Only two EU countries meet NIS2 deadline

Only Belgium has fully implemented directive with mere days left to comply

Pro

Image: Marco via Pexels

Only Belgium and Croatia have formally notified the European Commission of their compliance with the updated cyber security regulations for critical entities. This notification comes a week before the deadline set for all 27 EU member states. A Commission spokesperson confirmed this, saying that Belgium has fully implemented the Network and Information Security Directive 2 (NIS2), while Croatia has only partially done so.

The remaining countries have until 17 October to implement NIS2, which was adopted in 2022 to protect critical sectors such as energy, transportation, finance, water and digital infrastructure from major cyber attacks. In March, Croatia was the first and only country to announce the partial transposition to the Commission.

The revised directive aims to increase cyber security resilience across Europe in response to increasing digitalisation and changing threats. The previous NIS1 directive, introduced in 2016, proved inadequate to increase EU companies’ cyber security resilience and promote joint crisis management.

NIS2 requires companies to issue alerts within 24 hours and incident reports within 72 hours following significant operational disruptions caused by cyber incidents. Non-compliance can result in large fines of up to €10 million or 2% of global revenue, whichever is higher.

A recent report by the French Joint Parliamentary Committee on Digital & Postal Affairs highlighted the lack of awareness among companies about NIS2 requirements. The committee, which held consultations with stakeholders such as cyber security officers, software developers and cloud associations between March and May, concluded that the transposition deadline poses significant challenges for entities that are just coming under the directive.

The report highlights that many of these new entities are unaware of the necessary measures and criteria required to assess their compliance. In addition, it notes that the bill has yet to be submitted to the Council of Ministers, creating uncertainty about its future as the deadline approaches.

Business AM

Read More: EU European Union NIS2