Directive (EU) 2022/2555

Currently being transposed in France: the obligations are not yet enforceable, but preparation is under way.

Regulatory status verified on . Source: ANSSI, page on the NIS 2 Directive.

NIS2 compliance: scope of the entities caught, notification duties and penalties

NIS2 compliance begins with scope, because the Directive widens that of its predecessor considerably, and does so by a mechanism that catches organisations which never regarded themselves as critical operators. Assessment runs through three filters: the sector under Annexes I and II, the size of the entity, and a series of exceptions that override the size rule entirely. Sila runs the three and documents the result.

By Younès Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .

Who is caught

Article 2(1) applies the Directive to public or private entities of a type referred to in Annex I or Annex II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed those ceilings. In practice this means entities employing at least 50 persons, or whose annual turnover and annual balance sheet total each exceed EUR 10 million.

Article 2(2) sets that size rule aside in several cases, so an organisation of ten people can fall squarely within the Directive: providers of public electronic communications networks or publicly available electronic communications services, trust service providers, TLD name registries and DNS service providers, regardless of size; sole providers of a service essential to the maintenance of critical societal or economic activities; entities whose disruption could have a significant impact on public safety, security or health, or induce significant systemic risk; entities critical because of their specific importance at national or regional level; and public administration entities.

Article 3 then divides the entities caught into two categories, which carry the same substantive obligations but different supervision and penalty regimes.

Essential entities, Article 3(1)

Broadly, entities of a type referred to in Annex I exceeding the ceilings for medium-sized enterprises — at least 250 employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million — together with the categories caught regardless of size, entities identified as critical under Directive (EU) 2022/2557, and entities identified as operators of essential services under the previous NIS directive.

Important entities, Article 3(2)

Defined by difference: entities of a type referred to in Annex I or II that do not qualify as essential. In practice, medium-sized entities in Annex I sectors and all entities caught in Annex II sectors.

Annex I, highly critical sectors

Energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space.

Annex II, other critical sectors

Postal and courier services, waste management, manufacture, production and distribution of chemicals, production, processing and distribution of food, manufacturing of certain products, digital providers and research organisations.

Concrete obligations and notification deadlines

Article 21 requires appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems, based on an all-hazards approach. Article 21(2) lists ten minimum elements, from risk analysis policies to the use of multi-factor authentication.

Article 20 places responsibility on management bodies: they must approve the risk-management measures, oversee their implementation, may be held liable for infringements, and are required to follow training.

Article 23 organises notification of significant incidents in successive stages, each running from the moment the entity becomes aware of the incident.

Early warning, within 24 hours

Indicating whether the significant incident is suspected of being caused by unlawful or malicious acts, and whether it could have a cross-border impact.

Incident notification, within 72 hours

Updating the early warning and providing an initial assessment of the incident, including its severity and impact, and indicators of compromise where available. For trust service providers this period is reduced to 24 hours where the incident affects the provision of their trust services.

Final report, within one month of the notification

A detailed description of the incident including its severity and impact, the type of threat or root cause that likely triggered it, the mitigation measures applied and ongoing, and where applicable the cross-border impact. Where the incident is still ongoing, a progress report is provided instead, and the final report within one month of handling the incident.

What makes an incident significant, Article 23(3)

An incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned, or if it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

Penalties and competent authority

Article 34 requires Member States to provide, for essential entities, administrative fines with a maximum of at least EUR 10 000 000 or at least 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. For important entities, that floor is set at EUR 7 000 000 or 1.4 %, on the same basis.

Article 32 subjects essential entities to ex ante supervision: on-site inspections and off-site supervision, security audits and requests for information may be carried out without the authority having to establish a prior infringement. Article 33 subjects important entities to ex post supervision only.

Article 32(5) goes further for essential entities alone: in the event of persistent infringement, the authority may temporarily suspend a certification or authorisation, and request a temporary ban on a natural person exercising managerial responsibilities from exercising those functions.

The competent authority, the national thresholds and the registration arrangements follow from national transposition. France is in the process of transposing the Directive: the obligations are not yet enforceable, but preparation is under way. As at the verification date shown at the top of this page, the ANSSI still refers to the text as a draft bill on the resilience of critical infrastructure and the strengthening of cybersecurity, and the implementing decrees have not been published. The ANSSI has, since 17 March 2026, been publishing the Cyber France Reference Framework (ReCyF), which corresponds to the cybersecurity framework referred to in Article 14 of that bill, as a working document and by default non-binding. No forecast date for enactment is given here, and none should be inferred.

Why start preparing now

The obligations are not yet enforceable in French law. There are nonetheless three reasons, all verifiable in the text itself, not to wait for the implementing decrees.

Supply chain requirements are already being passed down by contract

Article 21(2)(d) requires entities within scope to address supply chain security, including the security-related aspects of the relationships between each entity and its direct suppliers or service providers. Article 41 set 17 October 2024 as the transposition deadline for all Member States. A company whose customer is within scope in a Member State where transposition has taken place therefore sees those requirements arrive contractually, irrespective of the state of French law. The supplier is not within scope; its customer is, and passes the obligation down.

