- NIS 2 (Directive (EU) 2022/2555) replaces the 2016 NIS Directive and has applied since 18 October 2024 in the Member States that have transposed it.
- It covers medium-sized and large entities in 18 sectors, classified as “essential” or “important”. Providers of cloud computing, data centre and managed services are explicitly included.
- It imposes 10 families of security measures and the reporting of significant incidents (early warning within 24 h, notification within 72 h, final report within one month), and makes management bodies accountable.
- In France, the “Résilience” bill transposing it was adopted by the Senate in March 2025 but had still not been finally passed as of October 2026.
What is the NIS 2 Directive?
The NIS 2 Directive (Network and Information Security), adopted on 14 December 2022 and published in the Official Journal of the European Union on 27 December 2022, sets a high common level of cybersecurity across the Union. It replaces the 2016 NIS 1 Directive, whose scope was limited to operators of essential services designated one by one by each Member State.
NIS 2 changes the approach: it is no longer the State that designates operators; entities must determine for themselves whether they fall within scope, based on their sector and size. The number of organisations concerned thus rises from a few hundred to several thousand per country: in France, ANSSI cites more than 10,000 entities, compared with around 500 under NIS 1.
Like any directive, NIS 2 must be transposed into the law of each Member State, which specifies the competent authorities, registration arrangements and penalty regime. The transposition deadline was 17 October 2024.
From NIS 1 to French transposition
- July 2016Adoption of the NIS 1 Directive (EU) 2016/1148, transposed in France by the Act of 26 February 2018: a few hundred designated operators of essential services (OES).
- 14 December 2022Adoption of the NIS 2 Directive (EU) 2022/2555, published in the OJEU on 27 December 2022 and in force since 16 January 2023.
- 15 October 2024The bill on the resilience of critical infrastructure and the strengthening of cybersecurity, which transposes NIS 2 and the CER Directive and adapts DORA, is tabled in the Senate.
- 17 October 2024Transposition deadline. On the same day, the Commission adopts Implementing Regulation (EU) 2024/2690, which sets out the technical requirements for digital providers (cloud, data centres, managed services, etc.).
- 12 March 2025The Senate adopts the bill. The special committee of the National Assembly adopts its text on 10 September 2025.
- 24 November 2025ANSSI opens company pre-registration on the MonEspaceNIS2 platform.
- October 2026The text, scheduled on the National Assembly’s agenda for 7 and 9 October, is withdrawn from it on 6 October. France has still not transposed the directive.
Who is in scope?
The scope combines a sector criterion (Annexes I and II of the directive) and a size criterion: in principle, medium-sized enterprises (at least 50 employees, or more than €10m in turnover and balance sheet total) and large enterprises are covered. Some players are covered regardless of size, such as DNS service providers, domain name registries and qualified trust service providers.
| Essential entities | Important entities | |
|---|---|---|
| Sectors | Annex I, “sectors of high criticality”: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space | Annex II, “other critical sectors”: postal services, waste management, chemicals, food, manufacturing (medical devices, electronics, machinery, vehicles, etc.), digital providers, research; and medium-sized entities from Annex I |
| Size | In principle, large enterprises in Annex I sectors, plus certain entities designated regardless of size | Medium-sized and large enterprises that are not essential entities |
| Supervision | Ex ante and ex post supervision: audits, inspections, requests for information | Ex post supervision, upon evidence of non-compliance or after an incident |
| Maximum fine | €10m or 2% of total worldwide annual turnover (whichever is higher) | €7m or 1.4% of total worldwide annual turnover (whichever is higher) |
The 10 minimum risk-management measures
Entities must take “appropriate and proportionate” measures, based on an all-hazards approach, covering at least the following ten areas.
Risk analysis and security policies
Policies on risk analysis and information system security.
Incident handling
Prevention, detection and handling of incidents.
Business continuity
Backup management, disaster recovery and crisis management (BCP / DRP).
Supply chain security
Security of relationships with direct suppliers and service providers, including cloud providers.
Secure development
Security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure.
Effectiveness assessment
Policies and procedures to assess the effectiveness of risk-management measures.
Cyber hygiene and training
Basic cyber hygiene practices and cybersecurity training.
Cryptography
Policies on the use of cryptography and, where appropriate, encryption.
Human resources and access
Human resources security, access control policies and asset management.
Strong authentication
Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communication systems.
