EU takes Ireland, Spain, France, and Netherlands to court over delayed cybersecurity law implementation

The European Commission has filed legal referrals at the EU's top court against Ireland, Spain, France, and the Netherlands for failing to implement the NIS2 Directive — the bloc's flagship cybersecurity law for critical infrastructure. The four member states are more than 20 months late in transposing the directive, which sets minimum security standards for hospitals, energy networks, transport operators, and public administrations. The Commission is asking the Court of Justice of the European Union to impose lump sum and ongoing daily financial penalties until compliance is achieved.