NIS2 Directive
NIS2 · NIS 2 · Directive (EU) 2022/2555 · essential entities · important entities · Resilience Bill · MonEspaceNIS2
A 2022 EU directive that requires thousands of organisations in 18 sectors to take cybersecurity measures, report significant incidents and hold their management directly accountable.
In practice
As of 7 October 2026, France has not yet transposed the directive: the “Resilience” bill, passed by the Senate on 12 March 2025, is still waiting for its floor debate in the National Assembly (the one planned for 7 October 2026 was postponed with no new date), and the European Commission referred France to the EU Court of Justice on 8 July 2026. The expected obligations are known: risk management measures (Article 21: risk analysis, incident handling, business continuity, supply chain, MFA, training) and approval and training by management (Article 20). A significant incident is reported in three stages: early warning within 24 hours, notification within 72 hours, final report within one month. Fines could reach €10 million or 2% of worldwide turnover for an essential entity, and €7 million or 1.4% for an important entity.
Fictional case: a 120-employee IT services company that manages systems for local authorities checks its status on MonEspaceNIS2, ANSSI’s online tool: it would most likely be an important entity. Without waiting for the law, it rolls out MFA everywhere, formalises its incident handling and trains its executive committee.
