Key facts
- The European Commission is preparing to take France and Spain to the Court of Justice of the EU.
- The legal action stems from the countries' failure to enact national legislation for the EU's NIS2 Directive by the October 2024 deadline.
The European Commission is preparing to take France and Spain to the Court of Justice of the EU over their failure to implement the bloc's cybersecurity legislation by the October 2024 deadline.

The European Commission's legal action underscores the EU's commitment to harmonizing cybersecurity standards across member states, aiming to bolster the resilience of critical infrastructure against increasing cyber threats. Failure to comply could result in significant fines and set a precedent for other member states lagging in implementation.
The European Commission is initiating legal proceedings against France and Spain for their failure to transpose the NIS2 Directive into national law by the October 2024 deadline. This directive, passed in 2022, mandates that operators of critical infrastructure across the EU must strengthen their defenses against cyber threats. The Commission's move to take the countries to the EU's top court signifies an escalation in enforcement efforts to ensure member states comply with bloc-wide regulations. While the Commission has sent reminders, both France and Spain have yet to fully implement the necessary legislation, with France reportedly planning to combine the NIS2 law with another critical infrastructure law, a bill that has faced delays. The Commission may propose financial penalties as part of these infringement procedures.
Pick the topics you care about. Get only what matters, on your cadence.