Connect with us

Published

on

Businesses have been working hard to shift their culture internally to ensure they’re taking the threat of cyber breaches and outage incidents seriously.

Andrew Brookes | Image Source | Getty Images

New European Union regulations requiring businesses to bolster their cyber defenses is off to a slow start as many member states have failed to adopt the rules in time to meet a key enforcement deadline, according to research monitoring the progress of the directive.

The EU’s NIS 2 cybersecurity directive sets a high benchmark for companies over their internal cybersecurity systems and practices. It imposes tougher requirements around risk management, transparency obligations and business continuity planning, in the event of a cyber breach.

On Thursday, the new directive officially became enforceable by member states. That means firms have to now ensure their operations are up to scratch with the rules. However, most EU member states have yet to implement NIS 2 in their own respective national laws, meaning that enforcement is likely to be spotty.

Two countries — Portugal and Bulgaria — haven’t begun the transposition process for NIS 2, where directives are incorporated into the national laws of EU member states, according to a tracker tool from internet research organization DNS Research Federation. The governments of Portugal and Bulgaria were not immediately available for comment when contacted by CNBC Wednesday.

“The implementation status varies significantly across the bloc,” Tim Wright, partner and technology lawyer at Fladgate, told CNBC via email.

What is NIS 2?

NIS 2 — or the Network and Information Security Directive 2 — is an EU directive that aims to increase the security of IT systems and networks across the bloc. First proposed in 2020, the law serves as an update to an earlier directive simply called NIS.

NIS 2 expands the scope of its predecessor to address more recent cybersecurity challenges and threats, as criminals have found new ways to hack companies and compromise their sensitive data.

The directive applies to organizations that operate within the EU and provide essential services to consumers, including banks, energy suppliers, health care institutions, internet providers, transport firms, and waste processors.

Watch CNBC's full exclusive interview with Google Cloud CEO Thomas Kurian and Accenture CEO Julie Sweet

Businesses will have a “duty of care” to report and share information on cyber vulnerabilities and hacks with other companies under the new regulation — even if it means owning up to being a victim of a cyber breach.

If a business falls victim to a cyber breach, they’ll have 24 hours to submit an early warning notification to authorities — a stricter timeline than the 72-hour window firms have to notify authorities about a data breach under the General Data Protection Regulation, a separate data privacy law in the EU.

Firms will also have to vet their technology vendors one by one for cyber threats and vulnerabilities.

Will it be effective?

Fladgate’s Wright said that effectiveness of NIS 2 as a regulation will largely depend on consistent implementation and enforcement across EU member states.

“Bad actors may target countries lagging in their NIS2 transposition or look for weaknesses in supply chains, targeting smaller, less-secure vendors and suppliers to gain access to larger, better-protected organisations,” he told CNBC.

Businesses have been working to get their internal processes, controls and broader culture around cybersecurity into shape for years ahead of the Thursday deadline.

Chris Gow, enterprise tech firm Cisco’s EU public policy lead, said that the spotty nature of NIS 2’s implementation has also been “exacerbated by local adaptation of the law.”

This, in turn, is “creating discrepancies that can prove difficult to navigate, especially for smaller organisations with limited resources,” Gow told CNBC in emailed comments.

State-backed cyber attacks are on the rise this year: DXC Technology

He recommended that, rather than being “overwhelmed” by discrepancies in local adaptations of NIS 2, organizations should “identify a common core of security controls and processes that stand them in good stead to both meet and demonstrate compliance at scale.”

What if a company fails to comply?

For “essential” entities like transport, finance and water companies, failure to comply with NIS 2 can lead to fines of up to 10 million euros ($10.9 million) or 2% of global annual revenues — whichever ends up higher.

Meanwhile, “important” businesses — such as food companies, chemicals firms, and waste management services — are looking at fines of up to 7 million euros or 1.4% of their global annual revenues for breaches.

Firms can also face possible suspensions of service if they fail to comply with NIS 2, as well as closer supervision.

“NIS 2 makes it clear – large fines, possible suspension of service and monitoring of compliance are being used as levers to encourage organisations responsible for critical services to pay attention to cybersecurity threats and their response to those,” Carl Leonard, EMEA cybersecurity strategist at Proofpoint, told CNBC.

“A baseline has been set in terms of risk-management and mitigation measures including incident handling, staff training, leadership accountability and many others,” Leonard added.

Continue Reading

Technology

What’s going on at Nexperia? Dutch chipmaker issues urgent plea to its China unit

Published

on

By

What’s going on at Nexperia? Dutch chipmaker issues urgent plea to its China unit

This photograph shows a general view of Nexperia headquarters in Nijmegen on November 6, 2025.

John Thys | Afp | Getty Images

Dutch chipmaker Nexperia has publicly called on its China unit to help restore supply chain operations, warning in an open letter that customers across industries are reporting “imminent production outages.”

Nexperia’s Dutch unit said Thursday that its open letter followed “repeated attempts to establish direct communication through conventional channels” but did not have “any meaningful response.”

