Cybersecurity Policy Report, EU Auditors Identify Flaws in Europe’s Cyber Defenses, (Sep 22, 2026)
European Union nations have been slow to transpose an EU cybersecurity directive into their national laws, creating gaps in the EU’s cyber defenses, according to a report published yesterday by the European Court of Auditors.
The Directive on Security of Network and Information Systems (NIS2) cleared the EU’s legislative branches in 2022. Member states were supposed to transpose its provisions into national laws by October 2024, but only two nations met the deadline, the report noted.
NIS2 covers a broader set of critical infrastructure sectors than its predecessor, NIS1, and requires covered entities to enact baseline cyber defenses and report significant cyber incidents.
“Delays in transposition have a significant impact on information sharing because, in the meantime, the entities covered by the NIS 2 Directive are not legally required to report incidents,” the auditors said.
In July, the European Commission asked the Court of Justice of the EU (CJEU) to impose financial penalties on Spain, France, Ireland, and the Netherlands over their failure to add NIS2 to their national laws (CPR, July 8).
The audit also criticized delays in the implementation of an EU cybersecurity “shield” pursuant to the EU Cyber Solidarity Act. The EU allocated 1.4 billion euros ($1.6 billion) for the cyber shield program, which establishes an EU network of cyber defense agencies that are supposed to share information about cyber attacks.
“The Cyber Solidarity Act requires cross-border cyber hubs to sign cooperation agreements with one another to facilitate information sharing,” the audit noted, but the European Union Agency for Cybersecurity (ENISA) missed a February deadline “for interoperability between cross-border cyber hubs.”
“We conclude that EU actions only partially facilitate the detection of and response to significant and large-scale cybersecurity incidents. While a cooperation framework has gradually been put in place, work is still ongoing towards achieving full set-up,” it said.
“Limited information sharing, reporting weaknesses and considerable implementation delays prevent EU networks and mechanisms from reaching their full potential. Projects pursue relevant objectives, but several face operational challenges and delays. Moreover, there are weaknesses in the overall performance monitoring framework,” it added.
“The EU has made progress in building a cybersecurity cooperation framework, but it is not yet working as effectively as it should,” George-Marius Hyzler, the ECA member in charge of the audit, said in a news release. “When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value.”
News: InternationalLegislation DataSecurity