Bulgaria, France, Ireland, Luxembourg, the Netherlands, Portugal, Spain, Sweden have all yet to adopt cybersecurity rules for critical sectors almost a year after an EU deadline, according to the latest data, meaning they face potential legal action.
The Network and Information Security Directive 2 (NIS2), which was approved back in 2022 aims to protect critical entities, such as energy, transport, banking, water and digital infrastructures, against major cyber incidents.
Countries had to transpose the rules into national legislation by 17 October last year.
The EU executive began an infringement procedure in May against 19 member states for failing to adopt the rules. The countries had two months to take the necessary measures, or else face referral to the EU Court of Justice.
Eleven member states have now done the work, but the remaining eight face potential further Commission action.
A spokesperson for the institution told Euronews that the Commission is “monitoring member states’ replies" and “once assessed, will propose either closure or in the absence of a satisfactory response [...] next steps of the infringement procedure.”
Under NIS2, companies need to issue a warning within 24 hours and deliver an incident report within 72 hours in case of incidents that cause serious operational disruptions. In case of non-compliance, companies face fines up to €10 million, or 2% of worldwide revenue, whichever is higher.
In December, the Commission will present an “omnibus” simplification package in a bid to identify reporting obligations in existing digital legislation that can be cut to ease pressure on enterprises, particularly SMEs. Cyber rules are expected to be part of that.
