EU Commission Refers Four Member States to CJEU Over NIS2 Transposition Failures
The European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify complete transposition of the NIS2 Directive (Directive (EU) 2022/2555), which member states were required to implement by 17 October 2024. The Commission asked the Court to impose a lump sum and daily penalties on each country until it notifies full transposition. According to the Commission, most member states have complied, meaning 23 of 27 have notified full national implementing measures, and the referrals follow letters of formal notice in November 2024 and reasoned opinions in May 2025.
Key Analytics
Impact Analysis
The referral shows the Commission is prepared to pursue financial penalties to force NIS2 implementation, making national transposition in the four lagging states a near-term certainty rather than an open question. One of the four has since closed: the Dutch Cyberbeveiligingswet entered into force on 15 August 2026, so organisations with Netherlands operations now carry live duties rather than a watching brief, and the separate radar entry for that law is the current answer for the Netherlands. Ireland, Spain, and France remain outstanding, and Ireland's own National Cyber Security Centre still states that the transposition deadline has not been met. Organizations operating in Ireland, Spain, or France should not treat the remaining transposition gap as a reprieve, because obligations for essential and important entities across NIS2's 18 critical sectors will apply on short notice once national laws take effect, often with tight registration deadlines. Multinationals should also expect uneven national variations, since each transposing law can add sector scoping, registration mechanics, and penalty regimes beyond the directive's baseline.
Recommended Actions
- Determine whether your organization qualifies as an essential or important entity under NIS2's sector and size criteria in each EU member state where you operate.
- Align now with the directive's Article 21 cybersecurity risk management measures and Article 23 incident reporting timelines (24-hour early warning, 72-hour notification) rather than waiting for national transposition in the four referred states.
- Brief management bodies on their NIS2 accountability duties, since the directive requires them to approve and oversee risk management measures and exposes them to liability for failures.
- Track the national implementing laws still outstanding in Ireland, Spain, and France, and register with the relevant national authority once entity registration windows open; for the Netherlands that step is no longer prospective, because the Cyberbeveiligingswet is in force and its register is open.
- Review supply chain security requirements, as in-scope customers will flow NIS2 obligations down contractually to vendors that fall outside the directive's direct scope.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Article 21 control gap closure against the directive baseline
- ›Entity classification per member state of operation
- ›Article 23 incident reporting workflow for early warning and notification
- ›Management body accountability briefing and oversight documentation
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 90 to 190 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.