European Commission seeks financial sanctions against four EU nations over critical infrastructure failures

The European Commission has advanced referrals requesting financial sanctions against Ireland, Spain, France, and the Netherlands for failing to meet compliance obligations, escalating a regulatory standoff that touches banking, digital infrastructure, and the broader question of how seriously EU member states take their own rules.

What happened and why it matters

On April 28, 2026, the Commission referred Spain, France, and the Netherlands to the Court of Justice of the European Union (CJEU) for failing to transpose the Critical Entities Resilience (CER) Directive into national law. The directive, formally known as Directive (EU) 2022/2557, was supposed to be implemented by October 17, 2024. That deadline came and went without any of these countries adopting a single piece of conforming legislation.

Ireland, meanwhile, is facing its own separate infringement actions related to urban waste water treatment rather than the CER Directive specifically.

Bulgaria, Luxembourg, Poland, and Sweden are also facing similar proceedings, making this a continent-wide reckoning rather than an isolated dustup with a few laggard governments.

The CER Directive and its reach into finance

Under the directive, member states are required to identify critical entities operating in vital sectors, including banking and digital infrastructure, and mandate protective measures against these threats.

The proceedings follow the standard Article 258/260 procedures of the EU treaty, which means the CJEU has the power to impose both lump-sum payments and daily penalties on non-compliant states.

The broader regulatory trajectory

The CER Directive sits alongside a growing constellation of European regulations designed to tighten oversight of financial and digital infrastructure. MiCA, the Markets in Crypto-Assets regulation, went into full effect across the EU in late 2024. The Digital Operational Resilience Act (DORA) targets financial entities’ ability to withstand ICT disruptions. The CER Directive covers the physical and organizational resilience layer underneath all of that.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.