NIS2: what the directive actually requires, and where France stands

A directive long settled, a law still missing

On 8 July 2026 the European Commission referred four Member States — Ireland, Spain, France and the Netherlands — to the Court of Justice of the European Union for failing to transpose the NIS2 directive, asking that they be ordered to pay a lump sum together with daily penalty payments¹. In France, the bill meant to resolve this is still waiting for its day on the floor of the National Assembly.

The situation sustains a misunderstanding: the absence of a national law does not make the obligations uncertain. The European text has been in force since December 2022, its content has not changed, and what transposition still has to settle comes down to arrangements and timing.

What the first directive could not do

The 2016 NIS directive laid the groundwork for European cybersecurity regulation. Its scope stayed narrow, and each Member State designated its own operators of essential services against its own criteria, which produced wide divergence from one country to the next. Enforcement tools, finally, were modest.

The order of magnitude is enough to measure the change. The impact assessment for the French bill puts the shift at "from about 500 to around 15,000 entities," with regulated sectors rising from six to eighteen².

Directive (EU) 2022/2555, adopted on 14 December 2022³, answers all three weaknesses of its predecessor: a scope defined by common criteria, harmonised obligations, and a penalty regime whose ceilings approach those of the GDPR.

Eighteen sectors, and a size threshold

NIS2 covers eighteen sectors, split between "sectors of high criticality" (energy, transport, health, banking, digital infrastructure, public administration and others) and "other critical sectors" (postal services, waste management, manufacturing, digital providers and others).

The change in method matters as much as the widening. Where NIS1 relied on case-by-case designation, NIS2 sets a general rule: belonging to one of the listed sectors and exceeding the size of a small enterprise is enough. An entity is covered when it employs at least fifty people, or when its annual turnover and balance sheet total each exceed ten million euros⁴.

Two mechanisms pull in organisations that believed themselves outside. The criteria are calculated across all of an entity's activities, not only those falling under the directive's annexes. More importantly, they account for linked and partner enterprises: under Article 6 of the Annex to Recommendation 2003/361/EC, an entity adds its own data, all of the data of its linked enterprises, and a proportional share of its partners'⁵. A forty-person subsidiary inside a group is therefore assessed at group scale.

In France the scope also reaches local government. The impact assessment counts 1,489 essential entities, including 661 local authorities and groupings, with municipalities above thirty thousand inhabitants falling into that category. The 992 communautés de communes would be important entities².

Entities covered regardless of size

The size criterion has exceptions. Covered whatever their headcount are providers of public electronic communications networks or services, trust service providers, top-level domain name registries, DNS service providers and public administration⁴. A fifteen-person trust service provider therefore falls under the directive.

Identification rests on self-assessment. No letter will tell an organisation it is in scope: working out its own status, then registering with the competent authority, is its own responsibility.

Essential entities, important entities

Entities in scope fall into two categories:

	Essential entities	Important entities
Profile	High-criticality sectors, from 250 staff or €50M turnover and €43M balance sheet	Other entities in scope
Supervision	Ex ante: inspections possible at any time	Ex post: inspection on evidence, indication or information of non-compliance
Fine ceiling	At least €10M or 2% of worldwide turnover	At least €7M or 1.4% of worldwide turnover

These are not absolute ceilings. Article 34 requires Member States to provide for fines of "a maximum of at least" these amounts, which allows a stricter transposition³. Whichever of the two is higher applies, which materially changes the calculation for a large group.

The substantive obligations are identical across both categories. An important entity is held to the same risk-management measures and the same reporting deadlines. What differs is what triggers supervision, and the nuance is often missed: Article 33 does not require an incident, it is enough for the authority to hold evidence, an indication or information suggesting non-compliance³. A report, a press article or a finding made at a third party can therefore open an inspection.

The French bill further provides that the State, local authorities and their administrative public bodies escape the fines, without being exempt from the security and notification obligations⁶.

The ten areas of Article 21

Article 21 does not stop at requiring "appropriate measures": it lists ten areas those measures must cover³. They fall into four families.

Risk governance accounts for four: policies on risk analysis and information system security; procedures for assessing the effectiveness of the measures taken; human resources security, access control and asset management; and basic cyber hygiene practices together with training.

Two concern the capacity to absorb an incident: incident handling, and business continuity (backups, disaster recovery, crisis management).

Three are technical: security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure; the use of cryptography and encryption; and multi-factor authentication and secured communications, including emergency communications.

The tenth concerns third parties, and deserves separate treatment.

What "proportionate" means in practice

Measures must be appropriate to the risk incurred, taking into account the entity's degree of exposure, its size, the likelihood of an incident, its potential severity, the state of the art and the cost of implementation³. Six criteria, no threshold values.

For some digital providers, the Commission has removed the ambiguity. An implementing regulation published in October 2024 sets out the technical requirements expected of DNS service providers, top-level domain name registries, cloud computing providers, data centre providers, content delivery network providers, managed service providers and managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers⁷. Entities on that list have a precise reference. The others rely in practice on the ISO 27001 family of standards and on national cyber hygiene guidance.

Supply chain security and its trickle-down effect

NIS2 requires regulated entities to account for vulnerabilities in their direct suppliers and the quality of those suppliers' security practices. In practice this means questionnaires, contractual clauses, incident notification requirements and sometimes audit rights.

The effect reaches past the directive's formal scope. A thirty-person logistics subcontractor is not regulated, but if it supplies a hospital that is, the requirements will arrive through its contract. This is probably the channel through which the text will touch the greatest number of organisations, more than through penalties.

Method is where many programmes come undone. Sending a two-hundred-line questionnaire to five hundred suppliers produces binders, not security. Ranking by how critical each dependency is, then seriously examining the handful of suppliers whose failure would halt operations, yields better results for comparable effort.

