Article at a glance: NIS 2 affects between 15,000 and 18,000 French companies, with penalties of up to €10 million and Accountability for executives. The French implementation is expected in July 2026, but preparing now is the best strategy. This guide explains everything you need to know.
Cyberattacks are on the rise in Europe, and their impact is becoming increasingly severe: service disruptions, data breaches, and financial losses. In light of this, the European Union has decided to raise cybersecurity standards for organizations that support the economy and citizens’ daily lives.
This is the purpose of the NIS 2 Directive, which was adopted in December 2022 and will take effect in October 2024. It replaces the NIS 1 Directive, which covered only about 500 entities in France. Under the NIS 2 Directive, between 15,000 and 18,000 French organizations are now subject to enhanced cybersecurity requirements. Are you a business leader, DPO, CIO, or CISO in a potentially affected sector? This guide provides a comprehensive overview of what NIS 2 means for your organization.
The NIS 2 Directive (Network and Information Security 2) is the European framework for cybersecurity, published as Directive (EU) 2022/2555. It marks a paradigm shift: cybersecurity is now a strategic imperative, rather than merely a technical choice.
NIS 2 in a nutshell: European legislation that requires companies in critical sectors to implement robust cybersecurity measures for their systems and report on them to the relevant authorities. This overview actually covers a set of fundamental requirements for your organization.
The first NIS Directive, also known as the Network and Information Systems Security Directive, which took effect in 2016, applied to only about 500 entities in France, primarily operators of critical infrastructure in the energy, transportation, and healthcare sectors. In the face of the surge in cyberattacks, the rise of ransomware, and increasingly sophisticated threats.
The NIS 2 Directive has three objectives, under the supervision of the European Commission:
Good to know: The NIS 2 Directive, along with the DORA Regulation (financial sector) and the CER Directive (critical physical infrastructure), forms part of a coherent set of European regulations designed to complement one another.
To fall within the scope of the NIS 2 Directive, your organization must operate in one of the 18 sectors defined by the directive and exceed certain size thresholds.
The NIS 2 Directive distinguishes between two categories of sectors, which are listed in the annex to the directive.
In practice: ANSSI provides a self-assessment tool on its website—Mon Espace NIS 2—that allows you to check your eligibility in just a few minutes.
The NIS 2 Directive classifies organizations into two categories based on their size and sector, which determines both the level of obligations and the amount of applicable penalties.
Critical entities (CE): large organizations in the sectors listed in Annex I (more than 250 employees or revenue exceeding 50 million euros), subject to proactive oversight by ANSSI. Significant Entities (SE): medium-sized organizations (50 to 249 employees, revenue between €10 million and €50 million) in Annex I and II sectors, subject to reactive monitoring.
Key figures: Between 15,000 and 18,000 French entities fall under the scope of the NIS 2 Directive, compared to approximately 500 under NIS 1.
Yes. The NIS 2 Directive requires the management of supply chain risks. If you are a service provider to an entity subject to the NIS 2 Directive, you will be required to demonstrate your security level through contractual provisions or audits. These new rules are among the most significant for SMB .
NIS 2 establishes a set of requirements regarding risk management measures, incident response, and Accountability .
Article 21 of the directive covers ten categories of measures: vulnerability management, business continuity, supply chain security, encryption, access control, strong authentication, and the use of appropriate monitoring solutions. Incident detection and response capabilities are central to these requirements, alongside the management of cybersecurity risks specific to each organization.
Dipeeo Tip: These measures, which include raising awareness among staff, largely align with the security requirements of GDPR, particularly Article 32. An organization already working toward GDPR compliance GDPR already laid a solid foundation for NIS 2.
This is one of the most stringent requirements of the NIS 2 Directive. Any significant incident must be reported to ANSSI within 24 hours (early notification), 72 hours (initial notification), and one month (final report).
An incident is considered significant if it causes a serious disruption of services, significant financial losses, or an impact on other organizations.
This is the most significant change in the NIS 2 Directive compared to NIS 1. The management bodies of the entities concerned are personally responsible for ensuring compliance with the Directive’s requirements. In practical terms, this means:
In the event of a serious breach, individuals in management positions may be held personally liable and may face a temporary ban on holding management positions. Cybersecurity is no longer solely a technical matter; it is a matter of trust and Accountability highest levels of the organization.
