred to in paragraph (1), the competent authority concerned shall provide the critical entity concerned with relevant follow-up information, including information that could support that critical entity’s effective response to the incident in question.

(13) The Minister responsible for the sector concerned shall inform the public of a notification made under paragraph (1), where he or she determines that it would be in the public interest to do so.

(14) A critical entity that fails to comply with paragraph (1) commits an offence.

PART 7

CRITICAL ENTITIES OF PARTICULAR EUROPEAN SIGNIFICANCE

Identification of critical entities of particular European significance

19. (1) A critical entity shall be considered a critical entity of particular European significance where it—

(a) has been identified as a critical entity pursuant Regulation 12,

(b) provides the same or similar essential services to, or in, six or more Member States (whether or not including the State), and

(c) has been notified pursuant to paragraph (3) of Article 17 of the Directive.

(2) A critical entity, following the notification referred to in Regulation 12(1), shall inform its competent authority—

(a) the fact that it provides essential services to, or in, six or more Member States,

(b) the names of the Member States in which it provides those essential services to, or in, and

(c) the nature of the essential services that it provides to, or in, each of those Member States.

(3) The competent authority, informed by a critical entity concerned under paragraph (2), shall inform the Minister, without undue delay, of the existence of a critical entity in the State of potential particular European significance.

(4) The Minister shall notify the Minister responsible for the sector concerned and the European Commission, without undue delay, of the identity of the critical entity concerned, and of the information they provided, under paragraph (2).

(5) Following identification of the critical entity in the State of potential particular European significance, the Minister, shall consult with—

(a) the Minister responsible for the sector concerned,

(b) the critical entity concerned, and

(c) the competent authority of the entity concerned.

(6) On completion of the consultations mentioned in paragraph (5), the Minister shall consult with—

(a) the European Commission, and

(b) the competent authorities of the Member States to, or in, which the entity concerned provides essential services.

(7) Once the European Commission informs the competent authority of its decision to consider a critical entity as a critical entity of particular European significance, the competent authority shall—

(a) forward that notification to the critical entity without undue delay, and

(b) inform that critical entity—

(i) that it is considered to be a critical entity of particular European significance,

(ii) its obligations under this Part, and

(iii) the date from which those obligations apply to it.

(8) This Regulation shall apply to a critical entity of particular European significance concerned from the date of receipt of the notification referred to in paragraph (7).

Co-operation with other Member States

20. (1) Whenever appropriate, the Minister may consult with the single point of contact of other Member States regarding critical entities for the purpose of ensuring that the Directive is applied in a consistent manner.

(2) Such consultations shall take place, in particular, regarding critical entities that—

(a) use critical infrastructure which is physically connected between two, or more, Member States (whether or not including the State);

(b) are part of corporate structures that are connected with, or linked to, critical entities in other Member States, or

(c) have been identified as critical entities in one Member State and provide essential services to, or in, other Member States (whether or not including the State in each instance).

(3) The consultations, under this Regulation, shall aim at enhancing the resilience of critical entities and, where possible, reducing the administrative burden on them.

Advisory missions

21. (1) Where a critical entity identified under Regulation 12 is considered by the European Commission to be one of particular European significance, the Minister, having consulted with the Minister responsible for the sector concerned, may request the European Commission to organise an advisory mission to assess the measures that the critical entity concerned has put in place to meet its obligations under these Regulations.

(2) Where an essential service is being provided in the State by a critical entity of particular European significance in another Member State, the Minister may request the European Commission to organise an advisory mission for the purposes mentioned in paragraph (1).

(3) On receipt of a reasoned request from the European Commission, or from one or more Member States to, or in which, an essential service is provided, the Minister shall provide the following to the Commission

(a) the relevant parts of the critical entity risk assessment;

(b) a list of relevant measures taken in accordance with Regulation 16;

(c) supervisory or enforcement actions, including assessments of compliance or orders issued, that its competent authority has undertaken pursuant to these Regulations in respect of that critical entity.

(4) A competent authority concerned and a critical entity concerned shall, through the Minister, receive the report of an advisory mission.

(5) The competent authority and the critical entity concerned shall take into account the report referred to in paragraph (4) and provide information through the Minister to the European Commission and the Member States to, or in, which the essential service is provided on the measures it has taken pursuant to that report.

(6) Each advisory mission shall consist of experts from the State, experts from the Member States to, or in, which the essential service is provided and European Commission representatives.

