The European Commission has initiated infringement procedures against several EU member states, including Cyprus, for failing to transpose two crucial directives on cybersecurity and critical infrastructure resilience into national law. The directives aim to enhance the security and resilience of critical sectors across the EU.

The Commission has sent formal letters to 23 member states, including Cyprus, for not fully transposing the NIS2 Directive (Directive 2022/2555) by the October 17, 2024, deadline. This directive seeks to establish a high level of cybersecurity across the EU and applies to entities in critical sectors such as: Public electronic communications services, Digital services, Energy and transport, Health and water management, Manufacturing of critical products, Public administration.

The Commission emphasizes that full implementation of the directive is essential to bolster resilience and improve incident response capabilities in these sectors.

Additionally, infringement procedures were initiated against 24 member states, including Cyprus, for failing to notify measures transposing the CER Directive (Directive 2022/2557) by the same deadline. This directive replaces the Council Directive 2008/114/EC and shifts the focus from protecting critical infrastructure to enhancing the resilience of entities operating in vital sectors.

The CER Directive expands its scope to include 11 sectors, such as: Energy, Transport, Health, Water, Banking, Digital infrastructure.

It also strengthens the ability of these entities to withstand threats ranging from natural disasters to cyberattacks and insider threats.

The letters sent to non-compliant member states mark the first stage of the EU’s infringement procedure. Member states have two months to respond and demonstrate compliance. Failure to do so may result in the Commission issuing a reasoned opinion, potentially leading to the case being referred to the Court of Justice of the EU.