Skip to main content
CISO Daily
Regulatory Update

EU Takes Four Countries to Court Over NIS2: What It Means for Multi-Country Compliance Plans

5 min read
CISO Daily
EU Takes Four Countries to Court Over NIS2: What It Means for Multi-Country Compliance Plans

More than two years after the deadline, NIS2 is still not national law everywhere in the EU. On 8 July 2026 the European Commission decided to bring four member states before the Court of Justice of the EU. For a company operating across Europe, the practical message is that your obligations depend on which country you sit in, and that the map is still moving.

What the Commission Did

According to The Record (9 July 2026), the Commission filed a referral on Wednesday 8 July 2026, bringing Ireland, Spain, France and the Netherlands to the Court over failure to implement the NIS2 Directive (Directive (EU) 2022/2555). Member states had until 17 October 2024 to transpose it.

The process was gradual. The Commission’s transposition page lists all four countries among those sent reasoned opinions on 7 May 2025. It now asks the Court to impose financial penalties on each country: a lump sum plus daily penalties until full transposition is notified.

The Commission describes NIS2 as raising cybersecurity standards for entities in 18 critical sectors, including health, energy, transport and the public sector.

Where Each Country Stands

The Record reported on 9 July 2026 that all four countries were more than 20 months past the deadline. It also reported that:

  • Ireland said its National Cyber Security Bill is close to finalisation, and its minister expects to notify transposition by the end of 2026.
  • Spain, France and the Netherlands had not published comparable statements at the time.
  • Fines of this kind are rarely paid, because states usually pass the law during proceedings and the Commission then withdraws.

The Netherlands adopted its law the same day as the referral (Stb. 2026, 187, dated 8 July 2026), and a companion decree (Stb. 2026, 189) brought it into force on 15 August 2026, according to the Dutch Staatsblad. We have not checked whether the Netherlands has formally notified transposition to the Commission.

Why This Matters to a Company

The referral is directed at governments. It does not create new duties for your organisation, and it does not suspend duties that already exist where national law is in force. Three consequences follow.

Obligations are uneven. Germany is an example of a country that had moved ahead. In November 2025, before enactment, McDermott described the German act’s tiered penalty scale: at the highest level, up to 2% of total turnover for particularly important entities and up to 1.4% for important entities, in both cases where turnover exceeds EUR 500 million; at the second level, up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities; and up to EUR 5 million at a third level. It also described management bodies personally liable under corporate law for breaches of oversight duties. We have not opened the enacted German text, so confirm these figures against it. Our assessment is that an entity in a country without a law, such as Ireland, Spain or France, does not face the same regime today.

Uneven does not mean exempt. Our assessment is that a group with operations in Ireland, Spain or France should plan on the basis that national laws will arrive, probably with little transition. The Commission’s action raises the cost of delay for those governments.

Timing risk sits with the group. The incident clock described by McDermott for the German act (early warning within 24 hours, notification within 72 hours, final report within a month) is the pattern the directive sets. A group with entities in several states may face different regulators, portals and wording for the same incident.

Questions to Put to Management

  • Which of our legal entities fall under NIS2 in which country, and who made that determination?
  • For countries without a law, what is our working assumption and trigger for moving from planning to compliance?
  • Does one incident process produce notices for every regulator that could apply, at the 24, 72 and one-month marks?
  • Who is the named accountable executive in each jurisdiction, and has the board received the training the national rules expect?
  • Are supplier contracts written to the directive standard, so they do not need reopening country by country?

A Note on the Proposed Changes

The Commission has also proposed targeted amendments to NIS2. Its NIS2 policy page says the 20 January 2026 proposal aims to ease compliance for 28,700 companies, including 6,200 micro and small enterprises. The Record reports that the amendments address issues which officials have said contributed to delays. These are proposals, not law. We would not defer governance work to wait for them.

Our Assessment

The referral does not change what a well-run programme should do. It does remove the comfort of assuming that the countries without a law are a safe place to be slow. Build one incident and governance process to the directive standard, then adapt it by country as laws land. We found no official statement, in the sources reviewed as of 6 November 2026 (The Record, the Commission’s NIS2 policy and transposition pages, McDermott), of a date by which Spain or France will notify transposition.

References