--- id: CP-366 slug: directive-nis-2 lang: en title: NIS 2 Directive description: What the NIS 2 Directive asks of organisations and their managers, what it changes for each employee, and where the law stands in France. canonical_url: https://startbrain.io/cyberpedia/en/articles/directive-nis-2/ markdown_url: https://startbrain.io/cyberpedia/en/articles/directive-nis-2.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "NIS 2 Directive", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/directive-nis-2/ (CC BY 4.0) wing: 6 theme: report_incidents reflex: cr-017 schema: G3 updated: "2026-10-26" translations: en: https://startbrain.io/cyberpedia/en/articles/directive-nis-2/ fr: https://startbrain.io/cyberpedia/fr/articles/directive-nis-2/ de: https://startbrain.io/cyberpedia/de/articles/richtlinie-nis-2/ es: https://startbrain.io/cyberpedia/es/articles/directiva-nis-2/ sources: - "n": 1 title: Directive (UE) 2022/2555 du Parlement européen et du Conseil du 14 décembre 2022 concernant des mesures destinées à assurer un niveau élevé commun de cybersécurité dans l'ensemble de l'Union, modifiant le règlement (UE) n° 910/2014 et la directive (UE) 2018/1972, et abrogeant la directive (UE) 2016/1148 (directive SRI 2) publisher: EUR-Lex, Official Journal of the European Union url: https://eur-lex.europa.eu/eli/dir/2022/2555/oj?locale=fr published: "2022-12-27" accessed: "2026-10-26" - "n": 2 title: NIS 2 | MesServicesCyber publisher: ANSSI url: https://messervices.cyber.gouv.fr/nis2 accessed: "2026-10-26" - "n": 3 title: SME definition publisher: European Commission url: https://single-market-economy.ec.europa.eu/smes/sme-fundamentals/sme-definition_en accessed: "2026-10-26" - "n": 4 title: "Violations de données personnelles : les règles à suivre" publisher: CNIL url: https://www.cnil.fr/fr/violations-de-donnees-personnelles-les-regles-suivre published: "2018-06-19" accessed: "2026-10-26" - "n": 5 title: Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity publisher: European Commission url: https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules published: "2026-07-08" accessed: "2026-10-26" - "n": 6 title: Résilience des infrastructures critiques et renforcement de la cybersécurité publisher: Senate (France) url: https://www.senat.fr/leg/pjl24-033.html published: "2024-10-15" accessed: "2026-10-26" - "n": 7 title: "Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité : dossier législatif" publisher: National Assembly (France) url: https://www.assemblee-nationale.fr/dyn/17/dossiers/DLR5L17N50731 accessed: "2026-10-26" - "n": 8 title: Réunion du mardi 22 septembre 2026 publisher: National Assembly (France), Conference of Presidents (record of conclusions) url: https://www2.assemblee-nationale.fr/17/la-conference-des-presidents/releve-de-conclusions/reunion-du-mardi-22-septembre-2026 published: "2026-09-22" accessed: "2026-10-26" - "n": 9 title: Réunion du mardi 6 octobre 2026 publisher: National Assembly (France), Conference of Presidents (record of conclusions) url: https://www2.assemblee-nationale.fr/17/la-conference-des-presidents/releve-de-conclusions/reunion-du-mardi-6-octobre-2026 published: "2026-10-06" accessed: "2026-10-26" --- # NIS 2 Directive NIS 2 is Directive (EU) 2022/2555, adopted on 14 December 2022, which sets a common level of cybersecurity across the European Union for organisations whose services matter to the economy and society. It replaces the first NIS Directive, which dated from 2016 [1]. In France, ANSSI states that several thousand entities, spread across 18 sectors of activity, will be covered: mostly medium-sized and large companies, local authorities and government bodies [2]. The directive asks states to impose security measures and short deadlines for reporting serious incidents on these organisations, and to make their managers responsible for implementation [1]. According to the European Commission, most member states have transposed it into their national law [5]. France is one of the four countries that the Commission referred to the Court of Justice of the European Union on 8 July 2026, for failing to transpose it fully [5]. ## In 30 seconds - Who is covered: companies and public bodies in the 18 sectors concerned, including energy, transport, health, water, digital infrastructure and part of industry, generally from the size of a medium-sized company upwards. - What it changes for you: in France, once the transposition law is in force, stricter security rules at work, training, and a first alert to be sent within 24 hours after a serious incident. - The reflex: report any security incident to the cybersecurity team as soon as you notice it, even if you doubt how serious it is. - If it is already done: did you click a dubious link, lose a device or notice something abnormal a few days ago without telling anyone? Report it now, the information is still useful. ## Straight answers ### Is