(7) The Minister may propose candidates to be part of an advisory mission.

(8) Critical entities of particular European significance shall provide advisory missions with access to information, systems and facilities relating to the provision of their essential services necessary for carrying out the advisory mission concerned.

(9) A critical entity that fails to comply with paragraph (8) commits an offence.

PART 8

GUIDANCE

Guidance

22. (1) For the purpose of providing practical guidance as regards compliance by critical entities and competent authorities with their obligations under these Regulations, the Minister may, from time to time and following consultation with such persons (if any) as he or she considers appropriate, prepare and publish guidelines.

(2) The guidelines, referred to in paragraph (1), shall specify the date on which they are to come into operation.

(3) The Minister may, following consultation with such persons (if any) as he or she considers appropriate, amend or revoke guidelines published under this Regulation.

(4) The Minister shall publish on a website maintained by him or her—

(a) the guidelines referred to in paragraph (1), and

(b) where guidelines prepared and published under paragraph (1) have been amended, the guidelines as amended.

(5) The Minister may prepare, and publish, guidelines for the purpose of providing practical guidance to the critical entities or the competent authorities in respect of the performance by such bodies of their functions.

(6) Guidelines prepared under this Regulation may include, but are not limited, to, the procedures to be followed for the purpose of the following

(a) risk assessment;

(b) mitigation;

(c) reporting;

(d) incident response.

PART 9

IMPLEMENTATION AND ENFORCEMENT

Inspections, supervision and enforcement

23. (1) Competent authorities may—

(a) conduct on-site inspections of the critical infrastructure and the premises that the critical entity uses to provide its essential services, and off-site supervision of measures taken by critical entities in accordance with Regulation 16;

(b) conduct or order audits in respect of critical entities.

(2) Competent authorities may require that critical entities provide, within a reasonable time limit set by those authorities—

(a) the information necessary to assess whether the measures taken by those entities to ensure their resilience meet the requirements set out in Regulation 16;

(b) evidence of the effective implementation of those measures, including the results of an audit conducted by an independent and qualified auditor selected by that entity and conducted at its expense.

(3) When requiring the information referred to in paragraph (2), the competent authority concerned shall state the purpose of the requirement and specify the information required.

(4) Without prejudice to the possibility to impose penalties in accordance with Regulation 30, competent authorities may, following the supervisory actions referred to in paragraph (1) or the assessment of the information referred to in paragraph (2), require, in writing, the critical entities concerned to take the necessary and proportionate measures to remedy any identified infringement of these Regulations, within a reasonable time limit set by those authorities, and to provide those authorities with information on the measures taken.

(5) The requirement referred to in paragraph (4) shall take into account, in particular, the seriousness of the infringement.

(6) A competent authority under these Regulations that assesses the compliance of a critical entity pursuant to this Regulation shall inform the competent authorities concerned under NIS 2 Directive.

(7) For the purposes of paragraph (6), the competent authorities under these Regulations may request the competent authorities under NIS 2 Directive to exercise their supervisory and enforcement powers in relation to an entity under that Directive that has been identified as a critical entity under these Regulations.

(8) Competent authorities under these Regulations shall co-operate and exchange information with the competent authorities under NIS 2 Directive or the DORA Regulation, as appropriate.

Safeguards

24. (1) The functions provided for in these Regulations can only be exercised subject to appropriate safeguards.

(2) The safeguards, referred to in paragraph (1), shall guarantee, in particular, that such exercise takes place in an objective, transparent and proportionate manner, and that the rights and legitimate interests of the critical entities affected, such as the protection of trade and business secrets, are duly safeguarded, and, in any case, consistent with the principles of fair procedures.

PART 10

AUTHORISED OFFICERS

Appointment of authorised officers

25. (1) A competent authority may, in relation to those sectors in respect of which it is designated as the competent authority, appoint such and so many persons as it thinks fit to be authorised officers for the purposes of these Regulations and of ensuring compliance by—

(a) critical entities in those sectors with their requirements, or

(b) other entities providing an essential service in those sectors.

(2) A competent authority may terminate the appointment of an authorised officer under this Regulation, whether or not the appointment was for a fixed period.

(3) The appointment as an authorised officer under paragraph (1) ceases—

(a) if it is terminated under paragraph (2),

(b) if it is for a fixed period, on the expiry of that period, or

(c) if the person appointed is an officer or employee of the appointing competent authority, on the person ceasing to be such an officer or employee.

