For organizations across all sectors, the regulatory framework and cybersecurity have become inextricably linked. The EU’s NIS2 Directive 2022/2555 imposes specific obligations on tens of thousands of French entities. CIOs, CISO, IT managers, and executives in critical sectors: Elit-Technologies outlines the specific requirements of this directive.
What is the NIS2 Directive?
This European directive strengthens the security of the networks and information systems of businesses and organizations in the EU. It replaces the first NIS Directive from 2016, which was deemed too limited.
What requirements does NIS2 impose on French organizations?
The directive is based on four pillars:
The logic behind the NIS2 Directive is comprehensive: reporting an attack allows other organizations to protect themselves against it. For example, an energy provider or a hospital that is paralyzed affects an entire chain of services. That is why Article 21 extends the requirement to supply chain security.
This has an indirect consequence: even though they are not directly affected, many small and medium-sized enterprises must bring their operations up to standard at the urging of their partners who are subject to these requirements.
Is your company affected by NIS2?
The regulatory threshold applies to medium-sized organizations. If your company operates in a critical sector, it is subject to these regulations regardless of its size. As a result, approximately 15,000 to 180,000 French entities will now be subject to regulation, compared to 300 to 500 under the previous directive (source: ANSSI).
A medium-sized hospital or a regional IT service provider are typical examples oforganizations subject to NIS2.
Are you an essential entity or an important entity?
| Question | If yes | If not |
|---|---|---|
| 1Doesyourorganization operate in a sector covered by NIS2 (energy, transportation, healthcare, digital services, water, government, financial services, waste management, manufacturing, food, etc.)? | Yes Proceed to the next question. | No You are likely not subject to NIS2 (unless specifically designated by the authorities). |
| 2Isyourorganization a large or medium-sized business (at least 50 employees or 10 million euros in revenue or total assets)? | Yes You are likely subject to NIS2. | No Check whether a specific provision nevertheless applies to you (for example, due to your critical role). |
| 3. Does your activity fall within the highest critical sectors (e.g., energy, transport, banking, financial market infrastructure, healthcare, drinking water, digital infrastructure, public administration, space)? | Essential entity You are very likely a key entity. | Important entity You are most likely an important entity if your sector is among the other sectors covered by NIS2. |
The difference between an essential entity and an important entity does not lie in cybersecurity requirements, which are largely the same. It mainly concerns the level of oversight by the authorities:
- Key element: proactive oversight with the option of regular checks;
- Significant entity: Oversight is generally initiated following an incident, a report, or indications of noncompliance.
Has the NIS2 Act been implemented in France?
France missed the October 2024 deadline for transposition. The Resilience Act was passed by the Senate in March 2025 but is still awaiting a final vote. However, ANSSI explicitly recommends not waiting for this vote to take action. Achieving compliance takes several months, and the Référentiel Cyber France (ReCyF), published in March 2026, already provides a framework for structuring your approach.
What penalties apply for non-compliance with the NIS2 Directive?
The penalties provided for under NIS2 are:
By way of comparison, a cyberattack costs a French organization an average of 59,000 euros and up to 64,000 euros for a large company (source: Asterès study for CriP—June 2023, 2022 data).
As for GDPR penalties, they can reach 20 million euros or 4% of annual revenue.
How does Elit-Technologies help you achieve NIS2 compliance?
Elit-Technologies has been an expert in cybersecurity governance and compliance for nearly 20 years. As an “Expert Cyber” certified company with an ISO 27001-certified SOC, we support organizations in meeting the requirements of each pillar of NIS2. Our ECP + ELiA platform, a sovereign AI solution hosted in France, provides a clear mapping of the information system. It facilitates the management of the documented compliance required by the directive.
Does NIS2 apply to your company? Assess your situation, request a compliance audit, or speak directly with an Elit-Technologies expert.
Frequently Asked Questions
What requirements does the NIS2 Directive impose on my IT team?
The NIS2 Directive requires the IT team to strengthen cybersecurity by:
- cybersecurity risk management;
- appropriate protective measures;
- incident detection and response;
- supplier security;
- documentation of practices.
Please note, however, that ultimate responsibility lies with management.
Does NIS2 apply to my company?
Your company is likely affected if:
- It operates in a sector covered by NIS2 (health care, energy, transportation, digital services, water, financial services, etc.).
- It has at least 50 employees or generates at least 10 million euros in annual revenue or total assets.
For example, a company with 50 employees that specializes in medical devices or a healthcare facility generally falls within the scope of NIS2. If in doubt, check the criteria set forth in the regulations.
Are my suppliers affected by NIS2?
Some of your suppliers may be directly subject to NIS2. Even when they are not, the directive requires you to manage supply chain risks. You must therefore:
- assess their level of security;
- Include cybersecurity requirements in your contracts;
- monitor the risks they may pose to your information systems.
How long does it take to achieve NIS2 compliance?
The timeline depends on your level of cybersecurity maturity. An organization that is already well-structured may need 3 to 6 months, while a company that needs to formalize its processes and strengthen its security measures will often need to allow 6 to 18 months. The key is to adopt a phased, documented approach supported by an expert such as Elit-Technologies.