my company covered? Two criteria matter: sector and size. The directive covers entities in the sectors listed in its Annexes I and II that are at least medium-sized companies, and certain entities whatever their size, such as DNS service providers or trust service providers [1]. Under the European definition, a company stops being small at 50 employees, or if its turnover and its balance sheet total both exceed 10 million euros [3]. These thresholds apply to the company alone, but a company that belongs to a group may have to count the group's headcount and figures as well [3]. Under the directive, large companies in the Annex I sectors are in principle "essential entities", most others are "important entities", and the maximum penalties differ from one category to the other [1]. ### Do I risk a penalty as an employee? The penalties provided for by the directive target entities and their managers [1]. What will affect you day to day are the internal rules your employer puts in place to comply, such as training, two-factor authentication or the reporting procedure. ### Has France transposed NIS 2? Not yet, as of the date this article was updated. ANSSI states that transposition is under way [2], and the bill that carries it, adopted by the Senate, has not yet been examined in a public sitting of the National Assembly [7]. ## What it changes for employees For an employee, NIS 2 will mainly mean clearer internal rules, in France once the transposition law is in force. Article 21 asks each entity concerned to take a minimum list of measures, including basic cyber hygiene practices, cybersecurity training, access control policies and, as appropriate, multi-factor authentication [1]. Article 20 also asks states to encourage entities to train their staff regularly, so that everyone can spot risks and judge security practices [1]. The point that depends most on you is incident reporting. The directive asks an entity to send an early warning to the CSIRT or the competent authority within 24 hours of becoming aware of a significant incident, then an incident notification within 72 hours and a final report within one month after that [1]. These deadlines lose their meaning if the information stays stuck along the way. A suspicious email opened on Monday and reported on Thursday means three days during which an attacker could move forward with nobody looking for them. Under the directive, an incident is "significant" if it causes, or can cause, severe disruption of services or financial loss for the entity, or considerable damage to other people [1]. Sorting is up to the security team; your role is to report. If the incident involves personal data, the GDPR adds its own obligation: notify the CNIL no later than 72 hours after a breach that presents a risk to individuals [4]. The article on the GDPR details this procedure. In the Brain programme, this action matches the reflex "Report any security incident to the cybersecurity team". Also report your own mistakes, an unfortunate click for example: without your report, the security team may never learn that an attack has begun. The article on blame culture explains why fear of being punished leads people to hide incidents. ## What it changes for management NIS 2 brings cybersecurity up to the level of management bodies. The directive asks that they approve the risk management measures and oversee their implementation, that they can be held liable if the entity infringes these obligations, and that their members undergo training [1]. In France, these obligations will apply once the transposition law is in force. For fines, states must provide for a ceiling of at least 10 million euros or 2% of worldwide annual turnover, whichever is higher, when an essential entity fails its security or reporting obligations. For an important entity, this ceiling is at least 7 million euros or 1.4% [1]. In an essential entity that does not remedy its failings despite the authority's orders, the directive also allows the authority to request that a person with managerial responsibilities, at chief executive or legal representative level, be temporarily banned from exercising those responsibilities in the entity [1]. Supply chain security is among the measures the directive requires, including relationships with direct suppliers and service providers [1]: the article on supplier risk assessment is devoted to it. To help organisations, ANSSI has published a working version of its Référentiel Cyber France (ReCyF), which lists the measures it recommends for meeting the security objectives of NIS 2 [2]. A tabletop crisis exercise makes it possible to check, before a real incident, that the alert can go out in under 24 hours. ## What the text says The directive was published in the Official Journal of the European Union on 27 December 2022. States had to transpose it by 17 October 2024 at the latest and apply it from 18 