On 21 September 2026, the European Court of Auditors published special report 19/2026, entitled "The EU's cyber defence is only partially effective". Its central finding is precise: in 2025, only seven Member States formally notified 14 cross-border incidents to ENISA and to the countries concerned, while the agency itself had recorded 322 incidents affecting at least two Member States (source: special report 19/2026, European Court of Auditors, 21 September 2026). The gap between operational reality and official notification flows is roughly twenty to one.
What the report measures
The report is based on an audit of the European Union's cyber cooperation framework over the 2021-2025 period. The Court examined the functioning of the NIS2 Directive, of the Digital Europe Programme, which has a budget of EUR 1.4 billion for cybersecurity over the 2021-2027 period (source: special report 19/2026), as well as the operational structures: CyCLONe, ENISA and the network of national CSIRTs.
Two findings stand out from the audit. The first: only two of the twenty-seven Member States met the October 2024 deadline for transposing NIS2 into national law. France is among the late States, with a referral to the CJEU pronounced on 8 July 2026. The second: even in countries where NIS2 has been transposed, the effective notification of cross-border incidents remains marginal. Organisations notify their national authority. The escalation to ENISA and the other affected Member States does not follow.
European aviation: a real-scale test that failed
The report cites a revealing incident. In autumn 2025, a cyber attack caused cascading disruption to European air traffic. Germany, Belgium and Ireland were among the affected countries. None of the three activated the European coordination provided for under NIS2. CyCLONe, the liaison network of national competent cybersecurity authorities, was not put on alert.
This was not an isolated human failure. It is the symptom of an incomplete architecture. The report notes that the European cyber alert system was not yet operational at the time of the audit. Technical cooperation agreements between structures had not been finalised. The responsibilities between the Commission's Cyber Situation Centre and ENISA remained unclear, with documented overlaps. In a real incident, "a technical alert becomes a permissions problem", the report summarises.
Why entities notify so little at European level
Three factors explain the gap between 14 formal notifications and the 322 incidents recorded by ENISA.
The first is structural. NIS2 entities notify their CSIRT or national competent authority. Escalation to ENISA is an additional step, borne by national authorities. If these authorities do not relay, ENISA receives nothing. No mechanism guarantees automatic transmission.
The second is legal. Some Member States have national security laws that restrict the sharing of incident information between countries. NIS2 has not yet produced harmonisation on this point. An incident affecting critical infrastructure may be covered by national defence secrecy in one State, and freely shareable in another.
The third is operational. Entities themselves often do not know whether the incident they are experiencing has a cross-border dimension. They discover the extent of the compromise over weeks, not hours. The early notification required by NIS2 (24 hours for the initial alert) often precedes the full qualification of the incident. The operational pitfalls of 24-hour notification are documented: the lack of visibility into cross-border propagation is one of them.
What this changes for your organisation
The temptation is to conclude that, since intergovernmental cooperation does not work, the notification requirements are theoretical. The opposite is the lesson to take away.
The European escalation mechanism is failing, but national authorities remain active. Since the REACTIV mechanism, ANSSI has powers to impose immediate measures. The French data protection authority (CNIL) oversees data breaches. These two channels operate independently of the cross-border cooperation system. Notification to the national authority remains mandatory and enforced.
The second consequence concerns threat intelligence. The report confirms that you cannot rely on automatic sharing of information about incidents affecting other organisations in other Member States. The 322 incidents recorded by ENISA are not public in detail. Your security teams work with a structural information deficit on cross-border incidents. This strengthens the case for complementary intelligence flows, sectoral or commercial, to compensate for the absence of an effective public system.
Three practical adjustments
First adjustment: do not build your notification deadlines on the assumption that other organisations affected by the same vector will have alerted the authorities before you. The cooperation mechanism does not guarantee this. Your obligation starts the moment you become aware of the incident, regardless of what other affected entities have done.
Second adjustment: if your activity exposes you to cross-border risks, for example because your systems process data or flows for entities in several Member States, include a step assessing the cross-border dimension in your incident playbook. This assessment determines the notification obligations that apply, which vary according to the affected countries.
Third adjustment: the report highlights the absence of a single reporting system for incidents falling under several regimes. The proposed single entry point, carried by the Commission's digital simplification regulation, is not yet operational. In the meantime, map the notification obligations that apply to your organisation under the active regimes (CRA, NIS2, GDPR) and identify the most demanding deadlines for each. A single incident can trigger several obligations in parallel, with different recipients and different deadlines.
What the report recommends
The European Court of Auditors makes four recommendations to the Commission. Strengthen coordination to avoid duplication between ENISA and the Cyber Situation Centre. Examine the possibilities for joint acquisition and analysis of information between institutions. Ensure that the future single reporting entry point makes it possible to identify cross-border incidents. Strengthen ENISA's capacity for detection and incident response.
These recommendations are addressed to the European institutions. Their implementation will take years. For your teams, the practical conclusion is immediate: notify as if intergovernmental cooperation did not exist. In practice, it does not yet truly exist.