EU-Driven Cybersecurity Certifications: Implications for Ireland's SME Sector

The European Union has adopted major regulatory measures, including the NIS 2 Directive, the Cybersecurity Act, and the Cyber Resilience Act, to strengthen cyber resilience through the EU Cybersecurity Certification Framework. This framework introduced mandatory certification requirements that will come into effect in 2027. Reflecting broader EU trends, Ireland has experienced delays in transposition of such regulatory instruments, raising questions about stakeholders' readiness status. The approach to address this question combines a structured review of literature with an exploratory survey to assess the maturity levels of stakeholders involved in the EU Cybersecurity Certification framework, including Small and Medium Enterprises (SMEs). Prelimirary findings from literature review highlighted the significance of challenges faced by SMEs including resource and capacity constraints. The outcome of this research will include a comprehensive overview of the state of implementation of the Cybersecurity Act, the NIS 2 Directive and the Cyber Resilience Act in Ireland aiming to lay the foundation for a cybersecurity certification readiness framework, providing practical pathways to support the engagement of SMEs and improve cybersecurity resilience in Ireland and across the EU.