NIS 2 introduces a penalty system aligned with that of GDPR. Fines vary depending on the type of entity:
Good to know: NIS 2 and GDPR penalties GDPR be cumulative. If an incident results in a personal data breach, your organization may face penalties from both ANSSI and the CNIL (National Commission for Information Technology and Civil Liberties) at the same time. This is yet another reason to address both compliance requirements in a coordinated manner.
France has failed to meet the October 17, 2024, deadline for transposing NIS 2 into national law. This delay in transposition creates legal uncertainty for the organizations concerned.
The government has chosen to implement NIS 2 through the Resilience Bill, which also incorporates the CER Directive and the DORA Regulation. Passed by the Senate in March 2025, it is expected to be adopted by the National Assembly no earlier than July 2026, at which point the European Commission will suspend its infringement proceedings against France.
While awaiting the law, ANSSI has not been idle. On March 17, 2026, it published the Référentiel Cyber France (ReCyF), a technical framework that lists the recommended management measures for achieving the security objectives set by NIS 2. This framework corresponds to Article 14 of the Resilience Bill. ReCyF is not mandatory by default, but stakeholders who apply it can cite it during ANSSI inspections. Aligning with ReCyF—whose official source is available on MesServicesCyber—means getting a head start on the formal implementation of these requirements.
No. Once the law is enacted, deadlines will be set and service providers’ resources will be stretched thin. To prepare, you need to assess your scope and implement initial measures before the requirement becomes formally enforceable.
NIS 2 compliance can’t be winged—it requires a structured approach. Here are the steps to follow to move forward in a gradual and well-documented manner.
Three cumulative criteria: your sector is listed in Annex I or II, you exceed the thresholds (50 employees or €10 million in revenue), and you operate in at least one EU Member State.
ISO 27001 is a catalyst, not a substitute. It does not cover statutory notification deadlines, the Accountability of executives, or the requirements of the ReCyF.
Tip from Dipeeo: Your GDPR compliance often GDPR 50 to 60% of the work required to achieve NIS 2 compliance. Data processing inventories, risk assessments, and incident management: these foundational elements can be directly reused.
The NIS 2 Directive and GDPR common objectives and requirements that overlap significantly.
Both regulations require security measures commensurate with the risk, incident reporting within specified timeframes (72 hours under the GDPR, 24 hours under NIS 2), and documentation of compliance activities. An organization that GDPR already GDPR a foundation that can be directly leveraged for NIS 2
The main difference: The GDPR on the protection of personal data, while NIS 2 covers the security of networks and information systems as a whole, including the sharing of information among competent authorities.
In practice, an organization that has already conducted its data protection impact assessment (DPIA), kept its record of processing date, and established a data breach response procedure has a foundation that can be directly leveraged for NIS 2.
For organizations in the financial sector (banks, insurance companies, asset managers, payment service providers), both regulations may apply simultaneously.
DORA is the lex specialis for the financial sector: it takes precedence over NIS 2. An organization that complies with DORA largely meets the requirements of NIS 2
A European regulation requiring companies to better protect themselves against cyberattacks.
SMB large companies in critical sectors such as healthcare, transportation, energy, and digital technology.
Ten categories of cybersecurity measures, reporting incidents to ANSSI within strict deadlines, executive involvement, and securing the supply chain.
Up to €10 million or 2% of global revenue for critical entities, up to €7 million or 1.4% for significant entities, with the possibility of Accountability executives Accountability .
It took effect in 2023 and is being phased in gradually across each European country.
Not yet. The Resilience Act is not expected until July 2026 at the earliest. ANSSI has published the ReCyF to help organizations start preparing now.
They complement each other. An organization that is already GDPR already laid much of the groundwork required for NIS 2.
Managing GDPR compliance GDPR running your business is exhausting. That’s exactly why Dipeeo exists.
With Dipeeo, a legal expert in data protection gets to know your business, its unique characteristics, and its constraints, becoming your trusted daily point of contact. They handle everything that weighs on you: the initial audit, mandatory documentation, monitoring your service providers, managing data deletion requests, and those unexpected issues that always seem to pop up at the worst possible time.
Here's what you'll actually get:
Many executives tell us they wish they had addressed this sooner. The best time to do so is now.
👉 I’m scheduling an appointment with Dipeeo – outsourced DPO
The NIS 2 directive should be seen as an opportunity to strengthen your organization's digital resilience and overall security. Anticipating its implementation means protecting your activities, building trust with your partners, and raising your level of cybersecurity. Don't just comply with the regulation: turn it into a strategic lever. Conduct an audit now.
