EU refers Ireland, Spain, France and Netherlands to top court over cybersecurity rules

Legal experts note that referrals to the Court of Justice typically represent one of the final steps available to the European Commission when member states fail to comply with EU directives despite repeated formal warnings.

The European Commission announced Wednesday that it will refer Ireland, Spain, France and the Netherlands to the European Union’s highest court after the four countries failed to fully implement cybersecurity rules required under EU law.

According to the European Commission, all four nations have failed to transpose measures required under the NIS2 Directive, which governs the security of information systems and networks across the bloc. The commission said in a statement that the directive strengthens cybersecurity standards across the EU by establishing high requirements for entities operating in 18 critical sectors, including health, energy, transport and public administration.

The commission said implementing these cybersecurity measures remains essential for improving the resilience and incident response capacity of both public and private organizations operating within these critical sectors. Officials emphasized that consistent implementation across member states helps ensure the bloc can respond effectively to growing cyber threats targeting essential infrastructure and services.

The commission sent formal notice letters to the four countries on November 28, 2024, followed by reasoned opinions issued on May 7, 2025. Despite these repeated warnings, none of the four countries notified the commission of complete transposition of the directive into national law, prompting officials to escalate the matter to the Court of Justice of the European Union.

The referrals request that the court impose financial penalties on the four countries, combining a lump sum payment with ongoing periodic fines that would continue until each nation achieves full transposition of the directive. The commission’s decision to pursue financial sanctions reflects growing urgency within the EU regarding cybersecurity preparedness across member states.

This latest action underscores mounting concern within the European Union over the rising risk of cyberattacks targeting both businesses and government institutions across the bloc. Officials have repeatedly stressed that inconsistent implementation of cybersecurity standards among member states creates vulnerabilities that could be exploited by malicious actors seeking to disrupt critical infrastructure or steal sensitive information.

The NIS2 Directive represents one of the EU’s most significant efforts to strengthen collective cybersecurity resilience across the bloc, expanding on earlier legislation to cover a broader range of sectors and impose stricter requirements on organizations handling critical infrastructure and services. The directive requires member states to establish national frameworks for incident reporting, risk management and supervisory oversight within these designated sectors.

Legal experts note that referrals to the Court of Justice typically represent one of the final steps available to the European Commission when member states fail to comply with EU directives despite repeated formal warnings. The process allows the commission to seek financial penalties designed to compel compliance, with fines continuing to accrue until the country in question demonstrates full implementation of the required measures.

The four countries named in Wednesday’s announcement will now need to respond to the referral and work toward completing the necessary legal and administrative steps to bring their national frameworks in line with the directive’s requirements. Officials in Brussels have not indicated a specific timeline for resolution, though the ongoing nature of the periodic penalties sought in the referral is designed to create continued pressure on the affected governments to act quickly.

The commission’s action comes amid a broader push across the European Union to harden digital infrastructure against an increasingly complex threat landscape, as government agencies and private companies alike continue reporting a steady rise in attempted cyberattacks. Officials have repeatedly warned that gaps in any single member state’s cybersecurity framework can create vulnerabilities affecting the broader EU digital ecosystem, given the interconnected nature of modern information systems across borders.

As the case moves through the Court of Justice, other EU member states are likely to watch closely, given the potential precedent it could set regarding enforcement of cybersecurity legislation across the bloc. The outcome may also influence how quickly remaining countries move to finalize their own compliance efforts under the NIS2 Directive, particularly as EU officials continue signaling a strong commitment to enforcing cybersecurity standards uniformly across all member states.