A large number of Irish firms will be liable for multi-million euro penalties if they fail to comply within 21 months with new EU-wide cyber security rules due to come into effect next month.