One of the four NIS2 court referrals has been dropped. The register says which, and which three are still live
· Cryptaguard · 6 min read
On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice over NIS2. Its own register now records the Dutch file closed on 1 October 2026. The other three referrals are still active — and so are five cases against member states whose transposition law is already in force.
What the register records
The July referral was reported everywhere. Four member states, one directive, a request that the Court impose a lump sum and daily penalties. What has not been reported is that one of the four files is shut. We went to the Commission's own register of infringement decisions rather than to a tracker, queried the twenty-three NIS2 non-communication cases one by one, and read what each carries. The Dutch case holds four decisions.
- Letter of formal notice, 27 November 2024.
- Reasoned opinion, 7 May 2025.
- Referral to the Court of Justice under articles 258 and 260(3) TFEU, 8 July 2026.
- Closing of the case, 1 October 2026.
The same record marks the case as no longer active. The title is unambiguous about what the case was for.
Lack of transposition of Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union by the NetherlandsEuropean Commission register of infringement decisions, read 10 October 2026
The Dutch Cyberbeveiligingswet entered into force on 15 August 2026, five weeks after the referral. The closure follows that, and follows the transposition notice the Ministry of Justice and Security published in the Staatscourant on 16 July 2026. Our Netherlands country page had left this question open in as many words; it is now answered.
Three referrals are still live
This is the part to take away if you take away one thing. The other three July referrals are untouched. Spain in INFR(2024)0270, France in INFR(2024)0274 and Ireland in INFR(2024)0279 are all still marked active, each carrying the referral decision of 8 July 2026 and no closing decision. None of the three has a transposition law in force, and in all three the political route has if anything narrowed since July: the Spanish Cortes were dissolved on 6 October, the French loi resilience was pulled from the Assemblee's order of business for 7 October, and the Irish National Cyber Security Bill had still not been published three weeks into the autumn session it was prioritised for.
So the right reading of the Dutch closure is not that the Commission is softening. It is that the Commission closes a file when the member state has given it something to accept.
The 1 October wave
The Dutch closure was not alone. Four NIS2 cases carry a closing decision dated 1 October 2026: Bulgaria in INFR(2024)0257, Hungary in INFR(2024)0277, the Netherlands in INFR(2024)0288 and Poland in INFR(2024)0290. Only the Dutch one had reached the Court. Bulgaria's closure was announced independently by its own ministry that same day, which is a useful external check on the date: two sources, arrived at separately, agree.
That brings the running total to fifteen of the original twenty-three NIS2 cases closed — Greece and Lithuania in February 2025, Cyprus, Malta, Romania and Slovakia in October 2025, Denmark, Latvia and Slovenia in January 2026, Czechia and Luxembourg in July 2026, and these four. Austria, Belgium, Croatia and Italy never received a letter at all.
Five open cases against states whose law is in force
Eight NIS2 cases are still active, and the list is not the one a reader would guess. Spain, France and Ireland, yes. But also Germany in INFR(2024)0263, Estonia in INFR(2024)0267, Finland in INFR(2024)0272, Portugal in INFR(2024)0292 and Sweden in INFR(2024)0296 — five member states whose transposition law has been in force for months. Germany since 6 December 2025. Estonia since 1 January 2026. Finland since 8 April 2025. Portugal since 3 April 2026. Sweden since 15 January 2026.
Resist the obvious conclusion, because the register does not support it. An active case means that the register holds no closing decision for it. It does not mean the Commission disputes the transposition, and the Bulgarian timeline shows exactly how large the administrative gap can be without anything being in dispute: entry into force on 17 February 2026, notification of full transposition on 6 March 2026, closure on 1 October 2026. Nearly seven months between a complete notification and the decision that accepts it. On that scale, an open case against Portugal six months after its law took effect is a file being read, not a quarrel.
The limit of this finding
We are reporting what one register records on one named date, and we are reporting it narrowly. The Dutch file carries no Court of Justice case reference, so nothing here says the Court has struck the action out — what is established is the Commission's decision to close. Closing decisions also carry no press release or memo reference, unlike the 8 July referral, which has both. If you look for a Commission press release announcing these closures you will not find one, and its absence proves nothing either way.
One case series is not the other
A guard worth putting in writing, because the two get conflated constantly. The same register also holds cases over Directive (EU) 2022/2557 on the resilience of critical entities, and they run on their own clock. Luxembourg is the clean example: its NIS2 case was closed on 8 July 2026, while its critical entities case remains active, referred to the Court on 29 April 2026 with a deferral decision recorded on 8 July. A member state in the clear on NIS2 can still be in court over CER. If someone tells you a country is "cleared", ask which directive they mean.
What this changes for an entity
Nothing about what you owe, and that is the point worth being blunt about. An infringement procedure is between the Commission and a member state. Your obligations come from the national transposition law, and in the Netherlands they have been owed since 15 August 2026 — through the referral, and now through the closure, without either moving them by a day.
What it changes is how you read a tracker. A closed file tells you the Commission accepts that the directive is in national law. It tells you nothing about whether the national regime is operable: whether the measures regulation has been published, whether the register is open, whether your sectoral supervisor has been designated. Bulgaria closed its file on 1 October and the regulation carrying its risk-management measures is still the 2019 text. Those are different questions, answered by different instruments, and only one of them is answered in Brussels.
- The NIS2 case against the Netherlands, referred to the Court of Justice on 8 July 2026, was closed by a Commission decision of 1 October 2026. It is the only one of the four July referrals to be dropped.
- Spain, France and Ireland remain active and still carry their 8 July referral. None of the three has a transposition law in force.
- Eight of the twenty-three NIS2 cases are still open, five of them against member states whose law is already in force: Germany, Estonia, Finland, Portugal and Sweden.
- An open case means the register holds no closing decision, not that the Commission disputes the transposition. Bulgaria took nearly seven months from notification to closure.
- Closure says the directive is in national law. It says nothing about whether the national regime is operable, and nothing about what you owe — that comes from the national law either way.