EU Lags in Enforcing Essential Cybersecurity Directives

Only seven of the twenty-seven EU member states have completely implemented the NIS2 directive, leading to the initiation of infringement procedures and immediate appeals for compliance.

The European Commission has disclosed that merely seven out of the twenty-seven EU member states have fully implemented the Network and Information Security Directive Two (NIS2) aimed at safeguarding critical entities, following a deadline in October.

A representative of the Commission confirmed that Belgium, Italy, Croatia, Romania, Slovakia, Lithuania, and Greece have completely adopted the national regulations, whereas six other nations, including Latvia, Germany, Czechia, Austria, Denmark, and Poland, have only partially enforced the necessary measures.

By October, only Belgium and Croatia were prepared to apply NIS2, which was approved in 2022 to protect vital sectors such as energy, transportation, banking, water, and digital infrastructures from significant cyber incidents.

During a discussion in the European Parliament in Strasbourg on Thursday, European Commissioner Glenn Micallef, who oversees intergenerational Fairness, Youth, Culture, and Sport, urged member states to hasten the implementation of NIS2 along with the Critical Entities Resilience Directive, which is intended to ensure the uninterrupted provision of essential services amid hybrid crises, including recent cyberattacks on undersea cables in the Baltic Sea.

Commissioner Micallef remarked that progress has been “still slow” and stressed the urgent need for action.

In November, the Commission commenced infringement procedures by issuing letters of formal notice to member states that had not complied with the deadline, granting countries until late January to respond.

The Commission is currently evaluating these responses and may consider further actions.

The Dutch government, which did not meet the deadline, informed parliament in a letter that the regulations are anticipated to take effect in the third quarter of 2025.

The NIS2 directive updates the earlier NIS1 and aims to confront the changing cybersecurity risks in light of increased digitization.

Under NIS2, companies are mandated to issue a warning within twenty-four hours and provide an incident report within seventy-two hours for any instances causing significant operational interruptions.

Failure to comply may lead to fines reaching up to ten million euros or two percent of global revenue, whichever amount is greater.