Your NIS2 documentation
file in 5 days

Multi-factor authentication (MFA)

“ For which services do you enforce MFA? Email, VPN, RDP, network and cloud administration, privileged accounts. ”

Email security

“ What controls do you use against email spoofing (SPF, DKIM, DMARC)? Have you disabled legacy protocols (IMAP, POP3, insecure SMTP)? ”

Incident response plan

“ What is your incident response plan, and within what time frame would you notify us of a cybersecurity incident? ”

Subcontracting and supply chain

“ Do you use fourth-tier subcontractors? Will you accept contractual clauses requiring NIS2 compliance (controls, breach notification, right of audit)? ”

Backups and continuity

“ Are backups performed? Are their integrity and the restoration procedures tested at least once a year? ”

Security governance

“ Is your information security policy based on a recognised framework (NIST, ISO 27001)? ”

Who is concerned?

The directive targets "medium-sized" or "large" companies (within the meaning of European law) active in a list of sectors deemed critical: energy, transport, health, banking, water, digital, public administration on the one hand; postal services, waste, chemicals, food, manufacturing, research on the other. A Member State may also include smaller entities if they play a key role.

What NIS2 really requires of you

In plain terms: put "proportionate" security measures in place, know how to identify your risks, protect your data, detect an attack, respond to it and restart afterwards. In addition come the physical security of premises, access control and authorisations, and checking the security of your service providers and suppliers.

When things go wrong, a precise timeline

If a "significant" incident occurs, the authority must be notified in three steps: an early warning within 24 hours, a more detailed notification within 72 hours, then a final report within one month. The customers affected must also be informed without delay of the measures to take on their side.

Penalties, without drama

The ceiling for fines is set by the directive: up to EUR 10 million or 2% of worldwide turnover (whichever is higher) for "essential" entities; up to EUR 7 million or 1.4% of worldwide turnover for "important" entities. These are legal ceilings, not an automatic invoice, and a fine comes only after a ladder of corrective measures - see the detail further down.

Key dates

The directive has been in force since 16 January 2023. Each Member State had to transpose its obligations into national law by 17 October 2024 at the latest, for effective application from 18 October 2024, the date on which the former NIS1 text was repealed.

In France, who leads the file

ANSSI is the authority designated to support NIS2 compliance. It has published a "Référentiel Cyber France" (ReCyF, available since 17 March 2026) and offers a platform "MonEspaceNIS2" as well as a "ClubSSI" to help companies find their way.

What is already happening among our neighbours

In Germany, the BSI authority indicates that the legal deadline for registration of the entities concerned has already passed: those that have not yet done so must do it without waiting. A concrete sign that the European movement is already under way, well beyond the texts.

A simplification is under consideration

In 2026 the European Commission presented a proposal (the "omnibus package") to ease NIS2 compliance, in particular for the smallest entities: around 28,700 companies would be concerned by this relief, including 6,200 micro and small enterprises.

A private clinic or a medical analysis laboratory

Falls within the “Health” sector of Annex I as soon as it is a healthcare provider within the meaning of European law, if it exceeds the medium-size threshold.

An automotive subcontractor or a machinery manufacturer

Falls within the “Manufacturing” sector of Annex II (vehicles, electrical equipment, machinery, electronics) above the size threshold.

A cloud provider or a managed service provider (MSP/MSSP)

Part of “Digital infrastructure” or “ICT service management” in Annex I: concerned from medium size (important entity), essential entity if large. The only size exception: if it is also a qualified trust service provider, a domain name registry or a DNS provider.

A local authority or a regional public body

Falls within the “Public administration” sector of Annex I if the Member State designates it, in particular when the disruption of its services would have a significant impact on critical societal or economic activities.

A food processor or a wholesaler

Comes under “Production, processing and distribution of food” in Annex II as soon as it carries out wholesale activity or industrial production/ processing.

A company “outside the 18 sectors”, but a supplier to a concerned entity

Not directly within the NIS2 scope, but may be pulled in by contract: see the “Ripple effect” section earlier on this page.

