c) Reporting channels Article 13(3) requires Member States to ensure that appropriate reporting channels are made available in order to facilitate the reporting of the offences referred to in Articles 3 to 6 to the competent national authorities. The information provided by HR, IT, IE and PT was not conclusive. Of the remaining Member States, there appear to be different approaches to implementing the reporting channels. Most Member States (BE, BG, CY, CZ, DE, EE, EL, FI, FR, HR, HU, IT, LT, LV, MT, NL, PL, PT, RO, SE, SI, SK and the UK) have notified measures providing for channels to make reporting easier for the person or organisation initially reporting an offence, e.g. the victim of a cyberattack (with the actual reporting channels left unclear by LV). However, other Member States (AT, ES and LU) have provided identical information on the implementation of Article 13(1) and (2), from which it appears that their measures will mainly facilitate the communication between authorities. d) Collection of statistical data According to Article 14 (1) and (2), Member States must ensure that a system is in place for the recording, production and provision of statistical data, at least on the number of offences referred to in Articles 3 to 7 registered by the Member States, and the number of persons prosecuted for and convicted of these offences. Relying on the obtained notifications, most Member States appear to have put in place both legislative and administrative measures to ensure collection of the information, usually on the basis of a general national electronic system. Information from a number of Member States was not conclusive (EL, IE, UK (Gibraltar, Northern Ireland and Scotland)). One reason was that information on the specific offences referred to in the Directive may not be collected separately (BE, DE and SE) or the information collected may not cover all of the offences referred to in the Directive (RO). e) Transmission of statistical data to the Commission Article 14(3) calls on the Member States to transmit the respective statistical data to the Commission. All Member States who notified measures, except for the UK (Gibraltar, Northern Ireland and Scotland) and HU, have confirmed the implementation of either legal or administrative measures or both to ensure compliance with this obligation. For EL, ES, LU and SI, the information provided was not conclusive. 3. Conclusion and next steps The Directive has led to substantive progress in criminalising cyberattacks on a comparable level across the Member States, which facilitates the cross-border cooperation of law enforcement authorities investigating this type of offences. Member States have amended criminal codes and other relevant legislation, streamlined procedures, and set up or improved cooperation schemes. The Commission acknowledges the major efforts by the Member States to transpose the Directive. However, there is still considerable scope for the Directive to reach its full potential if Member States were to fully implement all of its provisions. The analysis so far suggests that some of the main improvements to be achieved by the Member States include the use of definitions (Article 2), which has an effect on the scope of offences defined by national law on the basis of the Directive. In addition, Member States appear to have found it challenging to include all the possibilities defining actions in relation to offences (Articles 3 to 7) and include common standards of penalties for cyberattacks (Article 9). Other issues appear to relate to the implementation of administrative provisions on appropriate reporting channels (Article 13(3)) and the monitoring and statistics for the offences included in the Directive (Article 14). 12