Who is in scope
Scope follows sector and size: medium and large organizations in the sectors of Annexes I and II are in, as essential or important entities depending on sector and size, with some entities in regardless of size (trust service providers, DNS, public administration, entities designated as critical). The distinction matters for supervision and fines: essential entities face proactive supervision and fines up to 10 million euros or 2% of worldwide turnover; important entities face reactive supervision and a lower ceiling.
What it requires
Article 21 lists the minimum measures: risk analysis and security policies, incident handling, business continuity and crisis management, supply-chain security, secure acquisition and development, effectiveness assessment, cyber hygiene and training, cryptography, human resources and access control, multi-factor authentication. Article 23 sets the reporting clocks: early warning within 24 hours, notification within 72 hours, final report within one month. Article 20 puts management bodies on the hook and requires their training.
Where France stands
NIS2 was due for transposition across the EU by 17 October 2024. As of September 2026 the French transposition law (the projet de loi résilience, which also recasts the OIV regime) is still before Parliament, and the European Commission referred France to the Court of Justice in July 2026. The directive’s obligations are known, so entities that will be essential or important already run the Article 21 measures; what remains pending is the national supervision regime. The practical question for a CISO is therefore not whether NIS2 applies but whether the measures can be shown to operate on the day a supervisor asks.