Q. What is the NIS2 Directive, in one sentence?

It is the European text that has replaced, since 18 October 2024, the former 2016 cybersecurity law: the European Commission describes it as a text that “raises the common level of ambition on cybersecurity in the EU, through a wider scope, clearer rules and stronger supervision tools”.

Q. I run an SME: am I really concerned by the size thresholds?

The text targets first of all “medium-sized” or “large” enterprises within the European meaning, a precise legal criterion that refers to Recommendation 2003/361/EC (in practice: from 50 employees, or turnover and balance sheet both above EUR 10 million), active in one of the 18 sectors listed. Below that, you are in principle not directly subject, unless your State includes smaller entities deemed essential, or you supply an entity that is (ripple effect, see earlier on this page).

Q. As an executive, can I be held personally liable?

Yes, and it is the least known point of the text: the official legal summary of the directive states that the management body must approve the risk-management measures and oversee their implementation, and that it can be held liable in the event of a breach. Cybersecurity is therefore not only an IT matter: it is a governance issue that goes all the way up to the executive.

Q. How do I know concretely whether my company has to register?

Each Member State must keep an up-to-date official list of essential and important entities, reviewed every two years (first European deadline: 17 April 2025). In France, ANSSI provides a free online self-assessment tool, “MonEspaceNIS2”, which answers the question “am I concerned?” directly.

Q. Is France behind? What does that change for me today?

Yes: the French transposition act is still not published, well beyond the European deadline. In July 2026, the European Commission in fact referred France to the Court of Justice of the EU for not having notified its transposition measures (see the detailed timeline earlier). In practice: no French “NIS2” penalty is possible yet as long as the decree has not come out, but the day it is published, companies that are already ready will have nothing to catch up on.

Q. What really changes compared with the former NIS1 law?

NIS1 (2016) was limited to energy, transport, health, finance, water and digital. NIS2 greatly widens this scope: it now adds public electronic communications, social networks and digital platforms, waste management, the manufacture of critical products, postal services and public administration. Many companies that were until now off the radar now come within scope.

Q. Is any relief planned for small entities?

Yes, under consideration: the European Commission presented in 2026 a simplification package to reduce the administrative burden linked to NIS2, in particular for the smallest entities. Around 28,700 companies would be concerned by this relief, including 6,200 micro and small enterprises. The text has not yet been definitively adopted: one to watch, without waiting to prepare.

Maximum administrative fine: at least EUR 10,000,000 OR at least 2% of the total worldwide annual turnover of the preceding financial year - the higher of the two amounts applies.

Maximum administrative fine: at least EUR 7,000,000 OR at least 1.4% of the total worldwide annual turnover of the preceding financial year - same logic, the higher amount is retained.

Who imposes penalties?

Each Member State designates one or more “competent authorities” responsible for the supervision and enforcement of the directive. In France, this role is entrusted to ANSSI.

The last resort - essential entities only

If the previous measures remain without effect, the authority may itself temporarily suspend an authorisation covering all or part of the services, or ask the body that issued it or a court to suspend it; it may also ask the competent bodies or courts to temporarily bar a manager (CEO or legal representative) from exercising managerial functions, until the entity has taken the necessary measures. This extreme escalation concerns ONLY essential entities, not important entities.

The amount is not automatic

The law requires the following to be taken into account, case by case, of: gravity and duration of the infringement, repeated infringements, damage caused, intent or negligence, measures taken to mitigate the damage, adherence to approved codes of conduct or approved mechanisms, level of cooperation with the authority. Two companies in the same situation do not automatically receive the same fine.

Executives, personally liable

The text explicitly provides that the natural persons running the entity (CEO, legal representative) can be held liable for breach of their duty to ensure compliance - for essential entities and important entities alike.

And if it is also a data breach?

If the incident also constitutes a personal data breach, the NIS2 authority must inform the competent GDPR authority without undue delay (the CNIL in France). The two regimes are coordinated - this is not an automatic accumulation of penalties, but cross-information between authorities.

Figures from real cases? Not yet, honestly

As of the date of this watch, no publicly released NIS2 penalty decision has been found in an official source. The system depends on each Member State's transposition act, which is being finalised. A sign that the movement is under way: in Germany, the BSI authority indicates that the legal deadline for registration of the entities concerned has already passed.