Reporting a significant incident: three stages
An incident is “significant” when it causes or is capable of causing severe operational disruption of services or financial loss, or affects third parties by causing considerable material or non-material damage. It must be reported to the competent authority or the CSIRT (in France, ANSSI).
- Within 24 hoursEarly warning: report the incident and indicate whether it appears to be caused by unlawful or malicious acts, or could have a cross-border impact.
- Within 72 hoursIncident notification: update of the early warning, initial assessment of severity and impact, and available indicators of compromise.
- Within one monthFinal report: detailed description, type of threat or root cause, mitigation measures applied and ongoing, and any cross-border impact. An intermediate report may be requested in the meantime.
What NIS 2 changes in practice
Management on the front line
Management bodies must approve cybersecurity measures, oversee their implementation and undergo training. They can be held liable for infringements (Article 20).
Dissuasive penalties
Up to €10m or 2% of worldwide turnover for an essential entity. For essential entities, the authority may also temporarily suspend a certification or authorisation, or even request a temporary ban on exercising managerial functions.
The supply chain becomes an issue
Each entity must assess the security of its direct suppliers, their vulnerabilities and the quality of their practices. Cloud, outsourcing and SaaS contracts come within scope.
A knock-on effect on SMEs
Even when out of scope, many subcontractors are required by their customers to accept security clauses, audits and reporting commitments aligned with NIS 2.
NIS 2 and choosing a cloud provider
NIS 2 affects the cloud in two ways. First, providers of cloud computing services, data centre services, content delivery networks, managed services and managed security services are themselves regulated entities, under digital infrastructure and ICT service management. Implementing Regulation (EU) 2024/2690 sets out detailed technical requirements for them and precise thresholds for significant incidents.
Second, for any regulated entity, the cloud provider is part of the supply chain to be assessed. The directive calls for taking into account the overall quality of suppliers’ products and cybersecurity practices, as well as the coordinated risk assessments carried out at European level, which may include non-technical factors.
NIS 2 does not require the use of a European provider and does not address exposure to extraterritorial laws such as the CLOUD Act. It is therefore not a sovereignty instrument in itself: an entity can comply with NIS 2 while relying on a US hyperscaler. For sensitive data, the SecNumCloud qualification remains the only French framework that requires immunity from non-European laws.
What you need to know in 6 questions
Is my organisation in scope of NIS 2?
It is if it carries out an activity listed in Annex I or II of the directive and is at least medium-sized (50 employees, or more than €10m in turnover and balance sheet total). Some activities are covered regardless of size. In France, the simulator on ANSSI’s MonEspaceNIS2 platform lets you check your status.
Does NIS 2 already apply in France?
Not fully. The directive was due to be transposed by 17 October 2024, but the Résilience bill had not been finally adopted as of October 2026. The obligations will become enforceable once the law is promulgated and its implementing decrees are published. ANSSI recommends preparing now, and company pre-registration has been open since November 2025.
What is the difference between an essential and an important entity?
The security and reporting obligations are the same. The difference lies in supervision (ex ante for essential entities, ex post for important entities) and in the cap on fines: €10m or 2% of worldwide turnover versus €7m or 1.4%.
How does NIS 2 relate to DORA?
The DORA Regulation, applicable since 17 January 2025, is a sector-specific act that takes precedence over NIS 2 for financial entities as regards ICT risk management and incident reporting. A bank or insurer therefore applies DORA for these aspects. The French Résilience bill in fact deals with both texts together.
Are local authorities in scope?
The directive covers public administration and leaves Member States free to include local authorities. The French bill partly includes them: the Senate notably retained regions, departments and municipalities with more than 30,000 inhabitants. The final scope will depend on the text adopted.
Does NIS 2 require me to choose a sovereign cloud?
No. NIS 2 requires you to assess and manage the risks associated with your suppliers, without requiring any particular nationality. Choosing a European or SecNumCloud-qualified cloud is a matter for other texts (the State’s “Cloud au centre” doctrine, sector requirements) or your own risk analysis.
Further reading
- Directive (EU) 2022/2555 of 14 December 2022 (NIS 2), official text (EUR-Lex)
- Implementing Regulation (EU) 2024/2690 of 17 October 2024, technical requirements for digital providers (EUR-Lex)
- ANSSI, the NIS 2 Directive (cyber.gouv.fr)
- ANSSI, MonEspaceNIS2 platform: simulator and pre-registration
- French Senate, bill on the resilience of critical infrastructure and the strengthening of cybersecurity (legislative file)