Loading story…
The European Commission has referred France, Ireland, Spain and the Netherlands to the Court of Justice of the European Union for failing to transpose the NIS2 Directive into national law more than 20 months after the deadline. Brussels is seeking both lump-sum and daily financial penalties until each country formally notifies full implementation of the cybersecurity law, which expands security and incident-reporting obligations across 18 critical sectors and sits at the center of the EU’s wider cyber regulatory framework.
In France, the enforcement action follows another delay in parliamentary review of the national transposition bill, with examination now expected in September rather than July despite the measure being treated as a government priority. The French debate has also been complicated by a disputed provision, article 16 bis, which would protect end-to-end encryption and has drawn criticism from the parliamentary intelligence delegation over concerns it could restrict access to protected data, while ANSSI continues operational preparations through preregistration work and a new agreement with the Banque de France and the ACPR.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
The European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to transpose NIS2 into national law. It is seeking lump-sum and daily financial penalties until full implementation is formally notified.
The references state that Ireland, Spain, France, and the Netherlands had still not transposed the NIS2 Directive more than 20 months after the deadline, establishing that the implementation deadline had already passed without full national transposition.
While legislation remained delayed, ANSSI continued implementation preparations, including a pre-registration process and a new agreement with the Banque de France and the ACPR.
France again postponed parliamentary examination of the bill transposing the EU NIS2 directive. Review, initially expected in July, was now hoped for in September, despite the bill being described as a government priority.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The NIS2 Directive has introduced new, binding cybersecurity requirements for organizations across the European Union, emphasizing that cybersecurity is a core business risk requiring executive-level oversight. The directive mandates enhanced risk management, supply chain security, incident response, and reporting measures, as well as increased management accountability. In Spain, NIS2 became binding in January, prompting organizations to adopt modern security technologies and integrate comprehensive strategies to protect sensitive data and ensure regulatory compliance. Industry leaders highlight the need for systematic approaches to compliance and stress that IT risks must be managed as business risks under the new regulatory landscape.
Jun 29, 2026
The **EU Council** imposed sanctions on **three entities and two individuals** over cyberattacks targeting EU member states and partners. The measures include **asset freezes**, a ban on EU persons and companies providing funds or economic resources to those listed, and **travel bans** for the individuals. The action expands the EU cyber sanctions regime to **19 individuals and 7 entities**, underscoring a coordinated response to persistent malicious cyber activity affecting Europe. The sanctioned parties include China-based **Integrity Technology Group**, which the Council said provided products used to compromise devices in EU member states and worldwide, contributing to the hacking of **more than 65,000 devices across six member states** between 2022 and 2023. Also listed were **Anxun Information Technology** and its two co-founders for providing hacking services targeting **critical infrastructure and critical functions** in member states and third countries. The Iranian company **Emennet Pasargad** was sanctioned for accessing a **French subscriber database** and offering it for sale on the dark web, compromising **advertising billboards** to spread disinformation during the **2024 Paris Olympic Games**, and breaching a **Swedish SMS service** affecting a large number of EU citizens.
Jun 29, 2026
The European Commission unveiled a revised **EU Cybersecurity Act** proposal that would allow the bloc to identify and potentially exclude **“high-risk” suppliers**—including those deemed vulnerable to *third-country influence*—from critical digital infrastructure across **18 essential sectors**. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and **geopolitical** risk-management issue. Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around **network equipment** and connected energy technologies such as **solar inverters** that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand **ENISA’s** mandate, including closer operational cooperation with national authorities to help counter threats such as **ransomware**, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.
Jun 29, 2026