The measures required cannot be put in place quickly

Article 21(2) lists ten categories of measures, none of which is a matter of technical configuration: risk analysis policies, incident handling, business continuity and backup management, supply chain security, security in acquisition and development, procedures to assess effectiveness, cyber hygiene practices and training, cryptography, human resources security and access control, and multi-factor authentication. Article 20 adds approval of those measures by the management bodies and a training obligation on them. Article 23 further presupposes a written procedure designating in advance who classifies an incident and who notifies it, without which the 24-hour deadline cannot be met.

The measures overlap with the GDPR and DORA

The security measures of Article 21 overlap with those Article 32 of Regulation (EU) 2016/679 already imposes on every controller, and the notification procedure of Article 23 has in any event to be articulated with that of Article 33 GDPR, whose deadline and authority differ. For financial entities, Article 4 of the Directive disapplies its own risk-management and notification obligations in favour of Regulation (EU) 2022/2554, which imposes equivalent requirements. Work started today on any one of these regimes therefore serves the others, and ordering it once costs less than doing it three times.

How Sila engages

The engagement starts with the assessment of scope, which is the step most often carried out too quickly: the type of entity under the Annexes, size under Recommendation 2003/361/EC, and every exception in Article 2. The conclusion is documented, because an entity that concludes it is outside the scope must be able to show on what basis.

Where the entity is caught, the work covers the registration duty under Article 3(4), the ten measures of Article 21(2), the written incident notification procedure, which is the only way the 24-hour deadline can be met, and the governance and training requirements of Article 20.

The method, in four steps

  1. 01Gap assessment

    Establishing whether, and on what basis, the instrument applies to the activity as it is actually carried out, then comparing what the instrument requires against what already exists inside the organisation. The assessment ends with a ranked list of gaps, not an overall score. An organisation that falls outside the scope learns so at this stage, and the engagement stops there.

  2. 02Mapping

    Recording what the measures will apply to: processing activities and data flows, systems, service providers, contracts in force, roles and responsibilities. The map is the working document for everything that follows, and it is the document produced to a supervisory authority in the event of an inspection.

  3. 03Technical and organisational measures

    Implementing the measures the mapping has shown to be necessary: internal procedures, policies, contractual clauses to be renegotiated with providers, governance decisions, and training for the people concerned. Measures that sit inside the information system are specified by Sila and implemented by your own teams or your IT provider.

  4. 04Evidence file

    Assembling the file that can be produced to a supervisory authority: records, impact assessments, dated and versioned policies, decision trails, proof of training. Compliance is not demonstrated by the absence of an incident but by the production of this file, which means it has to be kept current once the engagement ends.

A tailored quotation within 48 hours

The scope of an engagement cannot be guessed at: it depends on whether and how the instrument applies to you, on the number of processing activities, systems and contracts involved, and on what already exists inside your organisation. No amount is therefore published on this site.

The process starts with a scoping discussion, at no charge and without commitment, to define what the engagement will cover. A tailored quotation follows within 48 hours, setting out the scope, the deliverables and the amount.

Frequently asked questions

Which companies are caught by NIS2?

Article 2 of Directive (EU) 2022/2555 applies to entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Recommendation 2003/361/EC or exceed those ceilings, that is, broadly, entities employing at least 50 persons or with turnover and balance sheet total each above EUR 10 million. Article 2(2) sets that size rule aside for certain categories, including providers of public electronic communications services, trust service providers, DNS service providers and TLD registries, and public administration entities, which are caught regardless of size.

What is the difference between an essential and an important entity?

The substantive obligations are identical: the risk-management measures in Article 21 and the notification duties in Article 23 apply the same way. The difference is in supervision and penalties. Article 32 subjects essential entities to ex ante supervision, Article 33 subjects important entities to ex post supervision only. Article 34 requires a fine ceiling of at least EUR 10 000 000 or 2 % of worldwide turnover for essential entities, and at least EUR 7 000 000 or 1.4 % for important entities.

Within what period must an incident be notified under NIS2?

Article 23(4) of Directive (EU) 2022/2555 requires an early warning without undue delay and in any event within 24 hours of becoming aware of the significant incident, an incident notification within 72 hours, and a final report within one month of the notification. Where the incident is still ongoing at that point, a progress report is submitted instead, followed by the final report within one month of handling the incident.

Does NIS2 apply to a company established outside the European Union?

It applies where the entity provides services within the Union and falls within one of the types listed in the Annexes. Article 26 sets out the rules of jurisdiction, and provides in particular that certain categories of entity are deemed to be under the jurisdiction of the Member State where they have their main establishment in the Union, with a duty to designate a representative where they are not established in the Union but offer services there.

What this regime triggers elsewhere

Article 4 of Directive (EU) 2022/2555 disapplies its risk-management and notification obligations where a sector-specific Union act imposes at least equivalent requirements. For the financial entities listed in Article 2 of Regulation (EU) 2022/2554, DORA applies on that basis.

Telling NIS2 from DORA for a financial entity

A cybersecurity incident affecting personal data triggers two separate notifications, to two authorities, on two timescales. The internal procedure has to provide for both, or the 24-hour deadline is missed as a matter of course.

Aligning NIS2 and GDPR notification

Annex III point 2 of Regulation (EU) 2024/1689 classifies as high risk AI systems intended to be used as safety components in the management and operation of critical digital infrastructure.

Classifying an AI system in critical infrastructure

Reference texts

The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.