BRUSSELS – Even two and a half years after EU countries vowed to enhance cybersecurity requirements across 18 critical sectors, many have failed to adopt the rules into national law, blowing a deadline to comply with the directive.
The rules were supposed to enhance security in key areas such as pharmaceutical manufacturing facilities, government administrative agencies and space infrastructure operators.
But six months after the deadline to put the directive into law came and went on 17 October, a total of 13 countries still have not incorporated the NIS2 cybersecurity directive into domestic legislation as required.
The missed deadline highlights a paradox within the EU: Although protecting the economy from malicious actors online is a political priority for governments, few have taken actual concrete steps to do so.
Efforts have been hindered by challenges such as political instability, skills shortages and concerns that cybersecurity requirements would impose new costs on businesses, harming competitiveness.
Only seven EU countries have fully adopted the directive, while another seven countries have partially done so, a Commission spokesperson told Euractiv. Some only did so after receiving letters of formal notice from the Commission back in November calling on them to act quickly.
It is “incomprehensible and irresponsible” that Member States are lagging behind with the transposition, said Bart Groothuis, a Dutch MEP from the liberal Renew group who previously was NIS2 rapporteur.
Every day of delay “increases our vulnerability” to cyberattacks, Groothuis added.
Sebastijan Čutura, senior manager for the European Cyber Security Organisation (ECSO), told Euractiv that he welcomed the recent developments in Malta and Finland, where laws have been adopted – although the governments have not yet formally notified the Commission.
That means Malta and Finland are not yet counted by the Commission among the countries that have successfully incorporated the directive into national law.
Čutura called the slow overall pace of implementation very concerning.
Among the laggards are Germany and France, the EU’s most populous countries, where political issues have delayed adoption of the directive.
In France, the transposition bill was only tabled by the government after the snap legislative elections of June 2024 and is now being reviewed by the National Assembly.
In Germany, the collapse of the coalition government put the transposition on hold, and is expected to be reintroduced only after the next coalition government takes power, presumably in May.
(bts)