Skip to Content

NIS 2 for SMEs: Are You in Scope and What Should You Do in 2026?

NIS 2 for SMEs: thresholds, sectors, ANSSI obligations, penalties and the Resilience bill timeline. Check whether you're in scope and get ready.

NIS 2 for SMEs: Are You in Scope and What Should You Do in 2026?

SME executive and IT manager reviewing a cybersecurity plan in the office

An SME falls under NIS 2 if it operates in one of the 18 covered sectors and has at least 50 employees, or more than €10 million in both annual turnover and balance sheet total. As of early November 2026, France still hasn't transposed the directive: the Resilience bill (loi Résilience) hasn't been passed, so the obligations don't apply yet. Even so, ANSSI is urging in-scope entities to start preparing now, using its ReCyF framework.

Key takeaways:

  • A company in one of the 18 NIS 2 sectors is an important entity from 50 employees, or from €10M in both turnover and annual balance sheet, and an essential entity from 250 employees, or from €50M in turnover and €43M on the balance sheet.
  • NIS 2 obligations don't apply in France yet: they will take effect with the Resilience bill and its implementing decrees, and the floor debate in the National Assembly has been postponed several times.
  • Since November 24, 2025, ANSSI has let organizations pre-register on MonEspaceNIS2 using a 5-to-10-minute form, which isn't mandatory yet.
  • ANSSI's ReCyF, published as a working draft on March 17, 2026, lists the expected measures: executive accountability, supplier mapping, backups, access management and logging.
  • An SME that isn't regulated can still be affected as a supplier: a NIS 2 entity must make sure its IT providers meet the entity's own obligations.
Yundera
Stay in control of your data
Yundera offers a managed private server hosted in France, with your apps and data under your control, no technical skills required.

Table of Contents

What is the NIS 2 directive and why does it matter for SMEs?

NIS 2 is European Directive (EU) 2022/2555. It sets a common level of cybersecurity for organizations considered essential to the economy and society, and it now covers some SMEs. Published in the Official Journal of the European Union on December 27, 2022, it replaces the first NIS directive and greatly widens its scope: it no longer targets just a handful of large operators, but entire sectors.

According to ANSSI, “several thousand entities across 18 sectors of activity” will be affected in France. The agency's official FAQ mentions around 600 different types of entities, “from SMEs to CAC 40 groups.”

  • Who is targeted first: mainly medium and large companies, local authorities and public administrations.
  • What brings you into scope: your business activity and company size (headcount, turnover and annual balance sheet), based on the European criteria in Recommendation 2003/361/EC.
  • Exceptions to know about: some services are covered “regardless of their size”, such as DNS providers, trust service providers and electronic communications operators.

A mid-sized SME in a covered sector can therefore be directly regulated. A smaller business, meanwhile, can be affected as a supplier to a regulated entity.

Pro tip: calculate your size across all your activities, not just the one that falls under a NIS 2 sector: that's the rule ANSSI points out.

Is my company in scope of NIS 2?

Your company is in scope of NIS 2 if it operates in one of the 18 covered sectors and exceeds the size thresholds published by ANSSI. The level of obligations depends on whether you're classified as an essential entity or an important entity:

  • Essential entity: at least 250 employees, or annual turnover above €50 million and an annual balance sheet above €43 million.
  • Important entity: an entity that isn't essential and employs at least 50 people, or whose turnover and annual balance sheet both exceed €10 million.

Sector matters as much as size. ANSSI distinguishes two groups:

  • Sectors of high criticality (11): including energy, health, transport and banking.
  • Other critical sectors (7): including digital providers and manufacturing.

Three calculation rules help you avoid misjudging your status, according to the official NIS 2 FAQ:

  • Overall scope: thresholds are calculated across all of the entity's activities, not just those covered by NIS 2.
  • Turnover excluding tax: it's counted net of VAT.
  • Size doesn't matter: DNS providers, trust service providers and providers of public electronic communications are in scope regardless of their size.

Pro tip: if in doubt, take the self-assessment test on ANSSI's MonEspaceNIS2 portal. It tells you whether your organization is an essential entity, an important entity or out of scope.

Where does the Resilience bill transposing NIS 2 in France stand?

As of early November 2026, the Resilience bill still hasn't been adopted: France is more than two years past the EU transposition deadline of October 17, 2024. The bill transposes NIS 2, the Critical Entities Resilience (CER) directive and the DORA regulation all at once. It's moving slowly through Parliament, according to the National Assembly's legislative file:

  • October 15, 2024: the government introduces the bill and triggers the accelerated procedure.
  • March 12, 2025: the Senate adopts the bill at first reading.
  • September 10, 2025: the National Assembly's special committee adopts its version.
  • October 6, 2026: the Conference of Presidents removes the bill from the October 7 and 9 agenda, without setting a new date.
  • November 9, 2026: the legislative file announces a floor debate, with 397 amendments tabled.

