7 July 2026 22:00 UTC · European Commission · EU Commission Press Release · Source · Email X Link

European Commission refers Ireland, Spain, France and the Netherlands

Key points

Failure to notify full transposition of NIS2 Directive
Commission requests financial sanctions until full transposition

TL;DR

Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify measures transposing the NIS2 Directive.
NIS2 sets high standards for entities in 18 critical sectors to strengthen EU cybersecurity and incident-response capacity.
Commission sent letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025; Member States had until 17 October 2024 to transpose; referrals include a request for financial sanctions.

Original text

European Commission - Press release Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity Brussels, 8 July 2026 Today, the European Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to notify measures transposing the NIS2 Directive on securing network and information systems ( Directive (EU) 2022/2555 ) into national law. The Directive strengthens EU cybersecurity by setting high standards for entities operating in 18 critical sectors, including health, energy, transport, and the public sector. Its full implementation is key to improving the EU's resilience and the incident response capacity of public and private entities operating in these critical sectors, and of the EU as a whole. Member States had until 17 October 2024 to transpose the Directive. While most complied, Spain, France, Ireland and the Netherlands have yet to notify full transposition. The Commission sent letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025. The referrals include a request to the Court to impose financial sanctions, consisting of a lump sum and daily penalties until notification of complete transposition. Background Cybersecurity involves protecting network and information systems, users and affected individuals from cyber incidents and threats. As cyber threats grow, the NIS2 Directive requires Member States to strengthen their cybersecurity capabilities and introduce risk-management measures and incident- reporting obligations for entities in 18 critical sectors. On 20 January 2026, as part of a cybersecurity package , the Commission proposed targeted amendments to the NIS2 Directive to provide greater legal clarity. The amendments make it easier for companies operating in the EU to comply with cybersecurity rules and risk-management requirements. For more information EU infringement procedure NIS2 Directive Infringement decisions database and infringements map and graphs July 2026 infringement package Infringement procedure Ireland ( INFR(2024)0279 ) Infringement procedure Spain ( INFR(2024)0270 ) Infringement procedure France ( INFR(2024)0274 ) Infringement procedure the Netherlands ( INFR(2024)0288 ) IP/26/1499 Press contacts: Thomas REGNIER (+32 2 29 91099) Patricia POROPAT (+32 2 29 80485) General public inquiries: Europe Direct by phone 00 800 67 89 10 11 or by email

Key tags

Topics

Keywords

Stats

Word count: 367

Summary words: 88

Compression: 24%

Boilerplate removed: Yes

Top phrases:

Entities

People

Organizations

Places

Brussels