(4) An authorised officer appointed under this Regulation shall be furnished with a warrant of his or her appointment and shall, when exercising any power conferred on him or her under these Regulations, if requested by a person affected, produce the warrant of appointment or a copy of it to that person together with a form of personal identification.

Powers of authorised officers

26. (1) An authorised officer appointed under Regulation 25 shall, for the purposes of any or all of these Regulations and of ensuring compliance with their requirements or, where Regulation 19 applies, of assisting a competent authority in another Member State in accordance with that Regulation, have power to do any or all of the following

(a) subject to paragraph (3), at all reasonable times enter and examine any place owned or operated by—

(i) a critical entity,

(ii) a critical entity of particular European significance, referred to in Regulation 19,

(iii) a person on behalf of an entity referred to in clause (i) or (ii), or

(iv) an entity providing an essential service,

for the purpose of, in relation to critical entity or an entity providing an essential service, assessing the compliance by that critical entity or entity providing an essential service with its obligations, or the obligations of the State, under these Regulations and the effects of such compliance on its resilience, or assisting a competent authority in another Member State under Regulation 19;

(b) for the purposes mentioned in subparagraph (a), to search and inspect the place, any process being carried out and any books, documents or records or things found at that place to the extent to which the place, process, books, documents or records or things relate to the resilience of that critical entity or entity providing an essential service, as the case may be;

(c) at a place referred to in subparagraph (a), request, inspect, review and examine any books, documents or records in respect of the resilience of a person referred to in subparagraph (a)(i) to (iv) which the authorised officer may reasonably require for the purpose of any search, examination, investigation, inspection, assessment or inquiry under these Regulations;

(d) require any person in charge of, or employed in, a place referred to in subparagraph (a) to produce to the authorised officer such books, documents or records (and in the case of such information in a non-legible form to reproduce it in a permanent legible form) that are in the person’s power, possession or control or to give to the authorised officer such information as the officer may reasonably require in relation to any entries in such books, documents or records;

(e) to inspect and take copies of or extracts from any such books, documents or records (including in the case of information in non-legible form a copy of or an extract from such information in a permanent legible form) or require that such a copy be provided;

(f) interview any person whom the authorised officer reasonably believes to be able to give to the authorised officer information or records relevant to any search, examination, investigation, inspection, assessment or inquiry under these Regulations and require the person to answer such questions as the authorised officer may ask relative to the search, examination, investigation, inspection, assessment or inquiry and to sign a declaration of the truth of the answers;

(g) require any person to afford the authorised officer such facilities and assistance within the person’s power, control or responsibilities as are reasonably necessary to enable the authorised officer to exercise any of the powers conferred on him or her by these Regulations.

(2) When performing a function under these Regulations, an authorised officer may, subject to any warrant under paragraph (5), be accompanied by such number of authorised officers or members of the Garda Síochána as he or she considers appropriate.

(3) An authorised officer shall not, other than with the consent of the occupier, enter a private dwelling unless the officer has obtained a warrant from the District Court under paragraph (5) authorising such entry.

(4) Where an authorised officer in the exercise of his or her powers under these Regulations is prevented from entering any place, an application may be made to the District Court under paragraph (5) for a warrant authorising such entry.

(5) If a judge of the District Court is satisfied on the sworn information of an authorised officer that there are reasonable grounds for suspecting that there is information required by an authorised officer under this Regulation held in any place or any part thereof, or that there is a record or thing which an authorised officer requires to inspect for the purposes of these Regulations, and that such inspection is likely to disclose evidence of a contravention of these Regulations, the judge may issue a warrant authorising an authorised officer, accompanied by such other authorised officers or members of the Garda Síochána as may be necessary at any time or times within one month of the date of issue of the warrant, on production of the warrant, if requested, to enter the place, if necessary by reasonable force, and perform the functions or exercise all or any of the powers conferred on an authorised officer under these Regulations.

(6) An application under paragraph (5) shall be made to the judge of the District Court in whose District Court district the place concerned is situated.

(7) A person shall not—

(a) obstruct or interfere with an authorised officer or a member of the Garda Síochána in the exercise of the powers conferred on such officer or member by these Regulations or a warrant under paragraph (5),

(b) without reasonable excuse, fail or refuse to comply with a request from or requirement of or to answer a question asked by an authorised officer or such member pursuant to a power conferred by these Regulations, or

(c) make a statement or give information to an authorised officer or such member that the person knows is false or misleading in a material respect.

