The European Commission has escalated its enforcement action against four Member States, referring France, Spain, Ireland and the Netherlands to the Court of Justice of the European Union (CJEU) for failing to fully incorporate new cybersecurity rules into their national laws. The Commission’s move marks the next stage in an infringement procedure over delays in transposing the Network and Information Security Directive 2 (NIS2 Directive), a major EU cybersecurity framework designed to strengthen the resilience of critical sectors against growing digital threats. By taking the matter before the EU’s highest court, the Commission is seeking to ensure that Member States comply with their obligations under EU law and establish a more consistent cybersecurity regime across the bloc.

The Legal Dispute Behind the Court Action

The NIS2 Directive was adopted by the European Union to replace and expand the earlier cybersecurity framework, known as the NIS Directive. It seeks to improve cybersecurity standards across a wider range of sectors, including energy, transport, healthcare, digital infrastructure, banking, and public administration.

Unlike regulations, which apply directly across Member States once adopted, directives require countries to take legislative action at the national level to achieve the objectives set by the EU.

However, Member States are not free to implement directives whenever they choose. They are legally required to transpose them into domestic law within the deadline set by the EU legislature.

The deadline for Member States to transpose the NIS2 Directive into national law expired on 17 October 2024. According to the Commission, the four Member States referred to the CJEU have failed to fully complete that process.

EU Enforcement Powers at Work

The Commission’s decision reflects EU’s infringement proceedings, one of its most important legal mechanisms. Under the Treaty on the Functioning of the European Union, the Commission has the authority to take action against Member States that fail to fulfil their obligations under EU law. Where a Member State does not address the Commission’s concerns during the earlier stages of the procedure, the Commission may refer the matter to the CJEU. The purpose of such proceedings is not simply punitive. They serve to preserve the uniform application of EU law across all Member States. In areas such as cybersecurity, where threats can easily cross national borders, inconsistent implementation of EU rules can create vulnerabilities that affect the wider Union. A weakness in one Member State’s cybersecurity framework can potentially have consequences for businesses, public institutions, and citizens across Europe.