NL facing EU fine for missing deadline to protect vital sectors against hybrid threats
The Netherlands is risking a fine from the European Commission because it missed the deadline to turn a directive for protecting vital sectors into legislation. The European Commission has taken the Netherlands and several other EU Member States to the European Court of Justice over the matter, the Telegraaf reported.
It concerns the Critical Entities Resilience Directive, which the European Commission introduced in 2022 to better protect vital sectors like energy, transport, healthcare, water, banking, and digital infrastructure. The directive obliges countries to take concrete measures against hybrid threats like sabotage, terrorism, criminal infiltration, cyberattacks, and natural disasters.
Member States had until October 2024 to implement these rules nationally. The Netherlands missed that deadline.
The legislation proved complex, given that the directive would cover hundreds of organizations. According to Minister David van Weel of Justice and Security, the Netherlands deliberately opted for a careful implementation because of the complexity of the legislation and the high regulatory burden it would place on organizations.
The Tweede Kamer, the lower house of the Dutch parliament, has since agreed that the rules must oblige companies in vital sectors to take concrete measures and report incidents within 24 hours. But the implementation of these rules remains far out of sight.
The government has yet to actually designate the sectors that will be covered by the legislation. That will happen in the coming period. After that, the designated sector will undergo a comprehensive risk analysis. There is also still uncertainty about exactly which measures organizations will be obliged to take.
The European Commission feels that the Netherlands’ careful implementation is taking too long and has submitted the matter to the European Court of Justice. It will determine whether the Netherlands will be fined.
