The EU's NIS2 regime reached full enforcement force on 1 June1. NIS2 is the bloc's 2024 Network and Information Security Directive, which sets binding cybersecurity duties on critical-infrastructure operators and large firms. From this date, personal fines for management-body members apply at 100% of the statutory maximum in member states that have transposed the directive, with the earlier grace-period discount gone. The liability now reaches named directors, not their organisations alone.
The European Commission has referred member states still untransposed 19 months after the October 2024 deadline to the CJEU (Court of Justice of the European Union), the bloc's highest court2. Those referrals are the enforcement follow-through to the maturity gaps ENISA, the EU cybersecurity agency, flagged when it placed water, rail and waste water in the cyber risk zone and benchmarked member-state readiness. The directors most exposed sit in exactly those laggard, lower-maturity sectors, where boards have had the least time to build the controls the directive now fines them personally for lacking.
Read alongside the UK bill reaching third reading a few sections up, the regulatory direction is the same on both sides of the Channel in a single fortnight: wider duties, sharper penalties, and personal accountability moving up the org chart. The divergence is on the ransomware-payment question, which NIS2 leaves to member states and Westminster has just parked.
