The European Commission has decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union (CJEU) for failing to notify measures transposing the NIS2 Directive into their national law, which was due to be transposed by 17 October 2024 at the latest. The directive lays down standards aimed at protecting networks and information systems and ensuring a high common level of cybersecurity across 18 critical sectors, notably health, energy, transport and the public sector. The Commission opened infringement procedures against these Member States in November 2024. On 7 May 2025, it sent them a reasoned opinion, granting them an additional two-month period to adopt the necessary measures. In the absence of notification of the transposition measures, the Commission is now asking the Court to impose financial penalties in the form of a lump sum and daily penalty payments, until the directive has been fully transposed. (APH)