NIS2: France and three other states referred to the EU Court of Justice

2026-07-08 · Publisher : Commission européenne · Domain : Industry 4.0 & 5.0

The Commission refers France, Ireland, Spain and the Netherlands to the EU Court of Justice for failing to fully transpose the NIS2 Directive, nearly two years after the October 2024 deadline, and seeks financial penalties.

### Background On 8 July 2026, the European Commission decided to **refer Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union** (press release IP/26/1499) for failing to notify full transposition of the **NIS2 Directive** (Directive (EU) 2022/2555) into national law. ### Timeline - **17 October 2024**: transposition deadline. - **28 November 2024**: letters of formal notice. - **7 May 2025**: reasoned opinions. - **20 January 2026**: in a cybersecurity package, the Commission proposes targeted NIS2 amendments for greater legal clarity. - **8 July 2026**: referral to the Court, with a request for financial penalties (lump sum and daily penalties until full transposition). ### Why it matters For French manufacturers, late transposition creates uncertainty: NIS2 obligations (cyber risk management, incident reporting, management accountability) are known, but their national implementation and the supervision timeline remain pending. Waiting is not wise: the substantive requirements are stable, customers and insurers already ask for them, and the Cyber Resilience Act separately imposes its own obligations on equipment makers. ### Key takeaway France is among the last four states without full NIS2 transposition, but in-scope industrial companies should comply without waiting.

Tags : Réglementation, UE, Cybersécurité OT, NIS2, France