This chapter examines the evolving cyber regulatory landscape for critical infrastructure in Europe through a comparative analysis between the Republic of Ireland (representing the EU framework) and the United Kingdom. It highlights the growing centrality of cyber in Europe’s public security, particularly in response to Russian cyber aggressions. Through a detailed comparative review, the chapter analyses foundational legal frameworks, scope and sectoral coverage, regulatory obligations, and incident reporting under the EU’s reviewed Network and Information System Directive (NIS2), the UK’s transposition of the pre-Brexit Network and Information System Directive (NIS) and its proposed Cyber Security and Resilience Bill (CSRB). While both systems share historical roots in the original NIS Directive, they are diverging post-Brexit. The EU is adopting a broader, more integrated approach, and the UK is developing a more targeted, sovereign framework. Key policy tensions are highlighted, particularly regarding the imposition of public security responsibilities on private entities without commensurate economic incentives for cyber deployment. The chapter also reflects on broader economic and legal considerations, including the relevance for cybersecurity of EU competition law, state aid rules, and the Services of General Economic Interest framework. Finally, the chapter calls for the alignment of cyber obligations with industrial policy and competitiveness goals.