NIS2 in France: who is affected and what SMEs can prepare

NIS2 is a European directive, to be written into the law of each EU country, that greatly expands the number of organizations subject to cybersecurity obligations. Transposing NIS2 in France is the job of the “NIS2 law”: the projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité (bill on the resilience of critical infrastructure and the strengthening of cybersecurity), whose examination in the Assemblée nationale (National Assembly), scheduled for early October 2026, has been postponed with no new date.

Even if the law does not cover it, an SME that works for an organization in scope will see that organization’s requirements arrive through the contract: it is better to prepare for them.

Where NIS2 in France stands on October 21, 2026

EU countries had to transpose the directive by October 17, 2024 at the latest. In France, the bill, tabled in the French Senate on October 15, 2024 under the accelerated procedure, was adopted there at first reading on March 12, 2025; the National Assembly’s special committee adopted its version of the text on September 10, 2025. The bill transposes three directives: NIS2, the directive on the resilience of critical entities and the directive linked to the DORA regulation for the financial sector.

Scheduled for debate in plenary session on October 7 and 9, 2026, the text was removed from the agenda on October 6; the meetings that set this agenda did not put it back on October 13 and 20. No new date has been set so far (see the National Assembly’s legislative file, in French).

On July 8, 2026, the European Commission decided to refer France, Spain, Ireland and the Netherlands to the Court of Justice of the European Union over this delay. It is asking the Court for a lump sum and daily penalty payments (penalties for each day of delay) until the directive is fully transposed.

Once the law is enacted, the implementing decrees and orders will follow. According to ANSSI, the French national cybersecurity agency, in its FAQ on the progress of the transposition (in French), NIS2 will enter into force in France when all these texts are published, without every requirement applying from that date: the compliance deadlines have not yet been set.

NIS2: who is directly affected

According to ANSSI, several thousand organizations will be affected, mostly medium-sized and large companies, local authorities and public administrations. Their 18 sectors fall into two groups:

• “sectors of high criticality”, including energy, transport, health, drinking water, digital infrastructure, banking and providers that manage other companies’ IT (managed IT services);
• the other “critical sectors”, including manufacturing, the food industry, waste management, chemicals, postal services and digital providers.

A company in a sector of high criticality is in principle an “essential entity” if it employs at least 250 people, or if its annual turnover exceeds €50 million and its balance sheet €43 million. Other companies in the sectors concerned are “important entities” if they employ at least 50 people, or if their annual turnover and balance sheet exceed €10 million. Micro and small enterprises are in principle not subject to the law, except in specific cases (certain domain name operators, for example).

To check your situation, ANSSI offers an online test on MonEspaceNIS2 (in French), where organizations can also pre-register.

What companies in scope will have to do

ANSSI sums up the framework in three obligations: register with ANSSI, the competent national authority; put in place risk management measures to meet the security objectives set by the French text; report significant incidents and critical security vulnerabilities to ANSSI.

These measures are described in ANSSI’s Référentiel Cyber France (ReCyF, the French cybersecurity framework), whose version 2.5 of March 17, 2026 is still a working version that may change with the parliamentary debates. It sets 20 security objectives: the first fifteen for important and essential entities, the last five for essential entities only. According to ANSSI, these objectives will become mandatory by decree once the law is enacted; the “acceptable means of compliance” proposed to achieve them will in principle remain optional, except in specific cases. Certain digital players fall under a specific European regulation.

Finally, the directive requires management to approve these measures, oversee their implementation and be liable in the event of non-compliance. According to ANSSI, penalties could reach €10 million or 2% of worldwide annual turnover for an essential entity, and €7 million or 1.4% for an important entity.

Suppliers and service providers: affected without being targeted

The directive also requires organizations to ensure “supply chain security”, including in their relationships with direct suppliers and service providers. The ReCyF turns this into an objective, “Maîtrise de l’écosystème” (control of the ecosystem), whose proposed means provide in particular that the company in scope:

• keeps an up-to-date list of its IT service providers and suppliers, with a contact for each;
• makes sure that each service complies with its own obligations, particularly in risk management and incident reporting, and obtains contractual guarantees: a security assurance plan (the provider’s written security commitments), a remote maintenance charter (rules for remote interventions) or monitoring indicators, for example;
• regularly checks this compliance, possibly through audits.

The business software vendor, managed IT services provider or hosting provider of a company in scope should therefore expect security questionnaires, contract clauses and audit requests. These requirements will come from the contract, not from the law, but could carry weight when contracts come up for renewal.

What your SME can prepare now

A few basic workstreams, inspired by the ReCyF, cover most of a client’s questions:

• a list of your systems, administrator accounts and access to your clients’ systems;
• multi-factor authentication (a code or a key in addition to the password) for remote access and for accounts with extended rights;
• regular security updates, following CERT-FR alerts (the French government’s alert center), and software still supported by its vendor;
• protected backups and restores that are actually tested;
• an incident procedure, with a person responsible for notifying your clients without delay;
• a file ready to send: measures in place, the list of your subcontractors, commitments you can keep. It is better to commit to what you know you can deliver than to sign a security annex you cannot apply.

A concrete example

Take, as an illustration, a 20-person SME with turnover below €10 million that develops and hosts the scheduling application of a group of private clinics with 400 employees. The SME is in principle not subject to the law. Its client, in the health sector (high criticality) and with more than 250 people, would in principle be an essential entity. Before renewing the contract, the client sends a questionnaire on these same topics, including update timeframes, and asks the SME to accept an audit.

If the SME has inventoried its access, enabled multi-factor authentication on the hosting administration, tested a full restore and written a short security assurance plan, it answers point by point, with evidence. The questionnaire becomes a sales argument rather than a risk of losing the contract.

Frequently asked questions

Is the NIS2 law already in force in France?

No. As of October 21, 2026, the National Assembly has not debated in plenary session the bill adopted by the Senate. The two chambers will then need to vote the text in identical terms, if necessary after a commission mixte paritaire (a joint committee where deputies and senators meet to reach an agreement), followed by enactment and the decrees.

My company has fewer than 50 employees: is it affected?

With fewer than 50 people and turnover or a balance sheet not exceeding €10 million, it is in principle not directly subject to the law, except in specific cases. If you work for an essential or important entity, its requirements will reach you through the contract.

Should I register on MonEspaceNIS2 now?

Pre-registration is open to organizations that know they are in scope, but the obligation will only apply once the law is in force. A subcontracting SME that is not subject to the law does not need to register: that step falls to its client, if the client is in scope.

411bit supports small businesses, SMEs and mid-sized companies in preparing for NIS2: cybersecurity audit, choice of priority measures, help answering your clients’ questionnaires and then, if you wish, monitoring and ongoing maintenance and support (supervision and upkeep of your systems), with a fixed-price quote per deliverable. Contact us to discuss it: every request receives a reply within 24 business hours. See also: securing your IT without holding back growth.