NIS2 CJEU referral (France, Spain)

European Commission refers France and Spain to the CJEU over NIS2 non-transposition

The week's most consequential regulatory move. The Commission referred France and Spain to the Court of Justice of the EU on ~9 June — the third and final stage of the infringement procedure — for failing to transpose NIS2 (Directive 2022/2555) more than 19 months past the October 2024 deadline (Brussels Signal). The CJEU can impose lump-sum fines and daily penalties until transposition completes. What defenders need to do differently: entities in non-transposed states operate in a legal grey zone — NIS2's substantive Article 21 security measures and Article 23 reporting windows apply as the floor even where the national implementing law and its competent authority do not yet exist. Swiss federal agencies and cantonal governments with regulated counterparts or outsourced providers in France or Spain should treat NIS2 Article 21 as the baseline regardless of national enforcement status, and watch the remaining non-transposers for the same escalation.