On 7 May 2025, the European Commission sent a reasoned opinion to 19 member states for failing to transpose the NIS2 Directive fully into national law. The countries have two months to respond and take the necessary measures; otherwise, they face referral to the European Court of Justice. The Commission is working closely with the EU Agency for Cybersecurity, ENISA, on transposition.

Other EU digital initiatives are also under way: a call for expressions of interest on cellular capabilities for detecting dual-use drones, a focus on digital skills gaps, and the fifth EU-Ukraine Cyber Dialogue.

Key points:

• Together with the EU Agency for Network and Information Security, the Commission is working closely with member states to ensure that the NIS2 Directive is transposed into national law.
• On 7 May 2025, the European Commission sent a reasoned opinion to 19 member states (Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, the Netherlands, Austria, Poland, Portugal, Slovenia, Finland and Sweden) for failing to transpose the NIS2 Directive fully.
• The 19 member states have two months to respond and take the necessary measures.

Source: EU Commission — NIS2 Transposition Tracker (German)