Cyber threats remain particularly high in France. According to the CESIN–OpinionWay barometer published in January 2026, 40% of surveyed companies reported experiencing at least one significant cyberattack in 2025. Meanwhile, ANSSI recorded 1,366 security incidents during the year, affecting businesses, public administrations, local authorities, healthcare institutions, and the education and research sectors. At Scalingo, we are on the front lines of this cybersecurity battle, and our teams work tirelessly to protect and alert our customers in the event of intrusion attempts.

Against this backdrop, the European NIS2 Directive was introduced to strengthen and harmonize cybersecurity across the European Union. Its goal is to improve the resilience and security of critical digital infrastructure across sectors deemed essential or important.

What does the directive mean for your organization? What are the new obligations? How can you prepare, with or without Scalingo? And most importantly, where does NIS2 implementation stand in France in 2026? 🤔

What is the European NIS 2 Directive?

The NIS2 Directive (Network and Information Security Directive 2) is an EU directive designed to strengthen and harmonize cybersecurity across the European Union. It builds on NIS1, extending its scope to additional sectors and organizations while tightening requirements for risk management and information-system security.

Key Changes Introduced by NIS 2

The NIS 2 Directive brings several major developments:

• Expanded Scope: NIS 2 broadens the regulatory coverage to include more entities and sectors. In addition to operators of essential services, it now covers 18 sectors in total, including public administration, healthcare, energy, digital infrastructure, and many supply-chain operators. In France, it is estimated that the number of affected companies could increase by 20 to 30 times compared to NIS 1, impacting thousands of entities, from public administrations and SMEs to major corporations in the CAC40. Overall, approximately 160,000 entities across Europe will be affected.

• Stricter Obligations: The directive imposes more stringent requirements for cyber risk management and security incident notification. Organizations will need to implement robust and responsive cybersecurity measures to prevent and address cyber threats. We will discuss these requirements in more detail later.

• Executive Responsibility: NIS 2 also introduces executive accountability for managing their organization's cybersecurity. Leadership bodies will be held personally responsible for implementing appropriate security measures and ensuring compliance with the new obligations.

• Penalties for Non-Compliance: With responsibilities come penalties. The directive now includes significant financial consequences for entities that fail to meet the requirements. NIS2 sets maximum fines at the higher of €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities. We will elaborate on this point later as well.

• Enhanced European Cooperation: Finally, NIS 2 promotes increased cooperation among EU member states to improve collective responses to cyber threats. This is its core purpose. It includes information sharing, coordinated actions, and the development of common strategies to strengthen European resilience against cyberattacks.

Which Sectors are Affected?

A total of 18 sectors are covered by NIS 2, each playing a vital role in our daily lives. The directive primarily aims to protect sectors where the security and availability of networks and information systems are crucial for society.

Highly Critical Sectors (or “Annex 1”)

• Energy ⚡

• Transport 🚚

• Banking 💰

• Financial Market Infrastructure 📈

• Healthcare 🏥

• Drinking Water 💧

• Wastewater 🚽

• Digital Infrastructure 💻

• IT Services Management 🛠️

• Public Administration 🏛️

• Space 🚀

Critical Sectors (or “Annex 2”)

• Postal and Courier Services 📬

• Waste Management 🗑️

• Manufacture, Production, and Distribution of Chemical Products 🧪

• Production, Processing, and Distribution of Food Products 🍞

• Manufacturing (medical devices, IT, electronics and optical products, machinery, motor vehicles, trailers and semi-trailers, other transport equipment, etc.) 🏭

• Digital Providers 💻

• Research 🔬

Entities within these two sectors are then categorized based on their "criticality" as well as their size in terms of the number of employees and revenue:

This distinction allows legislators to use a proportionality mechanism and adjust regulatory requirements (and imposed penalties) based on the risks involved and the human and financial resources each entity possesses.

💡 Note: Some entities, even if they do not meet these criteria, could be included based on a national risk assessment. Others may be excluded for reasons of national security and defense.

💡 This size criteria does not apply to the following entities, which are affected regardless of their size:

- Providers of public or publicly accessible electronic communications networks or services
- Trust service providers
- Top-level domain name registry operators and domain name system service providers.

In Summary, How Do I Know if My Company is Affected by NIS 2?

To determine if your company is affected by NIS 2, here are a few key points to consider:

• Generally, medium, intermediate, or large entities operating in the previously mentioned sectors will be subject to this regulation.

