Ireland:
What Irish customers expect

Ireland as a market for South America

For goods exporters from South America, Ireland is a fairly small market. Dublin Port is the country's largest port; a large share of sea freight arrives by ferry and short-sea services from Great Britain and the continent.

Ireland is interesting for service providers. Numerous international technology, pharmaceutical and medical device companies have their EU headquarters or large sites in Ireland. From there they award contracts for software development, customer service, data processing and content moderation. A call center in Bogotá serving Spanish- and Portuguese-speaking customers for a company in Dublin is a typical example.

Because English is the business language, getting started is easier than in many other EU countries. The bar for data protection and security is high, though, because the Irish entities are watched closely by the regulator and by their group headquarters.

What is the same across the EU and what applies in Ireland

Customs and product law are uniform across the EU; the basics are in the export guide. The customs authority is the tax administration, Revenue. Since Brexit, goods that reach Ireland via Great Britain leave the EU and must be cleared again on import into Ireland, unless they stay in transit under customs supervision.

Language: in practice, labels and instructions in Ireland are in English. The Food Information Regulation (Regulation (EU) No 1169/2011, Art. 15) allows member states to require their official languages.

VAT: the standard rate is 23 %.

Packaging: producer responsibility for packaging in Ireland is handled by Repak, the approved compliance scheme. The obligation lies with whoever places packaged goods on the Irish market, which for imports is usually the importer. Since August 12, 2026, the EU Packaging Regulation (Regulation (EU) 2025/40) applies as well.

NIS2 in Ireland

Ireland did not transpose NIS2 on time. So far only the General Scheme of the National Cyber Security Bill 2024, the outline of the bill dated August 30, 2024, has been published. As of October 11, 2026, no bill had been presented to parliament; the government lists it as a priority for fall 2026. In July 2026, the Commission took Ireland to the Court of Justice of the EU over the delay.

Until then, the NIS1 rules (S.I. No. 360/2018) apply to the operators of essential services already designated. The National Cyber Security Centre (NCSC) is to become the competent authority and national CSIRT, alongside sector regulators such as the Central Bank of Ireland for banks and ComReg for digital infrastructure. According to the NCSC, a registration and reporting portal will only be available once the law takes effect.

On October 7, 2026, the government published the National Cyber Security Strategy 2030. The NCSC has also adopted the Belgian CyberFundamentals (CyFun) framework as the national assessment scheme; certifications are expected from 2027. According to the NCSC, however, CyFun evidence does not count as proof of NIS2 compliance.

For suppliers the delay is barely noticeable. Groups headquartered in Ireland implement NIS2 requirements across the group, because they already apply in other EU countries. Financial companies are also bound by DORA. More under NIS2.

Data protection and supply chain

The data protection authority is the Data Protection Commission (DPC). Because many large technology companies have their main EU establishment in Ireland, the DPC is their lead supervisory authority for the whole EU under the one-stop-shop mechanism. Its decisions therefore carry weight far beyond Ireland.

What follows for you: if you process personal data for such a company, you will get a detailed data processing agreement under Art. 28 GDPR, standard contractual clauses for the transfer if your country has no adequacy decision, and regular audits.

Ireland has no supply chain law of its own. The European CSDDD will be the relevant rule.

What Irish customers typically ask for

Technology customers almost always expect an ISO 27001 certificate or a SOC 2 report, often both. Groups with a US parent tend to ask for SOC 2. The page SOC 2 or ISO 27001 helps you choose. Sightadel supports both frameworks and reuses what you have built for one when you add the other.

Pharmaceutical and medical device customers require quality management under ISO 9001 or industry-specific standards and audit suppliers on site.

Service providers with an AI component, for example in content moderation or data preparation, increasingly get questions about the AI Act. For those, Sightadel includes the EU AI Act and ISO/IEC 42001 as frameworks.

A sensible starting point for service providers to Irish customers:

1. Ask early for the group's contract template and security questionnaire; both are usually the same worldwide.
2. Check whether your country has an EU adequacy decision. If not, you need standard contractual clauses and a transfer impact assessment.
3. Choose between SOC 2 and ISO 27001 based on what your most important customers require.
4. Set up a reporting process for data breaches and security incidents that meets the contractual deadlines.

Contacts

First contacts usually go through the Enterprise Ireland office in São Paulo and the Irish embassies in the region.

FAQ