The letter marks the latest twist in a long-running saga that has threatened global automotive supply chains and stoked a bitter battle between Amsterdam and Beijing over technology transfer.

“We welcomed the Chinese authorities’ commitment to facilitate the resumption of exports from Nexperia’s Chinese facility and that of our subcontractors, enabling the continued flow of our products to global markets,” Nexperia’s Dutch unit said in the letter.

“Nevertheless, customers across industries are still reporting imminent production stoppages. This situation cannot persist,” they added. The group called on the leadership of Nexperia’s entities in China to take steps to restore the established supply flows without delay.

Chinese company Wingtech, which owns Netherlands-based Nexperia, reportedly hit back on Friday morning. Wingtech accused the firm’s Dutch unit of seeking to strip the firm of its shareholder rights and pushing to establish a non-Chinese supply chain, Reuters reported. CNBC has also contacted Wingtech for comment.

In this photo illustration, the logo of semiconductor manufacturer Nexperia is displayed on a screen.

Vcg | Visual China Group | Getty Images

Nexperia manufactures billions of so-called foundation chips — transistors, diodes and power management components — that are produced in Europe, assembled and tested in China, and then re-exported to customers in Europe and elsewhere.

The chips are relatively low-tech and inexpensive but are needed in almost every device that uses electricity. In cars, those chips are used to connect the battery to motors, for lights and sensors, for braking systems, airbag controllers, entertainment systems and electric windows.

How did we get here?

The situation began in September, when the Dutch government invoked a Cold War-era law to effectively take control of Nexperia. The highly unusual move was reportedly made after the U.S. raised security concerns.

Beijing responded by moving to block its products from leaving China, which, in turn, raised the alarm among global automakers as they faced shortages of the chipmaker’s components.

In an apparent reprieve last week, however, the Dutch government said it had suspended its state intervention at Nexperia following talks with Chinese authorities. It was thought at the time that this could bring an end to the dispute and pave the way for a restoration of normal supply chains.

Rico Luman, senior sector economist for transport and logistics at Dutch bank ING, said it remains unclear how long the situation will last.

“The imposed measures to seize the Dutch Nexperia subsidiary have been lifted, but there are still talks ongoing about restoring the corporate structure and relation with parent company Wingtech,” Luman told CNBC by email.

“It’s not only about supplies of finished chips, it’s also about wafer supplies from Europe to the Chinese entity,” Luman said, adding that companies including Japan’s Nissan and German auto supplier Bosch are among the firms to have warned about looming shortages.

Nissan signage at a dealership in Richmond, California, US, on Friday, June 21, 2024.

Bloomberg | Bloomberg | Getty Images

A spokesperson for the German Association of the Automotive Industry (VDA), which represents Volkswagen, Mercedes-Benz Group and BMW among hundreds of others, warned of elevated risks to supply, “particularly for the first quarter” of 2026.

“In recent weeks, the German automotive industry has largely been able to keep production stable through intensive efforts,” a VDA spokesperson told CNBC by email.

“However, the disruptions in the supply chain for Nexperia parts caused by political intervention have not been fundamentally resolved. Component availability remains uncertain,” they added.

ING’s Luman said the Nexperia situation is somewhat comparable to China’s rare earth export controls.

“The Chinese position appears strong again as European manufacturers are dependent on the supplies. And comparable to the rare earths, it’s not fully transparent which buyer is able to qualify for which chip supplies,” Luman said.

— CNBC’s Annika Kim Constantino contributed to this report.

Continue Reading

Technology

Leonardo unveils ‘Michelangelo Dome’ as Europe looks to bolster sovereign defense systems

Published

on

By

Leonardo unveils 'Michelangelo Dome' as Europe looks to bolster sovereign defense systems

Italian defense company Leonardo has announced plans for an AI-powered shield for cities and critical infrastructure (Leonardo S.p.A. and subsidiaries)

© Leonardo S.p.A. and subsidiaries

Italian defense company Leonardo on Thursday unveiled plans for an AI-powered shield for cities and critical infrastructure, adding to Europe’s push to ramp up sovereign defense capabilities amid rising geopolitical tensions.

The system, dubbed the “Michelangelo Dome” in a nod to Israel’s Iron Dome and U.S. President Donald Trump’s plans for a “Golden Dome,” will integrate multiple defense systems to detect and neutralize threats from sea to air including missile attacks and drone swarms.

Leonardo’s shares were marginally higher Thursday and is up around 77% since January, amid a year of steep rises for defense stocks across Europe as the region’s governments have hiked defense spending. 

The UK’s BAE Systems rose 42.7% since the start of 2025, Germany’s Rheinmetall 148.9% and France’s Thales 63.8%.

Leonardo’s dome will be built on what CEO Roberto Cingolani called an “open architecture” system meaning it can operate alongside any country’s defense systems.

“In a world where threats evolve rapidly and become ever more complex — and where defending is costlier than attacking — defense must innovate, anticipate and embrace international cooperation,” said Cingolani, during an event on Thursday evening.