• In France, the criteria for determining the size of an entity are as follows:

  • A number of employees greater than or equal to 50

  • An annual turnover or balance sheet total greater than or equal to 10 million euros

The government has also implemented a simulator to help assess your company's status: Government Simulator

Please note that the results of the test are strictly indicative and subject to further confirmation, pending the final adoption of the legislative and regulatory texts transposing the NIS 2 directive. Additional details will be provided for companies still uncertain about their status.

In the meantime, as we constantly emphasize, early preparation will be beneficial for all French companies, whether undertaken as a precaution or with certainty 😉.

NIS 2 in France: What Is the Status of Transposition, and When Will It Come into Force?

October 2026 update: The transposition of NIS 2 into French law is still ongoing.

The NIS 2 Directive was officially published on December 27, 2022, in the Official Journal of the European Union. EU Member States were required to transpose its requirements into national law by October 17, 2024.

France did not complete the transposition process by this deadline. The French draft law is still under parliamentary consideration.

In July 2026, the European Commission decided to refer France to the Court of Justice of the European Union for failing to fully transpose the directive.

There is still no definitive date for the full French regulatory framework to come into effect. While awaiting the publication of the transposition legislation, ANSSI encourages future essential and important entities to begin preparing for compliance now.

October 2026 update: ANSSI is now considering a target of full NIS2 compliance for all entities concerned by the end of 2028. However, this timeline remains indicative: it is not a legally binding deadline and will need to be confirmed as part of the French transposition process and its implementing regulations. Preparatory exercises may also be organized in the meantime.

In any case, it is essential for companies to closely monitor regulatory developments and prepare accordingly.

To help with this, ANSSI provides a dedicated page, regularly updated with the latest information: NIS 2 Directive – French Government

What Will the New Obligations for Regulated Entities Be?

While some details are still being finalized, three main areas structure these new requirements:

• Security measures and compliance areas,

• Requirement for notification, contact, and reporting of major Incidents

• Penalties for Non-Compliance

Let’s explore each of these aspects in detail to better anticipate the upcoming changes!

1. Security Measures and Targeted Compliance Areas

Articles 20 to 21.2.j of EU Directive 2022/2555 outline in detail the organizational and technical measures expected. These measures cover a broad spectrum of cybersecurity, including risk management governance, data encryption, and business continuity…

The main compliance areas include:

• Risk Analysis: Regularly identify, analyze, and assess potential risks to the security of your information systems.

• Security Policy: Develop and maintain an information security policy tailored to identified risks.

• Incident Management: Establish processes to detect, report, and promptly respond to security incidents.

• Crisis Management: Prepare detailed plans to manage crises caused by cyberattacks or other major incidents.

• Data Backup and Recovery Protocol: Implement regular and secure backup solutions for critical data, with restoration plans in case of loss or corruption.

• Business Continuity and Recovery Plan: Develop plans to ensure operational continuity and rapid recovery after an incident.

• Supply Chain Security: Ensure the security of interactions with suppliers and partners.

• Data Encryption: Implement measures to protect sensitive data through encryption.

• Rights and Access Control: Manage access rights to information and systems based on user needs. Use strong authentication mechanisms to verify user identities.

• Asset Management: Maintain an accurate and up-to-date inventory of IT assets to ensure their adequate protection.

• Communication Security: Ensure the security of internal and external communications.

• HR Management: Implement recruitment, training, and employee management processes that consider security aspects.

2. Obligation for Notification, Contact, and Reporting of Major Incidents

To ensure full compliance with the NIS 2 directive, companies must also adhere to a series of procedures regarding notification, contact, and reporting of major incidents.

• Companies and entities covered by the NIS 2 directive will be required to register with ANSSI (French National Agency for the Security of Information Systems). A pre-registration service is already available to help future regulated entities prepare for this process: ANSSI Pre-registration Service

• They must also provide contact and company identification information, which must be kept up to date at all times.

• In the event of a significant incident, the directive requires notification to the competent national authority, including:

  • An early warning within 24 hours of becoming aware of the incident.

  • A more detailed notification within 72 hours.

  • A final report no later than one month after submitting the incident notification.

EU regulatory update - October 2026: On October 21, 2026, the Council of the European Union adopted its position on the Digital Omnibus, a legislative package aimed, among other things, at simplifying cybersecurity incident reporting under several EU regulations, including NIS2. While the European Commission initially proposed a single EU-wide reporting point, the Council instead supports establishing a national entry point in each Member State, complemented by an EU-level mechanism for coordination and information sharing. These proposals are still subject to legislative negotiations with the European Parliament. They therefore do not currently change the incident reporting obligations or deadlines set out under NIS2.

Severe Consequences for Non-Compliance

During audits, you must be able to document and demonstrate your organization's compliance with protection measures. This underscores the importance of ensuring all executive bodies are aware.