(8) A statement or admission made by a person pursuant to a requirement under paragraph (1)(d) or (f) shall not be admissible in proceedings brought against that person for an offence (other than an offence under paragraph (9)(a)).

(9) A person who—

(a) contravenes paragraph (7),

(b) falsely represents himself or herself to be an authorised officer,

(c) prevents any person from answering any question to which an authorised officer may require an answer under this Regulation, or

(d) fails to comply with a bona fide request, instruction or direction from an authorised officer in the exercise of his or her functions under this Regulation,

commits an offence.

(10) In this Regulation—

“place” means any structure, premises, land or other location or part of such place, and includes any container, railway wagon, vessel, aircraft, motor or other vehicle;

“person in charge”, in relation to a place, means—

(a) the person under whose direction and control the activities at that place are being conducted, or

(b) the person whom the authorised officer has reasonable grounds for believing is in control of that place;

“record” includes any memorandum, book, report, statement, register, plan, chart, map, drawing, specification, diagram, pictorial or graphic work or other document, any photograph, film or recording (whether of sound or images or both), any form in which data (including data that constitute personal data) are held, any form (including machine-readable form) or thing in which information is held or stored manually, mechanically or electronically, and anything that is a part or copy, in any form, of any of, or any combination of, the foregoing.

Compliance notice

27. (1) Where a competent authority is of the opinion that a provision of these Regulations is not being, or has not been, complied with by a critical entity, the competent authority or an authorised officer appointed by the competent authority concerned may serve a notice (in this Regulation, referred to as a compliance notice) on that critical entity.

(2) A compliance notice—

(a) shall state that the competent authority or the authorised officer, as the case may be, is of the opinion referred to in paragraph (1),

(b) shall state the reason for the opinion, referred to in paragraph (1), of the competent authority or the authorised officer as the case may be,

(c) shall identify the provision of these Regulations in respect of which that opinion is held,

(d) shall require the person on whom it is served to take such action as is specified in the notice to remedy the non-compliance or suspected non-compliance,

(e) may require that the person provide the competent authority or the authorised officer, as the case may be, with information at such intervals as are specified in the notice in relation to the progress made in remedying the non-compliance or suspected non-compliance,

(f) shall inform the person of the requirement to confirm compliance with the notice as referred to in paragraph (6),

(g) shall inform the person of the right to appeal the notice and the requirements of paragraph (9),

(h) shall include an address for service of an appeal,

(i) shall be signed and dated by the competent authority or the authorised officer, as the case may be, and

(j) shall state that if the person on whom it is served fails to comply with the notice, the person commits an offence and shall be liable on conviction to the penalty referred to in Regulation 30.

(3) Subject to paragraph (4), a compliance notice under this Regulation shall be complied with within such period as may be specified in the notice which period shall not be less than 14 working days after the date of the notice.

(4) Upon the written application of the person on whom a compliance notice is served, the period specified in the notice as the period within which that notice must be complied with may be extended by and at the discretion of the competent authority or the authorised officer, as the case may be, and, where the period is so extended, the compliance notice shall be complied within such extended time period.

(5) A compliance notice may include directions—

(a) as to the action to be taken to remedy the non-compliance to which the notice relates, and

(b) to bring the notice to the attention of any person who may be affected by the non-compliance or to the notice of the public generally.

(6) A person on whom a compliance notice has been served shall confirm in writing to the competent authority or the authorised officer, as the case may be, that the compliance notice has been complied with as soon as practicable after so complying and, in any case, not later than seven working days after the date specified in the notice by which it is to be complied with or, where the period of time has been extended under paragraph (4), the date specified in accordance with the extension.

(7) Where a person on whom a compliance notice has been served so confirms in writing under paragraph (6) that the compliance notice has been complied with, the competent authority or the authorised officer, as the case may be, shall, on being so satisfied, not later than one month after the date of receipt of such confirmation, serve notice on the person concerned of compliance with the compliance notice.

(8) A person aggrieved by a compliance notice may, not later than 14 working days after the date on which the notice is served on the person, appeal against the notice to a judge of the Circuit Court for the circuit in which the notice was served and, in determining the appeal, the judge may, if he or she is satisfied that it is reasonable to do so, confirm, vary or cancel the notice.

