Eight EU Countries Face Action Over NIS2 Directive Compliance Failures

What's Happening?

Eight European countries, including Ireland, Spain, and France, are facing potential legal action from the European Commission for failing to transpose the NIS2 directive into domestic law by the October 2024 deadline. The directive aims to enhance cybersecurity across critical infrastructure sectors. Despite warnings issued in May 2025, these countries have not completed the necessary legal adaptations. Compliance challenges persist even in countries that have enacted the directive, with sectors like IT service management and public administration facing significant hurdles.

Why It's Important?

The failure to comply with the NIS2 directive highlights the complexities of implementing EU-wide cybersecurity measures. Non-compliance could lead to legal repercussions and financial penalties, affecting national economies and cybersecurity readiness. The directive's uneven application may result in varying levels of protection across member states, potentially exposing critical infrastructure to cyber threats. This situation underscores the need for coordinated efforts to strengthen cybersecurity frameworks within the EU.

What's Next?

The European Commission may escalate the issue to the Court of Justice of the European Union if the countries do not take corrective actions. The ongoing compliance challenges could prompt further regulatory scrutiny and adjustments to the directive's implementation. The situation may also influence the development of similar cybersecurity policies in non-EU countries, including the UK's upcoming Cyber Security and Resilience Bill.