France isn't the only country running late, but it's in the minority. As of January 1, 2026, 20 of the 27 member states had already transposed the directive.

The practical consequence: “under French law, the obligations arising from NIS 2 still do not apply.” They will take effect once the law is passed and its decrees are published. Not every requirement will necessarily apply from day one.

Pro tip: don't build your compliance plan around a parliamentary debate date, since those have already slipped several times. Check the Assembly's legislative file directly to see where the bill actually stands.

What are the NIS 2 obligations for an essential or important entity?

An essential or important entity will have to meet three main obligations, detailed by ANSSI: register, manage its cyber risks and report its incidents. They will apply as soon as the Resilience bill and its decrees are published.

  • Registration with the competent national authority: ANSSI needs to know every regulated entity, its sector and its security contacts. Registration goes through the MonEspaceNIS2 portal, where voluntary pre-registration is already open.
  • Cyber risk management: the entity puts in place technical and organizational measures proportionate to its exposure, for example around governance, access control, backups, logging and supplier oversight. ANSSI details them in its ReCyF framework.
  • Incident reporting: the entity must report significant security incidents to ANSSI, then provide updates on how the situation develops.

The two statuses don't carry the same level of requirements. In the framework published by ANSSI, each measure states whether it applies to both categories or only to essential entities. An important entity therefore has a lighter baseline of obligations, but it isn't exempt.

Reporting deadlines and report content will be set by the French transposition texts. Until they're published, be wary of timelines presented as final.

Pro tip: appoint a security contact and a deputy now, then write a simple procedure for classifying an incident and alerting management. That's the foundation of any fast report, whatever deadline is ultimately set.

What's in the ReCyF, ANSSI's framework?

The ReCyF is the list of concrete measures ANSSI expects from entities subject to NIS 2: it turns the directive's objectives into operational requirements. Its version 2.5, dated March 17, 2026, sets out “the measures recommended by ANSSI to achieve the security objectives set by NIS 2.” ANSSI's director general, Vincent Strubel, has stated that it will remain a working document until transposition.

The framework is published on ANSSI's NIS 2 page. Each measure states whether it applies to important entities, essential entities or both. A few examples that resonate for an SME:

  • Governance: for an essential entity, “the entity's chief executive is responsible for digital security within their entity.”
  • Suppliers: the entity maps its suppliers. It also makes sure any IT service complies with the obligations it is itself subject to.
  • Backups: they must be tested regularly. A backup that has never been restored proves nothing.
  • Accounts and access: unused accounts are disabled promptly and permissions are reviewed.
  • Logging: security logs are retained so an incident can be analyzed after the fact.

ANSSI notes that the document “is subject to adjustments.” Exact retention periods and frequencies may therefore still change with the implementing decrees.

Pro tip: download the ReCyF and sort each measure into three columns: “in place,” “partial,” “missing.” In half a day, you'll have an initial assessment that's far more useful than a rushed audit.

What penalties apply, and what is the executive's accountability?

A regulated entity that fails to comply with NIS 2 faces fines calculated on its worldwide turnover. Its leadership can no longer treat cybersecurity as a purely technical matter. According to ANSSI, penalties could reach:

  • Essential entity: 2% of worldwide turnover.
  • Important entity: 1.4% of worldwide turnover.

The maximum amounts and the sanction procedure will be set by the Resilience bill and its decrees. Since the bill hasn't been passed yet, no NIS 2 penalty can be imposed in France today.

The deepest change concerns governance. For essential entities, the ReCyF framework lays down a clear principle: “the entity's chief executive is responsible for digital security within their entity.” In practice, this means:

  • Decisions made at the right level: budget, priorities and acceptance of residual risk belong to senior management, not just the CIO or the IT provider.
  • A decision trail: you need to be able to show who approved the risk analysis and the action plan.
  • Involvement during a crisis: management must know who to notify, when and how, without improvising.

Pro tip: add a “digital security” item to a management meeting agenda every quarter and keep the minutes. It's simple, cheap, and proves that leadership is genuinely steering the issue.

I'm a supplier to a NIS 2 entity: what changes?

Even if your SME is outside the scope of NIS 2, your regulated customers will ask you for security guarantees, because they have to keep their supply chain under control. The ReCyF framework, published on ANSSI's NIS 2 page, asks essential and important entities to do two things: map their suppliers, and check that, “when using an IT service provider or supplier,” the service complies with the obligations they are subject to.

In practice, these obligations flow down to suppliers. Expect:

  • Contract clauses: security commitments, an obligation to report incidents promptly, a right to audit.
  • Security questionnaires: data hosting, backups, access management, updates.
  • Audits or evidence: written policies, restore test reports, a list of people with access to systems.

For a micro-business, this isn't necessarily a burden: the ability to respond quickly and precisely is often what makes the difference in a tender or a contract renewal.

