Commission Refers Four Member States to Court Over NIS2 Transposition

On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to notify complete transposition of the NIS2 Directive, Directive (EU) 2022/2555. The referral asks for financial sanctions: a lump sum plus daily penalties accruing until each member state notifies complete transposition.

The timeline explains the escalation. The transposition deadline was 17 October 2024. Letters of formal notice went out on 28 November 2024, reasoned opinions followed on 7 May 2025, and the referral is the step after that. NIS2 sets cybersecurity requirements for entities across eighteen critical sectors including health, energy, transport and the public sector.

For companies operating in or selling into those four markets, the practical effect until now has been uncertainty about which national regime applies — to their customers as regulated entities, and to themselves as ICT suppliers to those entities. A referral with penalty requests is a strong signal that the national laws are about to arrive, and probably quickly.

What arrives with them is supply-chain obligation. Article 21(2)(d) requires in-scope entities to manage security in their supplier relationships, which reaches integrators and component vendors through contract terms rather than through direct regulation: your customer becomes obliged to assess you. The questionnaires, the evidence requests and the security clauses follow from that, and they land on suppliers who are not themselves in scope.

This also compounds with the Cyber Resilience Act. The same connected industrial device can sit inside the CRA's product requirements while its operator sits inside NIS2's organisational ones, and the two regimes ask for overlapping but not identical evidence. A supplier who can answer both from one set of documentation is in a considerably better position than one assembling answers per questionnaire.