NIS2 Goes to Court: What the Referral of France, Spain, Ireland and the Netherlands Means

On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union for failing to notify full transposition of the NIS2 Directive. Member states had until 17 October 2024. The Commission has asked the Court to impose financial sanctions: a lump sum and daily penalties until transposition is complete.

The referral follows letters of formal notice sent on 28 November 2024 and reasoned opinions on 7 May 2025.

Does this mean NIS2 does not apply yet in these countries?

Not quite. A directive needs national law before its duties bind companies directly, so the exact obligations in these four countries depend on the final national texts. But waiting is a poor strategy:

• The laws are coming. The referral adds pressure to finish, and national rules will follow NIS2's minimum requirements, including the 24-hour early warning, the 72-hour notification and the one-month final report.
• Cross-border operations already count. A group with entities in member states that have transposed NIS2 is already in scope there.
• Supply chains ask first. Customers that are already in scope are asking their suppliers for NIS2-level security measures in contracts and audits.
• Management accountability is part of the directive. Boards will be expected to approve and oversee cybersecurity risk measures, and that takes time to set up.

What to do while the law catches up

1. Classify yourself. Use the NIS2 sector lists to judge whether you would be an essential or important entity.
2. Build the reporting path. Decide who declares an incident significant, who reports, and to whom. Practise it.
3. Close the detection gap. A 24-hour warning is impossible if significant incidents wait in a queue overnight. Make sure monitoring covers nights and weekends.
4. Keep evidence. Supervisors and final reports need a clear timeline. Logs and audit trails should be retained and searchable.
5. Review suppliers. NIS2 expects you to manage risks from your ICT supply chain.

Our NIS2 and DORA guide covers the deadlines and penalties in detail.

A note for French organisations

ClaireChains is based in Paris, so this one is close to home. France has not yet notified full transposition, but the direction is clear. Organisations that prepare now will spend the transition improving their security, not rushing to meet a deadline.

Claire Security helps with the operational side: 24/7 detection, fast triage and a full audit trail for every investigation, on your own servers.