Start by documenting three points every customer will ask about:

  1. Hosting: where the data is stored, with which provider and in which country.
  2. Backups: frequency, location and date of the last restore test.
  3. Access: who can access what, with which authentication, and how departures are handled.

Pro tip: pull these answers together in a two-page security fact sheet and keep it up to date. You can attach it to every questionnaire instead of starting from scratch each time.

How to prepare for NIS 2 right now

To prepare for NIS 2 without waiting for the law, an SME can follow four simple steps: check whether it's in scope, pre-register, map its information system and prioritize the ReCyF measures. ANSSI itself encourages future essential and important entities “to get started right away.”

Laptop displaying a cybersecurity checklist

  1. Check your eligibility: take the MonEspaceNIS2 self-assessment test. It cross-references your sector, headcount, turnover and balance sheet, calculated across all your activities.
  2. Pre-register with ANSSI: this has been possible since November 24, 2025. The form takes 5 to 10 minutes: contact details, sector, incident management contacts. It will only become binding once the Resilience bill and its implementing decree are adopted. It does, however, let you get ahead of mandatory registration.
  3. Map your information system and suppliers: list your applications, your sensitive data, where they're hosted and the suppliers your business depends on.
  4. Prioritize with the ReCyF: start with the measures that reduce risk the most. Those are tested backups, access reviews, log retention and a written incident response plan.

These projects strengthen your security whatever the parliamentary timeline. They protect you against ransomware today and make it easier to answer your customers' questionnaires.

Pro tip: give yourself 90 days for the four steps, with a named owner for each. A short plan that actually gets done beats an ambitious compliance program that sits in a drawer.

Yundera: a private server in France to take back control of your data

Yundera helps an SME give a clear answer to the first question in any NIS 2 effort: where is our data, and who processes it? That's what your regulated customers will ask first in their supplier questionnaires. Yundera offers a managed private server, the Personal Cloud Server, hosted in France and dedicated to a single customer. Your data stays on your own server: Yundera doesn't collect it or sell it. That makes it simpler to document your hosting in your security fact sheet. It doesn't replace the rest of the process: risk analysis, access management, an incident response plan and preparing for ransomware.

Yundera

Day to day, the server comes with ready-to-use open source apps: file storage, photos, website hosting, office tools and more. They install in one click from an app store. Each app is available over HTTPS on your own domain name, with no static IP, no port forwarding and no certificates to configure by hand. No technical skills are required, because Yundera manages the server for you.

To compare plans and see whether this model fits your organization, visit the Yundera private servers page.

Private server vs shared cloud — comparison diagram

NIS 2: the most common mistakes SMEs make

SMEs most often get the timeline and their scope wrong, not the technical side. Six mistakes come up again and again:

  • Waiting for the law: ANSSI encourages entities “to get started right away.”
  • Concluding too quickly that you're out of scope: thresholds are calculated across all your activities, not just one.
  • Forgetting your role as a supplier: your regulated customers will ask you for guarantees.
  • Believing alarmist websites: registration isn't mandatory yet; only pre-registration is open.
  • Handing everything off to IT: the chief executive remains responsible for digital security.
  • Never testing your backups: a restore that has never been tried protects you from nothing.

The timeline has already changed several times. Before making any decision, check where the bill stands in the Resilience bill's legislative file.

— Yundera

Sources

Frequently Asked Questions

Can a company with fewer than 50 employees be in scope of NIS 2?

Yes, in three cases. A company in a covered sector is an important entity as soon as its turnover and annual balance sheet exceed €10 million, even with fewer than 50 employees. Some players are also covered regardless of their size: DNS providers, trust service providers and providers of public electronic communications. Finally, a small business can be affected indirectly as a supplier to a regulated entity.

When will the NIS 2 directive take effect in France?

It will take effect once the Resilience bill is passed and its implementing decrees are published. As of early November 2026, the bill still hasn't been adopted, even though the EU deadline was October 17, 2024. The National Assembly's legislative file lists a floor debate on November 9, 2026, but the review has already been postponed several times.

Is pre-registration on MonEspaceNIS2 mandatory?

No. Open since November 24, 2025, it's voluntary. It will only become binding once the Resilience bill and its implementing decree are adopted. The form takes 5 to 10 minutes and lets you get ahead of mandatory registration.

What's the difference between an essential entity and an important entity?

According to ANSSI, an essential entity employs at least 250 people or has more than €50M in turnover with a balance sheet above €43M. An important entity employs at least 50 people or exceeds €10M in both turnover and balance sheet. The business sector also comes into play, and essential entities have more obligations and face heavier penalties.

What penalties does a company face if it doesn't comply with NIS 2?

According to ANSSI, fines could reach 2% of worldwide turnover for an essential entity and 1.4% for an important entity. The amounts and procedure will be specified by French law. Until the Resilience bill is adopted, no NIS 2 penalty can be imposed in France.

Recommended Reading

Sign in to leave a comment