THE ESSENTIALS IN BRIEF<\/p>\n
- \n
- Infringement is now tangible.<\/strong> Following warning letters and a reasoned response, EU Court proceedings including a sanctions request are now underway.<\/li>\n
- DE is not the defendant state.<\/strong> Operationally relevant remains the German implementation and registration situation – plus subsidiaries and suppliers in the four states.<\/li>\n
- Board-Framing changes.<\/strong> \u201cWe are still waiting for the law\u201d is no longer a credible risk argument in multi-state setups.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>What is KRITIS? Operators, duties and thresholds<\/a> \/<\/span> NIS2 hits CLOUD Act: Third\u2011state gap<\/a><\/p>\n
What the Commission has actually done<\/h2>\n
What is the NIS2 lawsuit before the CJEU?<\/strong> The European Commission has taken Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union (CJEU) because they failed to notify the full implementation of the NIS2 Directive by the deadline of 17 October 2024. A lump sum and a penalty fee have been requested against the states. The lawsuit does not immediately alter the national obligations for companies.<\/p>\n
In the July 2026 Infringement Package, the Commission refers Ireland (INFR(2024)0279), Spain (INFR(2024)0270), France (INFR(2024)0274) and the Netherlands (INFR(2024)0288) to the Court of Justice of the European Union. Allegation: failure to fully notify national measures transposing the NIS2 Directive (EU) 2022\/2555.<\/p>\n
The procedural path was predictable: a warning letter in November 2024, reasoned opinions in May 2025, and now the final step with a request for financial sanctions (lump sum and penalty fee). The addressees are the member states. The NIS2 fines for operators remain unaffected. The directive imposes high requirements on operators in 18 critical sectors \u2013 from energy and transport to health and public administration.<\/p>\n
For security leadership, the signalling effect is paramount: Brussels is no longer taking a lenient approach. Companies operating in multiple member states will once again receive a patchwork-like compliance map rather than an EU-wide “once and done” solution.<\/p>\n
\n4<\/div>\nMember states before the CJEU over NIS2 implementation<\/p>\n
Source: European Commission, IP\/26\/1499, July 2026<\/p>\n<\/div>\n
What this means for German companies<\/h2>\n
Germany is not one of the four countries in question. This only partially eases the governance narrative. Many DACH groups have important subsidiaries, shared services, or critical suppliers in FR, ES, NL, or IE. The legal situation remains unclear for now. The Netherlands has adopted its Cybersecurity Act on July 7, 2026, which will enter into force on August 15, 2026. Ireland aims to complete the notification by year\u2011end.<\/p>\n
Secondly, the German registration and reporting logic remains the operational lever: impact assessment, registration, reporting chains, management liability. Those who still plan for \u201cNIS2 comes eventually\u201d internally will collide with procurement, insurance, and customer due diligence, which already reflect EU pressure in questionnaires and contractual provisions.<\/p>\n
Thirdly: Multi\u2011country entities need a location matrix rather than a pure DE playbook. Scope, deadlines, competent authorities, and reporting channels differ – even though the directive sets the same framework.<\/p>\n
Board Communication Without the Theater<\/h2>\n
For the management board, a single slide saying \u201cCyber is important\u201d isn\u2019t enough. What\u2019s needed are three clear points: (1) Which entities fall under which national implementations? (2) Which evidence – governance, incident response, supplier oversight – is audit\u2011ready? (3) Which gaps have a deadline and an owner?<\/p>\n
The EU Court referral changes the tone: a delay at the state level is no free pass for the corporate side. Regulators, insurers and large customers read the signal as \u201cimplementation will be enforced\u201d. The sensible response is prioritized gap remediation rather than maximal tool purchasing.<\/p>\n
\nNext 30 Days<\/p>\n
- \n
- ✓<\/span>Scope Matrix DE plus FR\/ES\/NL\/IE subsidiaries and critical suppliers<\/li>\n
- ✓<\/span>Registration and reporting status per entity with owner and date<\/li>\n
- ✓<\/span>Incident Playbook: test 24h\/72h logic against real escalation paths<\/li>\n
- ✓<\/span>Board One\u2011Pager: top\u20113 risks with budget and timeline<\/li>\n<\/ul>\n<\/div>\n
What Security Is Prioritizing Now<\/h2>\n