Failure to achieve compliance or inadequate adoption of security measures can result in significant penalties. Financially, a company may face fines of up to 10 million euros or 2% of its total annual turnover.

What Does the Proportionality Rule in NIS 2 Directive Mean?

The proportionality rule applied to the NIS 2 directive aims to adjust regulatory requirements based on the criticality of sectors and the size of the entities involved. Essentially, this means that not all entities will be subject to the same obligations.

The distinction is primarily between entities classified as "essential" (EEs) and "important" entities (EIs). This differentiation can affect:

• Security Measures: There may be different requirements between EEs and EIs, considering the resources and stakes of large companies versus SMEs.

• Audits Conducted:

  • For EEs: Controls may be ex-ante (beforehand) or at the discretion of ANSSI.

  • For EIs: Controls are more likely to be ex-post (after the fact),

• Sanctions: These will generally align with those applied under GDPR:

  • For EE: Up to 2% of global annual turnover.

  • For EI: Up to 1.4% of global annual turnover.

This approach ensures a fair and balanced adaptation of requirements, taking into account both the importance of sectors and the capacity of entities to comply.

NIS 2: Four Essential Resources to Start Preparing Right Away

Although the transposition of the NIS 2 Directive into French law is still ongoing, preparing for the upcoming changes now is crucial. Some measures required by this directive will demand significant time and investments to be fully implemented.

What can you do right now?

• Read the European NIS 2 Directive : Begin by familiarizing yourself with the content of the directive, especially Articles 20 and 21. By studying the original directive articles, you can anticipate the key cybersecurity measures to implement, both organizationally and technically.

• Consult ANSSI's French Cybersecurity Framework (ReCyF): Published in its first working version in March 2026, this framework outlines ANSSI's recommended measures for meeting the security objectives set out by NIS 2. It is a particularly useful resource for anticipating future French requirements.

• Study the ISO 27001 standard : In France, the ISO 27001 standard is renowned for its best practices in information security management. This standard can provide a solid framework to structure your compliance efforts with NIS 2, particularly in terms of risk management and security policy implementation.

• Consult the ANSSI’s IT Hygiene Guide : This practical guide offers recommendations to enhance the security of your information systems. It covers various cybersecurity aspects such as access management, data protection, and secure communications.

Based on these resources, you can identify specific risks relevant to your organization and determine which compliance areas should be prioritized for addressing first.

How Scalingo’s PaaS Can Help You Comply with NIS 2

When it comes to complying with the NIS 2 directive, choosing your service providers is crucial, especially regarding hosting and protecting your data and applications. Opting for a reliable and certified partner like Scalingo is essential to ensure compliance with security standards and safeguard sensitive data.

✅ Integrated Security and Continuous Updates : Scalingo's PaaS provides an infrastructure where security is integrated from the outset. The platform ensures that all critical components provided by Scalingo are regularly updated, minimizing risks from vulnerabilities due to outdated software. This includes regular security updates and patch management, crucial for meeting NIS 2 requirements on vulnerability management.

✅ Compliance with Standards and Certifications : Scalingo adheres to recognized security standards such as ISO 27001:2022, aligning with NIS 2 expectations. Using a platform that is already certified greatly simplifies the compliance process, as many regulatory requirements are covered by the platform. Scalingo also holds HDS 2.0 certification.

✅ Business Continuity and Disaster Recovery : Scalingo integrates data backup and recovery features, ensuring business continuity and quick recovery in case of incidents. The platform facilitates the implementation of the disaster recovery strategies required by NIS 2.

✅ Cybersecurity Support and Expertise : Using Scalingo also means benefiting from the support of a cybersecurity-savvy team. This includes guidance on implementing best security practices and swift incident response, in line with Article 21.2.e of NIS 2.

By leveraging Scalingo's capabilities and certifications, organizations can enhance their readiness for NIS 2 compliance, ensuring robust cybersecurity measures are in place to protect against evolving threats.

Key takeaways

• The NIS 2 directive aims to strengthen the original NIS directive adopted in 2016. It focuses on cybersecurity, data protection, and information system security across several essential and critical sectors. In France, its transposition into national law is still ongoing.
  
  

• NIS 2 strengthens and harmonizes the penalty framework for non-compliance, with different maximum penalties applying to essential and important entities.
  
  

• Opting for a secure cloud provider such as Scalingo can already help meet some requirements of this new directive.
  
  

Originally published on October 16, 2024. Updated in October 2026 to reflect the latest developments regarding the NIS2 Directive and its transposition into French law.