(9) Notice of an appeal under paragraph (8) shall contain a statement of the grounds upon which the appeal is made and shall be lodged by the appellant with the appropriate office of the Circuit Court not later than 14 working days after the date upon which the compliance notice was served on the appellant.

(10) A copy of the notice by which a person makes an appeal shall be given by the appellant to the competent authority or authorised officer, as the case may be, concerned not later than 72 hours before the hearing of the appeal.

(11) The competent authority or the authorised officer, as the case may be, shall be entitled to appear, be heard and adduce evidence on the hearing of an appeal under paragraph (8) and at a hearing of any application referred to in paragraph (17).

(12) Where an appeal is made and the compliance notice is not cancelled, the person on whom the compliance notice was served shall comply with the notice by the later of—

(a) the day immediately after the end of the period of 14 working days after the date of the determination of the appeal and the confirmation of the notice,

(b) the date of the withdrawal of the appeal, or

(c) the day specified in the compliance notice or, where the period of time has been extended under paragraph (4), the day specified in accordance with the extension.

(13) Where no appeal is made, the person on whom the compliance was served shall comply with the notice by the later of—

(a) the day immediately after the end of the period within which an appeal may be made, or

(b) the day specified in the compliance notice or, where the period of time has been extended under paragraph (4), the day specified in accordance with the extension.

(14) A competent authority or an authorised officer, as the case may be, may, where he or she considers it appropriate to do so, by notice in writing to the person on whom a compliance notice was served, withdraw the compliance notice.

(15) A person on whom a compliance notice is served who fails to comply with, or causes or permits another person to contravene, the notice commits an offence.

(16) Where a person fails to comply with a compliance notice under this Regulation, the competent authority or the authorised officer, as the case may be, may, having given notice to the person concerned, apply to the judge of the Circuit Court for the circuit in which the notice was served for an order requiring the person to comply with the terms of the notice and the judge hearing the matter may, if he or she is satisfied that it is reasonable to do so—

(a) confirm the order sought,

(b) make such other order as it thinks fit, or

(c) refuse to make any order.

(17) A person on whom a compliance notice has been served shall not—

(a) pending the determination of an appeal, deal with a product, place, machinery, equipment or other thing to which the notice relates, other than in accordance with the terms of the compliance notice, or

(b) if the notice is confirmed or varied on appeal, deal with a product, place, machinery, equipment or other thing to which the notice relates, other than in accordance with the terms of the compliance notice as confirmed or varied.

(18) A person who contravenes paragraph (17) commits an offence.

(19) It shall be a defence in a prosecution for an offence under paragraph (15) or (18) for a person to show—

(a) that the person took all reasonable steps to ensure compliance with the relevant compliance notice, or

(b) it was not reasonably possible for the person to comply with the notice.

(20) This Regulation shall not operate to prevent or restrict—

(a) the entitlement of any person to bring proceedings for the purpose of securing compliance with these Regulations, or

(b) the bringing or prosecuting of any proceedings for an offence under these Regulations.

PART 11

INFORMATION NOTICES

Information notices

28. (1) A competent authority, or an authorised officer appointed under Part 10, may, by notice served on a critical entity or an entity providing an essential service, require the critical entity or entity providing an essential service to furnish, in writing, within such period as may be specified in the notice and, if applicable, in the format or manner specified in the notice, such information specified in the notice that the competent authority may reasonably require for the proper performance by the competent authority of its functions under these Regulations.

(2) An information notice under this Regulation shall—

(a) specify the purpose for which it is being served,

(b) inform the person on whom the information notice is served that he or she may appeal against a requirement specified in the notice to the Circuit Court in accordance with this Regulation, and

(c) state that if the person on whom the information notice is served fails to comply with the notice, that person commits an offence.

(3) Upon the written application of the person on whom an information notice under this Regulation is served, the period specified in the information notice may be extended by, and at the discretion of, the competent authority or the authorised officer, as the case may be.

(4) A person on whom an information notice under this Regulation is served may, within seven working days of the day on which the notice is served on the person, appeal against a requirement specified in the notice to a judge of the Circuit Court for the circuit in which the notice was served and in determining the appeal the judge may, if he or she is satisfied that it is reasonable to do so, confirm, vary or cancel the notice.

