The EU Commission is putting pressure on the member states to implement safety directives. According to the Brussels-based authority, 26 member states have not yet notified the full implementation of two EU directives in the areas of digital economy and migration, home affairs and the security union, including Germany.
These are the NIS 2 Directive for a higher level of cybersecurity and the Critical Facilities Resilience Directive (CER Directive). In both cases, the implementation deadline expired on 17 October 2024.
Draft laws already in the Bundestag
In the case of the NIS 2 Directive, a draft law has already been drafted, which was already discussed in the Bundestag’s Committee on Internal Affairs at the beginning of November 2024 (g+). In the hearing, however, most experts called for significant improvements, which the members of parliament still had to agree on. The extent to which an agreement will be possible therefore seems unclear.
The better protection of critical infrastructure has also already been decided by the cabinet. The so-called Kritis umbrella law provides for uniform rules for the protection of energy companies, airports and other large infrastructure facilities. The draft (PDF) has now been submitted to the Bundestag.
Greens call for quick agreement
In view of the infringement proceedings and the high security risks, the Greens demanded that the laws be passed before the Bundestag elections. “Together, we have a responsibility to make Germany more resilient to extremely serious threats,” said Green parliamentary group vice-chairman Konstantin von Notz and Misbah Khan, member of the interior committee, the Handelsblatt (paywall). Above all, the Union is called upon to behave clearly.
The two politicians demanded: “In view of the now openly aggressive actions of authoritarian countries such as Russia and China, we must increase the defensiveness of our society as quickly as possible.”
In an infringement procedure, the EU Commission first sent letters of formal notice to the Member States concerned, which must respond within two months, complete the implementation of the Directive and notify the Commission of the relevant measures. If the procedure is unsuccessful, the Commission can turn to the European Court of Justice (ECJ) and demand financial sanctions against the country.
