0:00
0:00
EU Lags in Executing Essential Cybersecurity Directives
Only seven of the twenty-seven EU member states have completely implemented the NIS2 directive, leading to infringement actions and urgent appeals for adherence.
The European Commission has disclosed that only seven out of the twenty-seven EU member states have fully implemented the Network and Information Security Directive Two (NIS2) aimed at protecting crucial entities, following an October deadline.
A representative from the Commission confirmed that Belgium, Italy, Croatia, Romania, Slovakia, Lithuania, and Greece have successfully enacted the national regulations, while six other nations—Latvia, Germany, Czechia, Austria, Denmark, and Poland—have only partially adopted the measures.
As of October, only Belgium and Croatia were prepared to enforce NIS2, which was sanctioned in 2022 to protect essential sectors like energy, transport, banking, water, and digital infrastructures from significant cyber incidents.
During a discussion in the European Parliament in Strasbourg on Thursday, European Commissioner Glenn Micallef, overseeing intergenerational fairness, youth, culture, and sport, urged member states to hasten the transposition of NIS2 along with the Critical Entities Resilience Directive, intended to maintain continuity of vital services during hybrid crises, including recent cyberattacks on undersea cables in the Baltic Sea.
Commissioner Micallef noted that progress has been “still slow” and stressed the need for immediate action.
In November, the Commission launched infringement procedures by sending formal notices to member states that missed the deadline, allowing countries until late January to reply.
The Commission is currently assessing these responses and may take additional steps.
The Dutch government, which also did not meet the deadline, informed parliament in a letter that the rules are anticipated to take effect in the third quarter of 2025.
The NIS2 directive, an enhancement of the previous NIS1, seeks to tackle the changing cybersecurity challenges amid rising digitization.
According to NIS2, companies must issue a warning within twenty-four hours and file an incident report within seventy-two hours for any occurrences that lead to serious operational disruptions.
Failure to comply can result in penalties of up to ten million euros or two percent of global revenue, whichever amount is greater.
A representative from the Commission confirmed that Belgium, Italy, Croatia, Romania, Slovakia, Lithuania, and Greece have successfully enacted the national regulations, while six other nations—Latvia, Germany, Czechia, Austria, Denmark, and Poland—have only partially adopted the measures.
As of October, only Belgium and Croatia were prepared to enforce NIS2, which was sanctioned in 2022 to protect essential sectors like energy, transport, banking, water, and digital infrastructures from significant cyber incidents.
During a discussion in the European Parliament in Strasbourg on Thursday, European Commissioner Glenn Micallef, overseeing intergenerational fairness, youth, culture, and sport, urged member states to hasten the transposition of NIS2 along with the Critical Entities Resilience Directive, intended to maintain continuity of vital services during hybrid crises, including recent cyberattacks on undersea cables in the Baltic Sea.
Commissioner Micallef noted that progress has been “still slow” and stressed the need for immediate action.
In November, the Commission launched infringement procedures by sending formal notices to member states that missed the deadline, allowing countries until late January to reply.
The Commission is currently assessing these responses and may take additional steps.
The Dutch government, which also did not meet the deadline, informed parliament in a letter that the rules are anticipated to take effect in the third quarter of 2025.
The NIS2 directive, an enhancement of the previous NIS1, seeks to tackle the changing cybersecurity challenges amid rising digitization.
According to NIS2, companies must issue a warning within twenty-four hours and file an incident report within seventy-two hours for any occurrences that lead to serious operational disruptions.
Failure to comply can result in penalties of up to ten million euros or two percent of global revenue, whichever amount is greater.
AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.
