The European Commission has initiated infringement procedures against 23 EU member states for not implementing the NIS2 Directive and the Critical Entities Resilience Directive, aimed at bolstering cybersecurity and infrastructure resilience. These measures come in response to the failure of countries such as Germany, France, and Ireland to meet the October 17 deadline for incorporating the NIS2 Directive into national law. This directive mandates organizations in critical sectors like finance, healthcare, and IT to adhere to cybersecurity risk management and incident reporting protocols.
The Commission has issued formal notices to the non-compliant states, requiring them to respond within two months and complete the implementation process. Failure to do so could lead to the Commission issuing reasoned opinions or even referring the cases to the Court of Justice, which can impose compliance orders and penalties. Historically, most countries resolve such issues before reaching the court stage.
Additionally, the Commission is addressing 24 member states, including Germany, for missing another deadline related to the assessment of risks to critical infrastructure, as outlined in the Critical Entities Resilience Directive. This directive broadens the scope of critical sectors from two to 11, emphasizing the importance of services like energy, transport, and digital infrastructure.
While only six countries, including Belgium and Greece, have fully transposed the NIS2 Directive, others, like Germany and France, are still in the legislative process. Many nations anticipate being ready to enforce the directive by March 2025. The regulation classifies sectors as “essential” or “important,” with violations potentially resulting in hefty fines based on an organization’s global revenue.
The NIS2 Directive underscores the need for a robust cybersecurity framework across the EU, urging national authorities to conduct security inspections, issue warnings, and ensure prompt reporting of cybersecurity incidents. The stringent penalties aim to drive compliance, enhancing the overall security and resilience of critical infrastructure throughout the European Union.
