NIS2
COMPLIANCE
CYBERSECURITY
NIS2: France referred to the Court of Justice of the European Union for failing to transpose the directive
France is being pursued before the Court of Justice of the European Union for failing to transpose NIS2. Financial sanctions are now at stake.
France postponed transposition several times: taken off the parliamentary agenda, deprioritised in favour of other emergencies… And Spain, Ireland and the Netherlands did the same.
Except that on 8 July 2026, the European Commission decided to get tougher. The four countries have been referred to the CJEU.
Nothing has been ruled yet, but financial sanctions are being requested (there is talk of several million, even tens of millions).
The truth is that NIS2 rests on 57 compliance points. That means months of work requiring time and money from a company.
It is easy to see why it is dragging on.
Except that the purpose of this European framework is to make things secure and more resilient. Being demanding in this area is necessary to prevent situations such as the data leak at the DGFiP, the French tax authority, from happening again.
And having to adapt all your processes is a situation companies have already faced with GDPR.
So if you are wondering whether you will have to do it, the answer is yes, it is only a matter of months.
Those who wait for the fine before moving will pay twice: the penalty payments, and the ground lost to those who will have structured their approach in advance.
You might as well make it an asset rather than a liability.
This news was first published on LinkedIn. To comment or share it, head to the original post. → See the post