October 2024, the date on which the 2016 NIS Directive was repealed [1]. They also had to draw up the list of their essential and important entities by 17 April 2025 at the latest [1]. Article 21 sets a minimum list of measures, based on an "all-hazards" approach [1]: - risk analysis and information system security policies; - incident handling; - business continuity, backups and crisis management; - supply chain security; - security in the acquisition, development and maintenance of networks and information systems, including vulnerability handling and disclosure; - assessment of the effectiveness of the measures; - basic cyber hygiene and cybersecurity training; - cryptography and, where appropriate, encryption; - human resources security, access control and asset management; - multi-factor authentication and secure communications, as appropriate. Article 23 sets the timetable for reporting a significant incident [1]: ```text Deadlines counted from the moment the entity becomes aware of the significant incident 24 hours early warning to the CSIRT or the competent authority 72 hours incident notification, with an initial assessment of severity and impact on request intermediate report 1 month final report, counted from the incident notification ``` ## Where implementation stands The European Commission sent letters of formal notice on 28 November 2024, then reasoned opinions on 7 May 2025. On 8 July 2026, it brought Ireland, Spain, France and the Netherlands before the Court of Justice of the European Union, asking for a lump sum and daily penalty payments until transposition is complete [5]. In France, transposition goes through the bill on the resilience of critical infrastructure and the strengthening of cybersecurity. In its tabled version, its Title II, devoted to cybersecurity, refers to Directive (EU) 2022/2555 and defines essential and important entities, with for example a threshold of at least 50 employees for an important entity [6]. The government tabled it in the Senate on 15 October 2024, under the accelerated procedure, and the Senate adopted it on 12 March 2025. The National Assembly's special committee tabled its text on 10 September 2025 [7]. The Assembly's Conference of Presidents had scheduled the bill for the sittings of 7 and 9 October 2026 [8], then removed it on 6 October 2026, without setting a new date [9]. At the time of consultation, the legislative file mentions no examination in a public sitting of the Assembly [7]. Meanwhile, ANSSI invites future essential and important entities to strengthen their security level now, and states that its ReCyF framework may be adjusted as parliamentary debates proceed [2]. ## Sources 1. EUR-Lex, Official Journal of the European Union, "Directive (UE) 2022/2555 du Parlement européen et du Conseil du 14 décembre 2022 concernant des mesures destinées à assurer un niveau élevé commun de cybersécurité dans l'ensemble de l'Union, modifiant le règlement (UE) n° 910/2014 et la directive (UE) 2018/1972, et abrogeant la directive (UE) 2016/1148 (directive SRI 2)", 27 December 2022. https://eur-lex.europa.eu/eli/dir/2022/2555/oj?locale=fr (accessed 26 October 2026) 2. ANSSI, "NIS 2 | MesServicesCyber". https://messervices.cyber.gouv.fr/nis2 (accessed 26 October 2026) 3. European Commission, "SME definition". https://single-market-economy.ec.europa.eu/smes/sme-fundamentals/sme-definition_en (accessed 26 October 2026) 4. CNIL, "Violations de données personnelles : les règles à suivre", 19 June 2018. https://www.cnil.fr/fr/violations-de-donnees-personnelles-les-regles-suivre (accessed 26 October 2026) 5. European Commission, "Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity", 8 July 2026. https://digital-strategy.ec.europa.eu/en/news/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules (accessed 26 October 2026) 6. Senate (France), "Résilience des infrastructures critiques et renforcement de la cybersécurité", 15 October 2024. https://www.senat.fr/leg/pjl24-033.html (accessed 26 October 2026) 7. National Assembly (France), "Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité : dossier législatif". https://www.assemblee-nationale.fr/dyn/17/dossiers/DLR5L17N50731 (accessed 26 October 2026) 8. National Assembly (France), Conference of Presidents (record of conclusions), "Réunion du mardi 22 septembre 2026", 22 September 2026. https://www2.assemblee-nationale.fr/17/la-conference-des-presidents/releve-de-conclusions/reunion-du-mardi-22-septembre-2026 (accessed 26 October 2026) 9. National Assembly (France), Conference of Presidents (record of conclusions), "Réunion du mardi 6 octobre 2026", 6 October 2026. https://www2.assemblee-nationale.fr/17/la-conference-des-presidents/releve-de-conclusions/reunion-du-mardi-6-octobre-2026 (accessed 26 October 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/directive-nis-2/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.