What changes for management bodies

Article 20 requires management bodies to approve risk-management measures, oversee their implementation and undergo cybersecurity training. Entities must offer comparable training to their employees. Combined with Article 32, it allows directors to be held liable for serious failures³.

In practice, a risk assessment has to reach the board, be discussed there, and any decision to accept a risk must be documented. Many organisations will find that their executive committee has never formally approved a security policy.

The precise shape of that liability is left to national law. It is one of the things to watch in each transposition.

Reporting in three stages

Any incident with a significant impact must be notified to the competent authority on the timetable set by Article 23³:

• an early warning within 24 hours of becoming aware of the incident, stating in particular whether it appears to stem from malicious activity or could have cross-border impact;
• a notification within 72 hours of that same point of awareness, with an initial assessment of severity and, where available, indicators of compromise;
• a final report within one month of the 72-hour notification, not within one month of the incident, describing the root cause, the measures applied and the effects.

Two details matter in practice. Trust service providers have 24 hours rather than 72 for the notification where the incident affects their trust services. And the clock starts at the point of becoming aware, a notion the directive does not define; the 2024 implementing regulation offers a reading, but only for the eleven categories of digital provider it covers, and only in a recital: awareness arises when the entity, after an initial assessment, has a reasonable degree of certainty that a significant incident has occurred⁷. For other sectors, national transpositions will have to settle the point.

An intermediate report may be requested in between, and an incident still ongoing after a month calls for a progress report.

An incident counts as significant if it has caused or is capable of causing severe operational disruption or substantial financial loss, or if it is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

The twenty-four-hour deadline assumes several decisions have already been made: who qualifies the incident, who has authority to report, through which channel, and with what minimum level of information. An organisation discovering these questions during an incident will not meet the deadline. This is procedural work, doable immediately and independent of where transposition stands.

Where French transposition stands

Position as at 4 November 2026.

Member States were required to transpose the directive by 17 October 2024 at the latest.

The Commission sent letters of formal notice on 28 November 2024, then reasoned opinions on 7 May 2025, before referring the matter to the Court of Justice on 8 July 2026¹.

In France, the vehicle is the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, which transposes NIS2, the CER directive and Directive (EU) 2022/2556 accompanying DORA. DORA itself, Regulation (EU) 2022/2554, has applied directly since 17 January 2025 and required no transposition.

Presented to the Council of Ministers on 15 October 2024, the text was adopted by the Senate on 12 March 2025 by 181 votes to 134, then examined by a special committee at the National Assembly, whose text was published as number 1779⁸⁹. Its passage through the floor, announced for 7 October 2026, was withdrawn from the agenda the day before by the conference of presidents, with no new date¹⁰.

Promulgating the law will not make the obligations immediately applicable: the implementing decrees and orders have to follow, setting out among other things the measures required of each category of entity.

This section is the one that will age fastest. Check where matters stand before drawing a conclusion from it.

Where to start without waiting for the law

The European text has not moved since December 2022. The sectors, the thresholds, the ten areas of Article 21, the reporting deadlines and the obligations on directors are known and stable. French law will set arrangements and compliance deadlines; the referral to the Court of Justice, for its part, narrows the room for manoeuvre on timing.

The work involved is measured in quarters. Building an up-to-date asset inventory, writing and testing a notification procedure that holds within twenty-four hours, examining critical suppliers, getting a security policy approved by the board: none of it can be made up in the weeks following publication of a decree.

One test places an organisation fairly well. Can it answer, today and within twenty-four hours, three questions: what happened, since when, and which systems are affected? Answering yes presupposes a current asset inventory, detection that works and an identified decision chain, which is most of what Article 21 asks for.

Sources & notes

1. European Commission, "Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity", 8 July 2026, https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules ↩ ↩²

2. Sénat, "Résilience des infrastructures critiques et renforcement de la cybersécurité — étude d'impact" (in French), https://www.senat.fr/leg/etudes-impact/pjl24-033-ei/pjl24-033-ei.html ↩ ↩²

3. European Union, "Directive (EU) 2022/2555 of the European Parliament and of the Council (NIS2)", 14 December 2022, https://eur-lex.europa.eu/eli/dir/2022/2555/oj ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

4. ANSSI, "Directive NIS 2", MesServicesCyber (in French), https://messervices.cyber.gouv.fr/nis2 ↩ ↩²

5. Institut luxembourgeois de régulation, "NIS 2 — Scope and field of application", https://www.ilr.lu/en/sectors/niss/nis-2/scope-and-field-of-application/ ↩

6. Silicon, "NIS2 : ce qu'il faut attendre du projet de loi examiné à l'Assemblée nationale", 5 October 2026 (in French), https://www.silicon.fr/cybersecurite-1371/nis2-ce-quil-faut-attendre-du-projet-de-loi-examine-a-lassemblee-nationale-229520 ↩

7. European Commission, "Commission Implementing Regulation (EU) 2024/2690", 17 October 2024, https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj ↩ ↩²

8. ANSSI, "Avancement de la transposition de la directive NIS 2", MonEspaceNIS2, updated 19 September 2025 (in French), https://aide.monespacenis2.cyber.gouv.fr/fr/article/avancement-de-la-transposition-de-la-directive-nis-2-1b3j1da/ ↩

9. Assemblée nationale, "Texte de la commission n° 1779" (in French), https://www.assemblee-nationale.fr/dyn/17/textes/l17b1779_texte-adopte-commission ↩

10. Next, "Caramba, encore raté : la transposition de NIS2 est de nouveau repoussée", 6 October 2026 (in French), https://next.ink/brief-article/alleluia-la-transposition-de-nis2-est-enfin-a-lordre-du-jour-de-lassemblee-nationale/ ↩