Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
24JUL

NIS2 fines now reach directors personally

4 min read
18:20UTC

The EU's NIS2 regime reached full force on 1 June, with personal fines for directors now at the statutory maximum and the Commission referring laggard member states to its top court.

← Back to Zimbra zero-click, and a 15-nation replyJump to analysis ↓
TechnologyDeveloping
Key takeaway

NIS2 now fines directors personally at the full rate, with the Commission taking laggard states to court.

The EU's NIS2 regime reached full enforcement force on 1 June 1. NIS2 is the bloc's 2024 Network and Information Security Directive, which sets binding cybersecurity duties on critical-infrastructure operators and large firms. From this date, personal fines for management-body members apply at 100% of the statutory maximum in member states that have transposed the directive, with the earlier grace-period discount gone. The liability now reaches named directors, not their organisations alone.

The European Commission has referred member states still untransposed 19 months after the October 2024 deadline to the CJEU (Court of Justice of the European Union), the bloc's highest court 2. Those referrals are the enforcement follow-through to the maturity gaps ENISA, the EU cybersecurity agency, flagged when it placed water, rail and waste water in the cyber risk zone and benchmarked member-state readiness . The directors most exposed sit in exactly those laggard, lower-maturity sectors, where boards have had the least time to build the controls the directive now fines them personally for lacking.

Read alongside the UK bill reaching third reading a few sections up, the regulatory direction is the same on both sides of the Channel in a single fortnight: wider duties, sharper penalties, and personal accountability moving up the org chart. The divergence is on the ransomware-payment question, which NIS2 leaves to member states and Westminster has just parked.

Deep Analysis

In plain English

The European Union has a cybersecurity law called NIS2, which stands for the Network and Information Security Directive 2. It requires companies that provide important services, including energy, water, hospitals, and financial services, to meet mandatory cybersecurity standards and to report incidents to regulators quickly. Since 1 June 2026, NIS2 reached its full enforcement phase in the countries that have already built the law into their national systems. The key change from 1 June is that individual company directors can now be fined personally alongside their organisations when a serious cybersecurity failure occurs. At the same time, the European Commission has referred the EU member states that have still not written NIS2 into their national law to the EU's highest court, the Court of Justice of the European Union, which can order them to pay financial penalties until they comply. The EU agency for cybersecurity, ENISA, has specifically flagged water companies, railways, and waste water utilities as the sectors with the biggest gap between what the rules require and what they are actually doing.

Deep Analysis
Escalation

Enforcement risk escalating. The 1 June full personal-liability date removes the last formal grace period. CJEU referrals against non-transposing member states signal the Commission will pursue compliance aggressively. First enforcement decisions against individual directors are likely within 12 to 24 months in high-capacity member states.

What could happen next?
  • Consequence

    Individual directors at essential and important entities in transposed NIS2 member states now face personal fines at 100 per cent of the statutory maximum for serious cybersecurity failures, removing the discretionary reduction that applied during the grace period.

    Immediate · Assessed
  • Risk

    ENISA's NIS360 2026 identification of water, rail, and waste water as highest-risk sectors means the first personal-liability enforcement test cases are most likely to come from infrastructure operators with documented maturity gaps rather than from financial-sector incumbents.

    Medium term · Reported
  • Precedent

    The Commission's CJEU referrals for non-transposition, running in parallel with entity-level enforcement in transposed states, create a two-tier NIS2 enforcement environment that may generate competitive disadvantage for firms operating in non-transposing jurisdictions relative to transposed ones.

    Medium term · Reported
Sources:Bitdefender
Mentions:NIS2 →European Commission →CJEU →ENISA →NCSC →GDPR →Luxembourg →Brussels →Westminster →Germany →Network and Information Systems →Singapore →Ireland →France →NIS360 →European Union →
First Reported In

Update #7 · VPN zero-day, no-patch KEV, late Exchange

Bitdefender· 14 Jun 2026
Read original →
Causes and effects
Caused by
ENISA puts water and rail in risk zone
ENISA NIS360 2026's identification of water, rail and waste water as highest-risk sectors provides the enforcement basis underlying the Commission's referral of untransposed member states to the CJEU.
Occurred 28 May 2026
Read story →
ENISA scores NIS2 maturity with NCAF 2.0
ENISA NCAF 2.0's member-state NIS2 maturity benchmarking in April 2026 established the documented readiness gaps the Commission now pursues via CJEU referrals.
Occurred 22 Apr 2026
Read story →
This Event
NIS2 fines now reach directors personally
Cyber accountability now reaches named directors, not their organisations alone, and the enforcement teeth are out.
Different Perspectives
AIVD
AIVD
AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.
CNCERT
CNCERT
China's national CERT was not party to AA26-204A and has previously argued that Western KEV-based advisories conflate demonstrated exploit capability with confirmed breach impact. It is expected to treat this fortnight's coalition-based Russia attribution as a Five Eyes-led exercise rather than an independently verified finding.
Russia
Russia
Moscow has not publicly responded to the AA26-204A attribution naming LAUNDRY BEAR as a Russian state-supported actor behind the Zimbra zero-click chain. Russian officials have consistently denied state involvement in prior Western cyber-attribution advisories, a pattern this fifteen-agency coalition is likely to meet with the same denial.
National Crime Agency
National Crime Agency
The NCA called the Woolwich Crown Court sentencing of Owen Flowers and Thalha Jubair Britain's largest-ever cybercrime prosecution. It expects continued pressure on Scattered Spider's UK-linked membership, alongside City of London Police's push for statutory Cyber Crime Risk Orders.
CISA
CISA
CISA co-led AA26-204A naming LAUNDRY BEAR and added five more flaws to KEV this fortnight, including a three-day Oracle EBS deadline, while absorbing a one-month detection-to-listing gap on FortiSandbox. It expects the risk-tiered BOD 26-04 model to hold even as a proposed $707m FY27 cut threatens the staffing behind it.
UK managed service providers and data centre operators
UK managed service providers and data centre operators
Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.