Europa Posted on 2025-08-12 10:22:00

EU, unprotected from cyber attacks? - Eight EU countries still lack regulations for critical sectors

From Kristi Ceta

EU, unprotected from cyber attacks? - Eight EU countries still lack regulations

Bulgaria, France, Ireland, Luxembourg, the Netherlands, Portugal, Spain and Sweden have not yet adopted cybersecurity rules for critical sectors, almost a year after the European Union's deadline, thus risking legal action.

The Network and Information Security Directive 2 (NIS2), adopted in 2022, aims to protect critical entities, such as energy, transport, banking, water and digital infrastructures, against major cyber incidents. Member states were required to transpose these rules into national legislation by October 17 last year.

The European Commission launched infringement proceedings in May against 19 member states for failing to implement the rules. These countries had two months to take the necessary measures, or face referral to the Court of Justice of the EU. Eleven countries have already complied with their obligations, but the remaining eight risk further action by the Commission.

A spokesperson for the institution said that the Commission is “monitoring the responses of the member states” and that “after the assessment, it will propose either the closure of the procedure or, in the absence of a satisfactory response, the next steps of the infringement procedure.”

Under the Directive, companies must give a warning within 24 hours and submit an incident report within 72 hours in the event of serious disruptions to operations. In case of non-compliance with the rules, companies can be fined up to 10 million euros, or 2% of global revenue, whichever is higher.

In December, the Commission will present an “omnibus” package, aiming to identify reporting obligations in existing digital legislation that could be shortened to reduce pressure on businesses. Cyber rules are expected to be part of this package.

Live TV

Latest news
All news

Most visited