cyber.hendryadrian.com
Security News · therecord.media

EU Refers Ireland, Spain, France and Netherlands to Court Over NIS2 Delays

· Original article ↗

Summary

The European Commission referred Ireland, Spain, France and the Netherlands to the EU’s top court over delayed NIS2 implementation, seeking lump-sum and daily fines. ENISA reported thousands of incidents, with public administration the most targeted sector.

Key points

  • The Commission says the four countries are more than 20 months late in transposing NIS2 and has asked the EU court to impose lump-sum and ongoing daily penalties.
  • As of January 2025, only six of the EU’s 27 member states had transposed the directive, according to the article.
  • NIS2 establishes minimum security standards for critical sectors and expands requirements for risk management and incident reporting across 18 sectors.
  • ENISA reported thousands of cybersecurity incidents in the year ending June 2025; public administration accounted for 38% and transport for 7.5% of incidents.
  • Ireland said its National Cyber Security Bill was nearing finalization and that it expected to notify transposition by the end of 2026; the other three countries had not published comparable statements.
  • The article says NIS2 supports broader EU cybersecurity measures, including the Cyber Resilience Act and the national response-team network.

Article Details

Event Type
The European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to transpose the NIS2 Directive on time.
Impact
The Commission is seeking lump-sum and ongoing daily financial penalties until each country formally notifies full transposition. NIS2 sets minimum security, risk-management, and incident-reporting requirements for critical sectors. ENISA reported thousands of incidents in the year ending June 2025, with public administration accounting for 38% and transport 7.5% of incidents.

People

Henna VirkkunenThe Commission’s technology lead, who warned that the EU could no longer be naive about adversaries’ ability to disrupt critical infrastructure.

Countries

FranceThe European Commission has referred Ireland, Spain, France, and the Netherlands to the EU’s top court for failing to transpose the NIS2 Directive on time.IrelandThe European Commission has referred Ireland, Spain, France, and the Netherlands to the EU’s top court for failing to transpose the NIS2 Directive on time.NetherlandsThe European Commission has referred Ireland, Spain, France, and the Netherlands to the EU’s top court for failing to transpose the NIS2 Directive on time.SpainThe European Commission has referred Ireland, Spain, France, and the Netherlands to the EU’s top court for failing to transpose the NIS2 Directive on time.

Industries

EnergyNIS2 sets minimum security standards for critical sectors such as hospitals, energy, transport, and public administration.Public administrationNIS2 sets minimum security standards for critical sectors such as hospitals, energy, transport, and public administration.TransportNIS2 sets minimum security standards for critical sectors such as hospitals, energy, transport, and public administration.