NIS2: prepare the ground without waiting for the last decree
The European NIS2 directive (2022/2555) considerably widens the scope of cybersecurity obligations across Europe. Where the first NIS directive mainly targeted certain critical operators (around 500 entities in France, for example), NIS2 raises that number to 10,000, or even 15,000 to 18,000 companies in France alone depending on the source, split between essential and important entities. The same change of scale applies in every Member State: the directive now reaches a large part of the economy, well beyond the traditional operators of critical infrastructure.
Where transposition stands: the French example
Member States had until 17 October 2024 to transpose NIS2 into national law, and many missed that date. France is a telling example of a legislative timetable that has fallen behind other Member States. Its transposition text, the bill on the resilience of critical infrastructure and the strengthening of cybersecurity (projet de loi Résilience), transposes NIS2 together with the CER and DORA directives. It was adopted by the Senate on 12 March 2025 under the accelerated procedure. In the National Assembly, the special committee adopted its text on 10 September 2025, but the debate in plenary was postponed several times: scheduled for 7 and 9 October 2026, it was withdrawn from the agenda again on 6 October by the Conference of Presidents, with no new date set. In early October 2026, the law has therefore been neither finally adopted nor enacted. If the two chambers do not agree on the same text, a joint committee will follow, then the implementing decrees and orders: NIS2 will only take effect in France once all of these texts are published.
The delay now has legal consequences: on 8 July 2026, the European Commission referred France, along with Spain, Ireland and the Netherlands, to the Court of Justice of the European Union for failing to notify full transposition of NIS2, asking the Court to impose a lump sum and daily penalty payments until transposition is complete.
Entities covered in France under the former NIS1 directive: around 500
Entities covered in France under NIS2: 10,000 to 18,000 depending on estimates
Maximum penalty for essential entities: up to €10 million or 2% of worldwide turnover
Maximum penalty for important entities: up to €7 million or 1.4% of worldwide turnover
Adoption by the French Senate (first reading): 12 March 2025
Text of the National Assembly special committee: 10 September 2025
Referral by the European Commission to the CJEU: 8 July 2026
Plenary debate in the National Assembly: withdrawn from the agenda on 6 October 2026, no new date set
Status in early October 2026: neither finally adopted nor enacted
This delay should not be read as a signal to wait: on 17 March 2026, ANSSI, the French national cybersecurity agency, presented working version 2.5 of ReCyF (Référentiel Cyber France), supplemented on 7 September 2026 by practical guidance sheets, which details the concrete measures recommended to meet the NIS2 security objectives. The framework remains a non-binding working document that may change with the parliamentary debates: ANSSI will only publish a final version after transposition. It nonetheless already gives a clear roadmap to anyone who prefers anticipating to reacting, wherever they operate in the EU.
A considerably wider scope
So-called essential and important entities, depending on their sector, their size and their role in the value chain.
Sectors such as energy, transport, health, water, digital infrastructure, certain digital services, public administration, critical manufacturing and waste management.
Subcontractors and suppliers, even when they are not directly regulated, because the clients concerned will tighten their contractual requirements.
The right reflex: do not wait to find out whether your company is officially in scope before dealing with the basics. NIS2 requirements largely overlap with the cybersecurity good practice expected by insurers, large corporate customers and partners. With a scope that grows from 500 to potentially 18,000 companies in France alone, the likelihood of being concerned, directly or through a client, has been multiplied considerably.
Essential or important entities: two distinct regimes
NIS2 does not put every organisation concerned on the same footing. It distinguishes two categories, essential entities and important entities, according to sector and size. This distinction is not just a label: it determines the supervisory regime and the level of penalties. Essential entities, considered the most critical, are subject to stricter supervision, including possible proactive inspections, and face the heaviest penalties, up to €10 million or 2% of worldwide turnover.
Important entities fall under a lighter regime, with checks generally triggered after the event, following an incident or a report, and a lower penalty ceiling, up to €7 million or 1.4% of turnover. For an SME, the first step is therefore to determine not only whether it is concerned, but which category it falls into, because expectations and financial risks differ significantly from one to the other.
In practice, national authorities provide tools to answer that question. In France, ANSSI offers an official self-assessment tool, MonEspaceNIS2, which helps each organisation find out whether it is in scope and under which regime. Checking with the competent authority of your own country is a good starting point to remove uncertainty without waiting for the decrees, and to calibrate the effort to what will actually be required.
Obligations to anticipate
Risk analysis: identify critical assets, dependencies, threats and vulnerabilities, starting with the systems whose unavailability would have the most direct impact on the business.
Security measures: patch management, access control, backups, encryption, logging, segmentation, MFA and hardening of sensitive environments.
Incident management: the ability to detect, qualify, contain and notify a significant incident within the required deadlines.
Business continuity: disaster recovery and business continuity plans, restore tests, crisis procedures and clearly defined roles.
Management accountability: cybersecurity becomes a governance matter, not just a technical one, with substantial financial penalties at stake (up to €10 million for essential entities).
Much tighter notification deadlines
One concrete change deserves to be anticipated now, regardless of when each national law is finally enacted: NIS2 cuts the deadline for the first notification of a significant incident to the national CSIRT or competent authority (ANSSI in France) to 24 hours after detection. This early warning is followed by an incident notification within 72 hours, then a detailed final report within one month. Meeting such a short deadline requires detection and internal escalation capabilities that are already well rehearsed, not improvised on the day of the incident, which is why it makes sense to start now with minimum logging and a documented incident procedure.
Another notable development: Article 32 of the directive provides for the possible personal liability of managers in the event of serious failings, with measures that can go as far as a temporary suspension from their duties. Cybersecurity thus becomes a matter of individual responsibility for management, not just an IT budget line.
Why start now
NIS2 compliance is not about producing a document. It means moving the organisation forward: inventory, internal policies, evidence, procedures, training and follow-up. The longer a company waits, the more the effort risks being concentrated in a rush, with costly and less accepted decisions, especially as the French legislative timetable, like that of other late countries, leaves little visibility on the exact date when binding obligations take effect.
Many of these measures overlap with the good practice in our SME security audit checklist: getting started means progressing at once on compliance, cyber insurance and real resilience. To take action, see also our 90-day NIS2 action plan.
Anticipate rather than be driven by the timetable
Uncertainty about the exact date of entry into force must not become an excuse for waiting. The measures expected by NIS2 (asset inventory, access management, tested backups, detection and incident procedure) are exactly those already demanded by cyber insurers and large clients. Getting started now means progressing in one move on regulatory compliance, insurability and real resilience, without waiting for the urgency of the last decree. Better still, for an SME that works as a supplier, being able to demonstrate a solid security baseline becomes a commercial argument with clients who are themselves subject to NIS2 and pass their requirements down their entire supply chain.
We support this preparation with an audit of your Active Directory and cybersecurity awareness training for your teams, delivered remotely; to take action, see also our 90-day NIS2 action plan. We help you implement the technical measures; we do not provide legal advice on your status. Contact us to review your exposure.
Sources: ANSSI, the NIS2 directive (in French) · French National Assembly, legislative file of the Resilience Bill (in French) · Leto, withdrawal from the agenda on 6 October 2026 · European Commission, referral of four Member States to the Court of Justice (8 July 2026) · ANSSI MesServicesCyber, ReCyF and practical sheets (in French) · EUR-Lex, Directive (EU) 2022/2555