(5) A person who appeals under paragraph (4) shall at the same time notify the competent authority or authorised officer, as the case may be, of the appeal and the grounds for the appeal

(6) The competent authority or authorised officer, as the case may be, shall be entitled to appear, be heard and adduce evidence on the hearing of an appeal made under paragraph (4).

(7) Where, on the hearing of an appeal under this Regulation, an information notice is confirmed or varied, the judge by whom the appeal is heard may, on the application of the appellant, suspend the operation of the notice for such period as in the circumstances of the case the judge considers appropriate.

(8) Subject to paragraph (9), a person on whom an information notice under this Regulation is served shall comply with the notice not later than—

(a) the end of the period specified in the notice, or

(b) where the period referred to in subparagraph (a) is extended under paragraph (3), the end of that extended period.

(9) Where an appeal is brought under this Regulation, and the information notice to which the appeal relates is confirmed or varied or the appeal is withdrawn, the person on whom the notice is served shall comply with the notice not later than—

(a) the day immediately after the day on which the notice is confirmed or varied or the appeal is withdrawn,

(b) the end of the period specified in the notice,

(c) where the period referred to in subparagraph (b) has been extended under paragraph (3), the end of that extended period, or

(d) where the operation of the notice has been suspended under paragraph (7), the end of the period of suspension,

whichever occurs later.

(10) A person on whom an information notice under this Regulation has been served and who fails to comply with, or causes or permits another person to contravene, a provision or a requirement of this Regulation commits an offence.

(11) It shall be a defence in a prosecution for an offence under paragraph (10) for a person to show, in respect of the provision or requirement of this Regulation to which the prosecution relates—

(a) that the person took all reasonable steps to ensure compliance with that provision or requirement, or

(b) that it was not reasonably possible for the person to comply with that provision or requirement.

(12) A person who, in purported compliance with a requirement in an information notice under this Regulation, furnishes information to the competent authority or authorised officer, as the case may be, that he or she knows to be false or misleading in a material respect commits an offence.

(13) A competent authority or an authorised officer, as the case may be, where the authority or officer considers it appropriate to do so, by notice in writing to the person on whom an information notice was served, withdraw that notice.

PART 12

FINAL PROVISIONS

Service of documents, etc.

29. (1) Subject to paragraphs (2) and (3), a notice, direction, certificate or any other document (in this Regulation, referred to as a document) that is required to be served on a person under these Regulations shall be in writing and addressed to the person concerned by name, and may be so served to the person in one or more of the following ways

(a) by delivering it to the person;

(b) by leaving it at the address at which the person ordinarily carries on business;

(c) by sending it by pre-paid registered post addressed to the person at the address at which the person ordinarily carries on business;

(d) if an address for the service of documents has been furnished by the person, by leaving it at, or sending it by pre-paid registered post addressed to that party at that address;

(e) by sending it by means of electronic mail or a facsimile machine, to a device or facility for the reception of electronic mail or facsimiles located at the address at which the person concerned carries on business or, if an electronic address or facsimile number address for the service of documents has been furnished by the person concerned, that electronic address or facsimile machine, but only if—

(i) the recipient’s facility for the reception of electronic mail generates a message confirming a receipt of the electronic mail, or

(ii) the sender’s facsimile machine generates a message confirming successful delivery of the total number of pages of the document;

and it is also given in one of the other ways mentioned in subparagraphs (a) to (d);

(f) if the address at which the person ordinarily resides cannot be ascertained by reasonable enquiry and the notice relates to a premises, by delivering it to the premises or by affixing it in a conspicuous position on or near the premises.

(2) For the purposes of this Regulation, a company formed and registered under the

Companies Act 2014

(No. 38 of 2014) or an existing company within the meaning of that Act shall be deemed to be ordinarily resident at its registered office, and every other body corporate and every unincorporated body shall be deemed to be ordinarily resident at its principal office or place of business.

(3) Where a document under these Regulations is to be served on a person who is the owner or occupier of land or property and the name of the person cannot be ascertained by reasonable inquiry, it may be addressed to the person by using the words “the owner” or, as the case may require, “the occupier”.

(4) Where an opinion, finding, statement or decision of a competent authority is contained in a document which—

(a) purports to have been made by or at the direction of that competent authority, and

(b) is produced in evidence by an officer of the competent authority or by an authorised officer in any proceedings,

such document shall be admissible in evidence and shall be evidence of any such opinion, finding, statement or decision in such proceedings without further proof.