Technically, the list stays sober: clear asset and dependency visibility, privileged access controls, backup\/restore testing, logging until reportable, vendors with remote access. Organizationally, it includes roles, coverage, and documented decisions by management-exactly what auditors and accounting firms will later ask for.<\/p>\n
Those who already run an Information Security Management System (ISMS) or an ISO\u201127001 (International Organization for Standardization 27001) framework can map NIS2 (the EU’s Network and Information Security Directive) requirements onto it rather than building a parallel universe. Those starting from scratch should begin with scope and reporting chain, not with tool comparisons.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nIs Germany affected by the ECJ lawsuit?<\/strong><\/summary>\n
No as a defendant member state. The German implementation and registration situation, as well as group companies and suppliers in the four defendant states, remain relevant.<\/p>\n<\/details>\n
\nWhat were the four states accused of?<\/strong><\/summary>\n
Incomplete notification of national measures transposing the NIS2 Directive. The Commission is seeking financial penalties before the EU Court of Justice.<\/p>\n<\/details>\n
\nDoes the lawsuit change my German obligations overnight?<\/strong><\/summary>\n
Not automatically. It increases political and regulatory pressure and sharpens the due-diligence expectation in multi-state setups and supply chains.<\/p>\n<\/details>\n
\nWhat should the board see next?<\/strong><\/summary>\n
An entity matrix with scope, deadlines, pending evidence and named owners – plus three prioritized risks with time and budget.<\/p>\n<\/details>\n
\nIs a pure tool upgrade sufficient as an answer?<\/strong><\/summary>\n
No. NIS2 requires controllable governance, reporting obligations, and supply chain oversight. Tools alone prove nothing. Governance provides the proof.<\/p>\n<\/details>\n
<\/p>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/cursor-windows-git-exe-repo-root-code-execution-cover-hero-250x141.jpg\")
<\/span>Editor’s Pick<\/span>Cursor Launches git.exe from Repository Root on Windows<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/legacyhive-windows-eop-poc-nach-patch-tuesday-cover-hero-250x141.jpg\")
<\/span>Editor’s Pick<\/span>LegacyHive PoC Meets Latest Windows Patches<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/joomla-icagenda-balbooa-kev-upload-rce-cover-hero-250x141.jpg\")
<\/span>Editor’s Pick<\/span>Two Joomla Upload Vulnerabilities Added to CISA KEV<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/09\/net-when-ai-agents-travel-data-residency-as-46681309.jpg\")
<\/span>cloudmagazin<\/span>When AI Agents Travel: Data Residency as an Operating Problem<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/09\/net-more-insolvencies-smaller-cases-what-cou-22218328-250x143.jpg\")
<\/span>MyBusinessFuture<\/span>More insolvencies, smaller cases: What counts<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-token-opex-inference-steuert-nicht-das-s-43794747-250x141.jpg\")
<\/span>Digital Chiefs<\/span>Token-OPEX: Inference Controls, Not the Seat Budget<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"The EU Commission sues Ireland, Spain, France, and the Netherlands over incomplete NIS2 implementation. What this means for CISOs.","protected":false},"author":50,"featured_media":22227,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"NIS2 EU court case","_yoast_wpseo_title":"NIS2 Patchwork: Four States Face EU Court","_yoast_wpseo_metadesc":"The EU Commission sues four states for incomplete NIS2 implementation. Implications for groups, subsidiaries, and supply chains.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[259],"tags":[],"class_list":["post-22330","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategie-governance-en"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":22223,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22330","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=22330"}],"version-history":[{"count":2,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22330\/revisions"}],"predecessor-version":[{"id":24273,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22330\/revisions\/24273"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/22227"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=22330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=22330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=22330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} - ✓<\/span>Registration and reporting status per entity with owner and date<\/li>\n
- DE is not the defendant state.<\/strong> Operationally relevant remains the German implementation and registration situation – plus subsidiaries and suppliers in the four states.<\/li>\n