Brussels Takes Seven Member States To Court Over CER, And The Consequences Land On You

If you are a CISO at a critical-infrastructure organization in Bulgaria, France, Luxembourg, the Netherlands, Poland, Spain, or Sweden, your Critical Entities Resilience (CER) Directive enforcement clock just shortened. On May 7th, 2026, the European Commission referred all seven Member States to the Court of Justice of the European Union for failing to transpose the CER directive more than eighteen months after the deadline.