Commission starts procedures for Cyprus and others on cybersecurity, critical infrastructure directives

A large number of member states, including Cyprus, have been given two months to transpose to national law two directives on cybersecurity and the protection of critical infrastructure, whose transposition deadline expired recently, according to a decision by the European Commission.

Published on 28 November, the special infringement package focused on the absence of communication by Member States of measures taken to transpose EU directives into national law, includes sending letters of formal notices to these member states. This is the first stage in the EU’s infringement procedure that could end with the Commission taking the case to the Court of Justice of the EU.

In this case, the letters are sent to member states who have not yet notified full transposition measures for two EU directives in the field of digital economy and migration, home affairs and security union.

Member states now have two months to reply to the letters of formal notice and complete their transposition, or the Commission may decide to issue a reasoned opinion, the second stage in the process, right after the possibility of appeal to the CoJ.

Firstly, the Commission begins infringement procedures against 23 member states for their failure to fully transpose the NIS2 Directive (Directive 2022/2555), which aims to ensure a high level of cybersecurity across the EU. Letters have been sent to Bulgaria, Czechia, Denmark, Germany, Estonia, Ireland, Greece, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, Malta, Netherlands, Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland and Sweden.

Member states had to transpose the NIS2 Directive into national law by 17 October 2024. The NIS2 directive covers entities operating in critical sectors such as public electronic communications services, ICT service management, digital services, wastewater and waste management, space, health, energy, transport, manufacturing of critical products, postal and courier services, and public administration.

Full implementation of the legislation is key to further improving the resilience and incident response capacities of public and private entities operating in these critical sectors and the EU as a whole, the Commission notes.

Secondly, the Commission begins infringement procedures for 24 Member States, for failing to notify national measures transposing the Directive (EU) 2022/2557 on the resilience of critical entities (CER Directive). These member states are Belgium, Bulgaria, Czechia, Denmark, Germany, Greece, Spain, France, Croatia, Cyprus Latvia, Lithuania, Luxembourg, Hungary, Malta, the Netherlands, Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland and Sweden.

Member states had to transpose the CER Directive by 17 October 2024. The directive repeals the Council Directive (2008/114/EC) on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection. The new Directive shifts the approach from the protection of critical infrastructure to enhancing the resilience of the entities operating that infrastructure, while expanding the sectoral scope from 2 to 11 sectors.

Also, the directive ensures the provision of vital services for our society and our economy in key sectors such as energy, transport, health, water, banking and digital infrastructure, by strengthening the resilience of critical infrastructure and critical entities against a range of threats, including natural hazards, terrorist attacks, insider threats, or sabotage.

(Source: CNA)