# EU Cracks Down: Four Member States Face Fines Over Delayed NIS2 Directive Implementation **Brussels, Belgium** – The **European Commission** has taken decisive action, filing legal referrals at the **Court of Justice of the European Union** against four member states for their failure to implement the bloc's flagship cybersecurity law. Ireland, Spain, France, and the Netherlands are more than 20 months behind schedule in transposing the **NIS2 Directive**, a crucial piece of legislation designed to set minimum security standards for critical infrastructure across the EU. ## The Mandate of NIS2 The **NIS2 Directive** is a comprehensive update to the original **Network and Information Security Directive** of 2016. It significantly widens its scope to cover 18 critical sectors, including hospitals, energy networks, transport operators, and public administrations. The directive also introduces new requirements for risk management and incident reporting, which were not present in its predecessor. Its timely implementation is seen as vital for the EU's collective cybersecurity posture. ## Seeking Financial Penalties The Commission is requesting the imposition of both a lump sum and ongoing daily financial penalties on the four delinquent countries. These penalties would continue until each state formally notifies full transposition of the directive. While such fines are rarely paid in practice, with member states typically adopting the required legislation during proceedings, the move underscores the Commission's commitment to enforcing cybersecurity standards. ## A Broader Cybersecurity Framework **NIS2** is a cornerstone of a broader legislative program on cybersecurity within the EU. It underpins initiatives like the **EU’s Cyber Resilience Act**, which imposes security requirements on connected products and whose vulnerability-reporting obligations are set to begin in 2027. The directive also establishes the national response-team network that the Cyber Resilience Act relies upon. In January, the Commission also proposed revising the **EU’s Cybersecurity Act** to strengthen **ENISA**, the EU’s cybersecurity agency, and mitigate risks in critical technology supply chains. This includes a provision that would see member states phase out designated high-risk suppliers, such as **Huawei** and **ZTE**, from critical infrastructure. ## Growing Threats and Urgency The legal action comes amidst increasing warnings from cybersecurity experts and EU officials about the escalating threat landscape. **ENISA** has reported thousands of cybersecurity incidents affecting the bloc, with public administration identified as the most-targeted critical sector, accounting for 38% of incidents. Transport followed at 7.5%. **Henna Virkkunen**, the Commission’s technology lead, emphasized the gravity of the situation in February, stating that the EU could no longer afford to be "naive" about adversaries' ability to disrupt critical infrastructure. Power grids, hospitals, and financial systems are all increasingly exposed to sophisticated cyber threats. ## Member State Responses Ireland has indicated that its **National Cyber Security Bill**, which will transpose **NIS2** and establish the country’s **National Cyber Security Centre** on a statutory footing, is nearing finalization. The minister responsible anticipates notifying full transposition by the end of 2026. Spain, France, and the Netherlands have not yet published comparable statements regarding their progress. Separately, the Commission has proposed targeted amendments to **NIS2** to provide greater legal clarity and ease compliance for companies. These issues have been cited by officials as contributing factors to the delays in transposing the updated directive.