Cybersecurity & Resilience
EU Commission takes member states to court over NIS2 — what companies need to know
Key takeaways
- On 8 July 2026 the Commission referred four member states to the CJEU — incomplete NIS2 transposition despite the October 2024 deadline.
- NIS2 duties apply regardless of national delay — firms in affected countries should not rely on “political grace periods”.
- Germany has updated the BSIG — registration, risk management and reporting are operational reality via BSI tools.
- CJEU proceedings can bring lump-sum and daily fines — they increase political pressure but do not change EU directive logic.
- Cross-border operators need country-specific registration and reporting paths — fragmentation remains a risk.
On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for delayed NIS2 transposition. For firms in critical sectors this is a clear signal: compliance and supervision under NIS2 stay top priority — even when individual member states still lag nationally.
This article explains background, procedure and impact on companies — with a view to Germany. Not legal advice.
What the NIS2 Directive requires
NIS2 (Directive (EU) 2022/2555) harmonises cybersecurity across 18 critical sectors — energy, transport, health, digital infrastructure, public administration and more. Core duties:
- appropriate risk management and security measures,
- reporting significant incidents to competent authorities,
- management accountability and training,
- cooperation with CSIRTs and EU crisis mechanisms (EU-CyCLONe).
The transposition deadline for member states was 17 October 2024. NIS2 replaced NIS1 from 18 October 2024 at EU level.
Germany implements NIS2 in the BSIG — overview: NIS2 in Germany and BSI registration deadline.
Why the Commission sues now
For missing transposition the Commission runs infringement proceedings:
- letter of formal notice (November 2024),
- reasoned opinion (May 2025),
- CJEU referral (July 2026) for Ireland, Spain, France, Netherlands.
Rationale: without full national implementation, uniform supervision, registers and enforcement are missing — gaps in European cyber resilience.
The Commission seeks financial sanctions — lump sums and daily penalties until full transposition is notified. That hits governments, not individual firms — but raises political pressure for fast legislation.
Countries in proceedings — business angle
- Ireland / Spain / France: national implementation incomplete — uncertainty on registration and supervision.
- Netherlands: law adopted, formal notification to Commission may still be pending — proceedings may end once notified.
- Germany: BSIG path active — still watch EU-wide fragmentation.
Impact on companies — including in Germany
1. No pause on duties
EU directive logic: duties exist even when a member state transposes late. Firms in reference countries should not defer NIS2 measures — supervision can start nationally before a CJEU judgment once laws are in force.
2. Cross-border complexity
Groups with sites in IE, ES, FR, NL need country-specific applicability and reporting. A German BSIG setup does not replace local registers.
3. Tougher enforcement culture
The case signals EU enforcement intent — alongside the Commission cybersecurity package (January 2026) clarifying NIS2. Supervisors will likely scrutinise compliance more seriously — documentation, management evidence, supply chains.
4. Interface with CRA and exercises
NIS2 covers organisational resilience; the CRA covers products. Exercises such as Cyber Europe 2026 test reporting and crisis chains — programmes should share both regimes and one incident fact base.
Compliance checklist for decision-makers
- Applicability documented (sector, size, special roles),
- BSI registration or local equivalent in each EU country,
- Incident playbooks with reporting deadlines and CSIRT contacts,
- Management trained and evidence archived,
- Suppliers and critical services in risk register — link to industrial readiness for OT.
Common wrong assumptions
- “CJEU case = standstill for us” — wrong on duty content.
- “ISO 27001 is enough” — does not replace BSIG/NIS2-specific evidence.
- “IT security only” — management is jointly accountable.
Supervision outlook
As implementation spreads across the EU, the number of defined supervisory authorities and sanction tools grows. Treat NIS2 as ongoing governance — not a closed 2024/2025 project. People with regulatory and OT experience remain scarce — cybersecurity talent shortage.
Conclusion
The EU Commission takes member states to court over NIS2 because delayed transposition weakens European cyber supervision. For companies that means: plan compliance fully, clarify cross-border registers and reporting paths, take supervision seriously — regardless of CJEU timing. In Germany the BSIG path remains decisive; internationally active operators carry fragmentation risk until all states catch up.
Further reading: Cyber resilience foundations, Cybersecurity board governance. Hiring: Cybersecurity recruitment.
Source
European Commission — NIS2 Directive: securing network and information systems
FAQ
- No. BSIG/NIS2 requirements apply in Germany; the case concerns other member states and underscores EU enforcement intent.
- Check applicability and reporting paths per country — do not blindly copy German BSIG setup. Budget legal advice for group structures.
- Information security officers with regulatory experience, GRC managers and incident leads with CSIRT interfaces — profiles Perfomynd places deliberately.