NIS2: what obligations apply to a small subcontractor?

Two ways of being caught by NIS2

Directive (EU) 2022/2555, known as NIS2, sharply increases the number of organisations subject to cybersecurity obligations. For a small business, the question “does this apply to me?” in fact has two distinct answers.

The first is legal: your company falls within the scope of the directive in its own right, because it operates in a listed sector and exceeds certain size thresholds. It then becomes an “essential entity” or an “important entity”, with direct obligations and possible penalties.

The second is contractual: your company is not covered, but it works for a client that is. The directive requires that client to manage the risks arising from its suppliers. Those requirements then reach you through the contract, through a security questionnaire or through an audit. No penalty from ANSSI, the French national cybersecurity agency, applies to you directly — but losing a client does.

Many small subcontractors discover NIS2 by the second route, and it is often the more pressing one.

Where French law stands

Member States were required to transpose the directive by 17 October 2024 at the latest. France did not meet that deadline.

The text carrying that transposition is the projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité (the bill on the resilience of critical infrastructure and the strengthening of cybersecurity), which also transposes the CER Directive and aligns French law with the DORA Regulation. It was presented to the Council of Ministers on 15 October 2024, passed by the Sénat on 11 and 12 March 2025, then adopted in special committee at the Assemblée nationale on 10 September 2025. As we write, the Assemblée nationale’s legislative file shows no examination in plenary sitting, no final adoption and no promulgation. The date of entry into force is therefore unknown.

ANSSI further states that the obligations will apply once the act, the implementing decrees and the ministerial orders have been published, and that the date on which the requirements actually apply may differ from the date the text enters into force. The thresholds, deadlines and amounts quoted below are those of the directive: the French act and its decrees may set out how they are to be applied.

Sources: progress of the transposition on MonEspaceNIS2, the Assemblée nationale’s legislative file, and the text of Directive (EU) 2022/2555 on EUR-Lex.

Are you directly covered?

Two criteria combine: sector and size.

Sector. Annex I of the directive lists the “sectors of high criticality”: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, management of ICT services (business-to-business), public administration and space. Annex II lists the “other critical sectors”: postal and courier services, waste management, chemicals, production and distribution of food, manufacturing (medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles and other transport equipment), digital providers (online marketplaces, search engines, social networking platforms) and research.

One point deserves the attention of small digital firms: management of ICT services (business-to-business) appears in Annex I. It covers managed service providers and managed security service providers in particular. An outsourced IT provider, or any supplier that administers its clients’ systems remotely, therefore sits in a covered sector.

Size. As a general rule, the directive applies from the medium-sized enterprise upwards in the European sense: at least 50 employees, or an annual turnover and a balance sheet total both exceeding 10 million euros. Below that, a company is in principle out of scope, except for the exceptions the directive provides for certain activities (providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers, in particular) or where the State specifically designates it.

Essential or important. A large enterprise (250 employees or more, or more than 50 million euros of turnover and more than 43 million euros of balance sheet total) in an Annex I sector is in principle an essential entity. The other entities in scope are in principle important ones. The difference lies mainly in the supervisory regime and the ceiling on penalties: up to 10 million euros or 2% of worldwide turnover for an essential entity, 7 million euros or 1.4% for an important entity, whichever is higher.

To check where you stand, ANSSI provides a simulator on MonEspaceNIS2. It is no substitute for legal analysis when your activity spans several sectors.

How NIS2 reaches a subcontractor that is not covered

Article 21 of the directive requires essential and important entities to take risk-management measures, among them supply chain security. Paragraph 3 specifies that they must take into account the vulnerabilities specific to each direct supplier and service provider, the quality of their products and their cybersecurity practices, including their secure development procedures.

In practice, your client cannot simply assert that its suppliers are reliable: it must be able to show that it has checked. That obligation takes the form of a questionnaire, contract clauses, sometimes an audit or a request for documents.

The security questionnaire. It arrives at the time of a tender or a renewal. It covers two-factor authentication, backups, access management, patch management and the procedure to follow in the event of an incident.

The contract clauses. They may set a deadline for reporting an incident that affects the client, a right of audit, minimum security requirements, an obligation to pass those requirements on to your own subcontractors, and even data reversibility. These clauses flow from the client’s own obligation: if it has to submit an early warning to the authority within 24 hours of becoming aware of a significant incident, it cannot wait a week for its supplier to tell it.

One point needs to be precise: what the directive imposes on your client is not imposed on you by law, but by the contract you sign. It is the contract that sets the extent of your obligations. Read those clauses before accepting them, and do not commit to a notification deadline that your organisation cannot meet.

The measures expected, in practice

Whether or not you are directly covered, the reference is the same: the list in Article 21(2) of the directive. It is what main contractors’ questionnaires align with. It covers ten areas:

1. policies on risk analysis and information system security;
2. incident handling;
3. business continuity: backups, disaster recovery, crisis management;
4. supply chain security;
5. security in the acquisition, development and maintenance of systems, including vulnerability handling;
6. procedures to assess the effectiveness of the measures;
7. basic cyber hygiene practices and training;
8. the use of cryptography and, where appropriate, encryption;
9. human resources security, access control and asset management;
10. multi-factor authentication and secured communications.

The directive sets out a principle of proportionality: the measures depend on the entity’s exposure to risk and its size. To spell out what it expects, ANSSI published the Référentiel Cyber France (ReCyF), its cyber requirements framework, on 17 March 2026, together with a comparison tool mapping it to other frameworks. It is a working document: no final version will be published before the transposition is complete. Source: ReCyF and comparison tool on ANSSI’s innovation laboratory (in French).

For a subcontracting business of twenty to fifty people, that translates into a realistic baseline:

• Two-factor authentication on email, remote access and administration consoles, including those that give access to your clients’ systems.
• Backups with a disconnected or immutable copy, and a documented restore test.
• An inventory of workstations, servers, accounts and access to client environments, with a regular review of rights.
• Patches applied within a defined timeframe, and tracking of equipment that is no longer supported.
• A written incident procedure: who detects, who decides, who tells the client and how quickly.
• Awareness training for your teams, on phishing in particular.
• A short security policy that you can hand to a main contractor, describing what you actually do.

Where to start

First, check your status with the MonEspaceNIS2 simulator. If you are in scope, a full compliance programme is required.

Next, list the clients that are covered or likely to be, and gather the questionnaires and clauses you have already received. They set out precisely what is expected of you.

Then take an honest stock against the ten areas of Article 21. An IT security audit lets you rank the gaps by priority and produce the evidence main contractors ask for.

Key points

• The French transposition of NIS2 is not complete at the time of writing: neither the entry into force nor the date of actual application is yet known.
• A small business is in principle directly covered from 50 employees, or more than 10 million euros of both turnover and balance sheet total, if it operates in an Annex I or Annex II sector.
• Below those thresholds, NIS2 reaches you through your clients: questionnaires, contract clauses, audits.
• The requirements cover the ten areas of Article 21; ANSSI’s ReCyF sets out the detailed version.