The European Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity

The European Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to notify measures transposing the NIS2 Directive on securing network and information systems (Directive (EU) 2022/2555) into national law.

The Directive strengthens EU cybersecurity by setting high standards for entities operating in 18 critical sectors, including health, energy, transport, and the public sector. Its full implementation is key to improving the EU’s resilience and the incident response capacity of public and private entities operating in these critical sectors, and of the EU as a whole.

Member States had until 17 October 2024 to transpose the Directive. While most complied, Spain, France, Ireland and the Netherlands have yet to notify full transposition. The Commission sent letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025. The referrals include a request to the Court to impose financial sanctions, consisting of a lump sum and daily penalties until notification of complete transposition.

Background

Cybersecurity involves protecting network and information systems, users and affected individuals from cyber incidents and threats. As cyber threats grow, the NIS2 Directive requires Member States to strengthen their cybersecurity capabilities and introduce risk-management measures and incident-reporting obligations for entities in 18 critical sectors.

On 20 January 2026, as part of a cybersecurity package, the Commission proposed targeted amendments to the NIS2 Directive to provide greater legal clarity. The amendments  make it easier for companies operating in the EU to comply with cybersecurity rules and risk-management requirements.

See more stories here.