Penalties

30. (1) A person that commits an offence under Regulation 9(17), 11(10), 15(7), 16(12), 18(14), 21(9), 26(9), 27(15) or (18) or 28(10) or (12) shall be liable—

(a) on summary conviction, to a class A fine, or

(b) on conviction on indictment, to a fine not exceeding—

(i) in the case of an individual, €50,000, and

(ii) in the case of a person other than an individual, €500,000.

(2) Notwithstanding

section 10

(4) of the

Petty Sessions (Ireland) Act 1851

, summary proceedings for an offence under these Regulations may be instituted at any time within 12 months of the date of the alleged commission of the offence.

Costs of prosecutions

31. (1) Where a critical entity is convicted of an offence under these Regulations, the court shall, unless it is satisfied that there are special and substantial reasons for not doing so, order the critical entity concerned to pay to the prosecutor a sum equal to the costs and expenses, measured by the court, reasonably incurred by the prosecutor in relation to the prosecution of the offence.

(2) An order for costs and expenses, referred to in paragraph (1), shall be in addition to, and not instead of, any fine or penalty the court may impose.

Prosecution of offences: critical entities

32. (1) Proceedings in relation to summary offence under these Regulations may be brought and prosecuted by a competent authority referred to in paragraph (2) of Regulation 8 or as designated by the Minister under paragraph (1) of that Regulation.

(2) Where an offence under these Regulations is committed by a body corporate and is proven to have been so committed with the consent, connivance or approval of, or to have been attributable to the wilful neglect on the part of, any person, being a director, secretary or other officer of the body corporate or a person who was purporting to act in any such capacity, that person, as well as the body corporate, commits an offence and is liable to be proceeded against and punished as if he or she was guilty of the first-mentioned offence.

(3) Where the affairs of a body corporate are managed by its members, paragraph (2) applies in relation to the acts and defaults of a member in connection with the functions of management as if the member were a director or manager of the body corporate.

Hearing of proceedings otherwise than in public

33. Where a court is satisfied that it is desirable that the whole or part of proceedings relating to an application or an appeal under these Regulations be heard otherwise than in public because of the nature or the circumstances of the case or having regard to the interests of justice, then the court may make an order that the proceedings shall, in whole or part, be heard otherwise than in public.

Review of Regulations by Minister

34. (1) The Minister shall, not earlier than six years and not later than seven years after the date of the coming into operation of these Regulations, having consulted with the Minister responsible for, and the competent authority concerned with, the sector concerned, conduct a review of the operation of these Regulations.

(2) Having conducted the review mentioned in paragraph (1), the Minister shall prepare a report in writing of the findings of the review and shall cause copies of the report to be laid before each House of the Oireachtas.

SCHEDULE

Regulations 2(1), 3(1), 7(6) & (8), 8(2), 9(4), 10(2), 11(4) & (8), 12(1), (3), (4), (6) & (8) and 15(4)

SECTORS, SUBSECTORS AND CATEGORIES OF ENTITIES

In this Schedule—

“Electricity Regulation” means Regulation (EU) 2019/943 of the European Parliament and of the Council of 5 June 2019

11

on the internal market for electricity, as amended;

“Gas Directive” means Directive (EU) 2024/1788 of the European Parliament and of the Council of 13 June 2024

12

on common rules for the internal markets for renewable gas, natural gas and hydrogen, amending Directive (EU) 2023/1791 and repealing Directive 2009/73/EC);

“Medicinal Products Directive” means Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001

13

on the Community code relating to medicinal products for human use, as amended;

“NACE Rev. 2” means the common basis for statistical classifications of economic activities within the European Community set out in the Annex to Council Regulation (EEC) No. 3037/90 of 9 October 1990

14

on the statistical classification of economic activities in the European Community, as amended;

“Ship and Port Facility Regulation” means Regulation (EC) No 725/2004 of the European Parliament and of the Council of 31 March 2004

15

on enhancing ship and port facility security, as amended.

TABLE

Column

(1)

Column

(2)

Column

(3)

Sectors

Subsectors

Categories of entities

Notice of the making of this Statutory Instrument was published in

“Iris Oifigiúil” of

25

th October,

2024.

TABLE OF CONTENTS

Regulation

PART 1

PRELIMINARY AND GENERAL