The company is targeting the project being fully operational by the end of the decade.

Airbus CEO Guillaume Faury told CNBC earlier on Thursday that the protocols to exchange data between countries and teams on the battlefield were still “still quite limited,” adding it could take a decade to build out Europe’s “digital battlefield.”

Europe’s defense push

European governments have rapidly committed to increased defense spending as the U.S., a key ally for the bloc, has previously threatened to reduce financial support in the region

In May the EU announced a 150 billion euro ($173.5 million) programme to provide long-term loans to member states for defense procurement and industrial capacity. NATO members also committed to increasing defense and security spending to 5% by 2035 in June.

Why private investors are pouring billions into Europe's defense tech sector

Leonardo’s unveiling of its new dome system is part of a sector wide move from leading defense primes that’s seeing them shift “investment from standalone hardware to integrated command architectures,” Loredana Muharremi, equity analyst at Morningstar told CNBC. 

“Modern warfare is won by the network that can integrate every platform into one decision cycle,” she said. “The winners will be the contractors that own the network layer, not the metal, which capture recurring upgrades and scale.”

Risks to Leonardo’s dome system include execution delays and “dependency on European procurement cycles,” Meghan Welch, managing director at Brown Gibbons Lang & Company told CNBC.

European primes are also increasingly competing with an emerging class of defense tech startups in the region.

German AI drone startup Helsing raised 600 million euros and doubled its valuation to 12 billion euros in June, the Financial Times reported. Quantum Systems, which also develops autonomous defense tech, announced Friday it has tripled its valuation to above 3 billion euros after a 180 million euro raise.

Continue Reading

Technology

CNBC Daily Open: November hasn’t been kind — or typical — for U.S. stocks

Published

on

By

CNBC Daily Open: November hasn't been kind — or typical — for U.S. stocks

Traders work on the floor at the New York Stock Exchange (NYSE) in New York City, U.S., Nov. 26, 2025.

Brendan McDermid | Reuters

The U.S. stock market was closed Thursday stateside for Thanksgiving Day and will reopen on Friday until 1 p.m. ET.

With approximately just 3 hours of trading left for the month, major U.S. indexes are looking to end November in the red, based on CNBC calculations.

As of Wednesday’s close, the S&P 500 was down 0.4% month to date, the Dow Jones Industrial Average 0.29% lower during the same period and the Nasdaq Composite retreating 2.15%, vastly underperforming its siblings as technology stocks stumbled in November.

Unless there’s a huge jump in stocks during the shortened trading session on Friday stateside — which might not be an unequivocally positive move since it would raise more questions about the market’s sustainability — that means the indexes are on track to snap their winning streaks. The S&P 500 and Dow Jones Industrial Average have risen in the past six months, and the Nasdaq Composite seven.

It will also mark a divergence from the historical norm. The S&P 500 has advanced an average of 1.8% in November since 1950, according to the Stock Trader’s Almanac. And in the year following a U.S. presidential election, it typically rises 1.6%.

But it’s not been a typical post-presidential election year. It’s hard to see the market, in the coming months, or even years, moving according to any historical trajectory.

What you need to know today

U.S. futures are mostly flat Thursday night. The stock market was closed during the day for Thanksgiving in the U.S. Asia-Pacific markets traded mixed Friday. Japan’s Nikkei 225 ticked up in volatile trading after Tokyo inflation came in hotter than expected.

Trump to suspend migration from ‘Third World Countries.’ The U.S. president will also cancel federal benefits and subsidies to “noncitizens” in the country, he said in Truth Social posts on Thursday night stateside. Trump did not specify which countries would be affected.

South Korea imposes sanctions on Prince Group. The Cambodian conglomerate is accused of running large-scale fraud operations across Southeast Asia. The U.S., U.K. and Singapore have also imposed punitive measures on the company.

Russia is ready for ‘serious’ discussions for peace. The U.S.-led framework “can be the basis for future agreements,” Russian President Vladimir Putin said Thursday, as translated by Reuters. He added that the U.S. seemed to take Moscow’s position “into account.”

[PRO] Bank of America doesn’t see much upside for 2026. The S&P 500 should rise by a single-digit percentage point, a slowdown from recent years because one supporting factor will be shrinking, said a strategist from the bank.

And finally…

An operator works at the data centre of French company OVHcloud in Roubaix, northern France on April 3, 2025.

Sameer Al-doumy | Afp | Getty Images

Europe’s slow and steady approach to AI could be its edge

It’s unlikely that Europe will lead in building facilities for AI hyperscalers or for the training of AI — that race is considered all but won — but the general consensus is that it could excel in smaller, cloud-focused and connectivity-style facilities.

Europe has “a lot of constraints, but, actually, the more difficult something is to replicate, the more long-term value what you’ve got has,” said Seb Dooley, senior fund manager at Principal Asset Management.

— Tasmin Lockwood

Continue Reading

Trending