EU Court of Auditors: cyber-incident cooperation framework only partially effective, cross-border notification failed for the 2025 airport ransomware disruption

The European Court of Auditors published Special Report 19/2026 on 2026-09-22, concluding that the EU's cooperation framework for detecting and responding to cybersecurity incidents (the CSIRTs network, EU-CyCLONe, the Cyber Blueprint, the European Cybersecurity Alert System and the EU Cybersecurity Reserve) is only partially effective. Three structural gaps drive the finding: NIS2 transposition delays ("member states had until October 2024 to transpose the NIS 2 Directive into national law, but only two met the deadline" (European Court of Auditors, Special Report 19/2026, 2026-09-22)); national-security legislation that lets member states withhold incident information with no obligation to share it; and no EU-wide platform to correlate cross-border incidents in real time. As its case study, the report documents that the September 2025 Collins Aerospace ransomware attack on airport passenger-processing systems; "the disruption was most severe at London Heathrow Airport, Brussels Airport, Berlin Brandenburg Airport, and Dublin Airport" (European Court of Auditors, Special Report 19/2026, 2026-09-22), was never classified as "significant" or "large-scale cross-border" under NIS2 by the affected member states, named by heise as Germany, Belgium and Ireland (heise online, 2026-09-22): "no member state treated this incident as being either significant or large-scale cross-border. Therefore, none of the affected member states formally notified ENISA or other member states of the incident. The CSIRTs network did not advise EU-CyCLONe, which therefore did not support the coordinated management of the incident" (European Court of Auditors, Special Report 19/2026, 2026-09-22). EU-wide, "in 2025, only 14 significant cross-border incidents were reported, by seven member states" (European Court of Auditors, Special Report 19/2026, 2026-09-22), and "no cybersecurity incident has been considered 'large-scale' by any member state since 2016", despite events the report itself cites as comparably severe, including WannaCry and NotPetya (European Court of Auditors, Special Report 19/2026, 2026-09-22). The Court's Recommendation 1, targeted for 2027 (information-sharing analysis and cross-border-incident detection) and 2028 (real-time incident reporting), calls for a Commission/ENISA-led review of national-security restrictions on information sharing and progress toward real-time incident reporting to ENISA (European Court of Auditors, Special Report 19/2026, 2026-09-22).

Switzerland sits outside NIS2's scope but is embedded in the same cross-border supply chains (aviation, finance, cloud) the report's case study concerns. The finding that formal EU cross-notification cannot be relied on for early warning is a direct input to how Swiss public-sector CERTs and GovCERT.ch should weight direct primary-source monitoring of national CERTs and vendor advisories against EU cross-notification channels, since a serious incident affecting an EU supply-chain partner may never surface through the formal EU mechanism at all.