The NIS2, DORA, and AI Act regulations all converge on a common requirement: the ongoing management of risks, usage patterns, and dependencies within the information system, coupled with the ability to provide evidence that these measures are actually being implemented. While this is an operational challenge for CIOs and CISOs, it also involves the accountability of senior executives and the sustainability of the relationship of trust with customers.
This framework is not limited to a simple list of requirements or one-time audits. It requires a structured governance model that links assets, security measures, and service providers. Elit-Technologies transforms these requirements into a comprehensive operational system, from the initial assessment to ongoing monitoring.
What cybersecurity regulations apply to French companies?
Three key documents now outline the obligations of professionals:
The GDPR remains the cornerstone of personal data protection, while the future Cyber Resilience Act will impose security standards on digital products. According to the European Commission’s timeline, reporting obligations will take effect on September 11, 2026, followed by the main requirements in December 2027.
All of these documents follow the same approach: identifying assets, assessing risks, and demonstrating the effectiveness of measures. These regulatory requirements for cybersecurity risk management thus become a cross-functional issue for all departments.
What is the NIS2 Directive, and which organizations are affected?
The NIS2 Directive extends cybersecurity obligations to several thousand French entities. According to ANSSI’s official presentation, it targets 18 key sectors, including energy, healthcare, digital services, and manufacturing.
This text places cybersecurity at the heart of governance: executives must now approve and oversee risk management strategies. For CIOs, this requires complete control over critical assets, access, and service providers.
Supply chain security is becoming a top priority. Even if not directly subject to these standards, an SME may be required to comply with them by its customers. Elit-Technologies helps you map out your scope and maintain the necessary evidence of compliance.
The European NIS2 Directive provides for heavy penalties: up to 10 million euros (or 2% of global revenue) for critical entities, and 7 million euros (or 1.4% of revenue) for significant entities. The specific details will depend on the French transposition law.
What is DORA, and what obligations does it impose on the financial sector?
DORA (Digital Operational Resilience Act) (see the regulation) has been in effect since January 2025 for financial institutions. Its purpose is to ensure the digital security of financial entities and their ability to recover after an incident.
The regulation is structured around five pillars, including ICT risk management, incident reporting, and oversight of third-party service providers.
For IT managers, the challenge lies in managing external dependencies (cloud, managed services). DORA requires that these service providers be bound by contract and that their ability to prevent and document incidents be evaluated.
Elit-Technologies’ solution enables the integration of operational oversight and regulatory reporting, while aligning DORA with NIS2 to share evidence.
What does the AI Act require of companies?
The AI Act regulates the use of artificial intelligence systems within the EU. Safety requirements for AI systems are determined by their intended purpose and their potential impact on individuals.
Certain provisions have been in effect since February 2025. Regulation (EU) 2026/1744 adjusted the timeline for high-risk systems, as detailed in our analysis of the AI Act’s postponement.
The key challenge is identifying Shadow AI. Without an accurate map of actual usage patterns, it is impossible to assess the risks or establish effective governance rules.
Elit-Technologies integrates AI governance into your cybersecurity strategy: inventory of tools, risk assessment, and continuous monitoring to ensure verifiable compliance.
What are the risks for a company in the event of noncompliance?
In addition to fines, noncompliance threatens business continuity and exposes executives to criminal liability. A lack of visibility into a critical service provider can undermine the entire business structure.
Conversely, integrating NIS2, DORA, or the AI Act into day-to-day operations enhances actual security and reassures the company’s ecosystem (partners, investors, insurers).
With 19 years of expertise in cybersecurity and IT infrastructure, Elit-Technologies operates a SOC, a NOC, and a CSIRT. Our expertise is attested by ISO 27001 certification and the ExpertCyber label from Cybermalveillance.gouv.fr.
Our methodology consists of four key steps:
We offer operational support that combines cybersecurity solutions with governance and compliance, while allowing the client to retain control over its final decisions.
What compliance services does Elit-Technologies provide?
Compliance cannot be a one-time audit; it requires a sustainable system. Elit-Technologies implements this system for organizations, either to support or replace internal resources, from the initial assessment through to final verification.
Compliance Mapping and Assessment
We identify your digital assets, licenses, and usage patterns, including Shadow AI. This inventory allows us to establish a documented baseline and accurately measure any discrepancies from the regulatory framework.
Monitoring and Incident Response
Our certified SOC provides 24/7 monitoring. Incidents are handled by dedicated experts, with no per-incident charges, and include immutable backups to ensure business continuity.
Regulatory Documentation and Support
We develop the required deliverables (PSSI, logs, notifications) to translate the complexity of NIS2, DORA, or the AI Act into concrete documents that your teams can use.
Governance of AI Use
We integrate AI into your overall security framework: mapping usage patterns, assessing risks, and defining a compliance roadmap for truly verifiable governance.
These services are built on a sovereign infrastructure operated in France, ensuring maximum protection for your data.
How does ECP + ELIA make it easier to manage compliance?
The ECP platform centralizes the management of your information system. It is powered by ELIA, our sovereign AI hosted in France (Full Souverain offering), which can query your data using natural language.
ECP + ELIA provides a consolidated view of assets and risks, simplifying the tracking of action plans and audit preparation. AI speeds up access to information, while our experts retain decision-making authority.
Assess your regulatory exposure and take your first steps with an Elit-Technologies expert: Schedule an appointment.
Frequently Asked Questions
What are the main regulations in the cybersecurity regulatory framework?
The framework is based on NIS2 (networks and information systems), DORA (finance), the AI Act (AI systems), and the GDPR (personal data), supplemented by the future Cyber Resilience Act.
What is the difference between the GDPR and NIS2?
The GDPR focuses on personal data. NIS2 addresses the overall security of information systems and the supply chain. Compliance with one does not guarantee compliance with the other.
How can I tell if my company is subject to NIS2 or DORA?
It depends on the sector, size, and status of the financial institution. A scope analysis is essential to identify your direct or contractual obligations.
Where should you start when implementing a cybersecurity or AI Act compliance program?
An “AI Readiness” audit or a regulatory assessment can help you identify gaps as a priority and map out your path to compliance.