← All resources

NIS2 France: are construction firms in scope?

Published October 21, 2026 · 9 min read · CyberNovaLabs.io

Construction divisions 41, 42 and 43 appear in no NIS2 annex, and as of 21 October 2026 France has no transposition law. But division 33 is in there, your French activity code changes on 1 January 2027, and transfer fraud rose 93% in 2025. What actually matters for a building firm.

The short answer

No, in the vast majority of cases. Construction and building firms appear in neither Annex I nor Annex II of Directive (EU) 2022/2555: divisions 41 (construction of buildings), 42 (civil engineering) and 43 (specialised construction activities) are simply not on the lists^[1]. A general contractor, a bricklayer, a roofer, an earthworks firm, a plumber or a building electrician is not an essential or important entity because of its trade.

There is also a French calendar fact. On 21 October 2026, two years after the European deadline of 17 October 2024, France still has no NIS2 law. The National Assembly's legislative file shows no public sitting: the last recorded step is the filing of the special committee's text on 10 September 2025^[2]. The bill was tabled in the Senate on 15 October 2024 and adopted there at first reading^[3]; the debate announced for 7 and 9 October 2026 did not take place. Until the law is enacted and the decrees published, French law contains no list of designated entities, no enforceable registration deadline and no penalty scale^[4].

Three things already reach you regardless: the activity code that will decide your fate, your clients' security questionnaires, and payment-redirection fraud on your monthly work statements. This NIS2 construction France guide takes them in that order.

Are you in scope? Four questions, in order

Ask them in this order and stop at the first "yes".

1. Is your main activity one of the eighteen sectors in the annexes? Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space, then postal services, waste management, chemicals, food, manufacturing, digital providers, research^[1]. "Construction" is not there.
2. Do you operate, not only build? A civil works company that runs a waste water plant, a district heating network or an electricity network under concession falls in through Annex I: operating is not building^[1].
3. Do you have a digital services subsidiary? A construction group that hosts or administers other companies' IT, or sells a managed IT service, should read the Annex I category "ICT service management (B2B)"^[1].
4. Do you pass the size thresholds? Classification as an essential or important entity depends on the size of the entity under the European SME definition^[1]. This question only matters if you answered "yes" above.

The code trap: 43 is not 33

This is the sector's costliest misreading. Annex II does not cover "manufacturing" as a whole: it lists a closed set of divisions — 26 computer, electronic and optical products; 27 electrical equipment; 28 machinery and equipment; 29 motor vehicles; 30 other transport equipment; 31 furniture; 32 other manufacturing; and 33, repair and installation of machinery and equipment — plus medical device manufacturing^[1].

Read division 33 carefully. A firm that installs and maintains industrial machinery on site falls under Annex II. The same work, invoiced by an electrical installation firm (43.21) or a heating and air conditioning firm (43.22), does not. Two companies working side by side on the same site can end up on opposite sides of the line purely because of their main activity code.

Another reflex is wrong: precast. Producing precast walls, floor slabs, ready-mixed concrete or building materials falls under division 23, other non-metallic mineral products, which is not in the Annex II list^[1]. A precast plant does not enter scope through that route.

Two activities often held inside a construction group do bring it in, however. Waste management, Annex II, for the subsidiary that runs a construction-waste sorting or recycling site as an activity in its own right. And waste water or energy, Annex I, for the entity holding a network concession^[1].

Activity	Division	In the NIS2 annexes?
Building construction, civil engineering, specialised works	41, 42, 43	No[1]
Precast concrete, building materials	23	No[1]
Installation and maintenance of industrial machinery	33	Yes, Annex II[1]
Construction-waste sorting and recycling as a standalone activity	Waste management	Yes, Annex II[1]
Operating a waste water or heating network under concession	Waste water, energy	Yes, Annex I[1]

Your French activity code changes on 1 January 2027: check it now

All of the above rests on your activity code, and France is changing its classification. NAF 2025 replaces the 2008 version, and the new APE code becomes the official reference on 1 January 2027; throughout 2026, only the current code is official^[5]. Active legal units in the Sirene register and their establishments will be recoded.

INSEE already lets you preview your future code by entering your SIREN on sirene.gouv.fr, and an online form, open since January 2026, lets you request a review when the proposed code does not match your real activity^[5][12]. INSEE states that the change creates no additional rights or obligations by itself. Still, the French transposition law, when it comes, will designate sectors — and the code applied to you may not be today's. Ten minutes of checking beats an inherited classification.

What already applies to you, without NIS2

1. Your client's security questionnaire. In-scope entities must manage the risk coming from their direct suppliers. They do it by contract, not by statute: incident notification clauses, two-factor authentication, a named list of accesses, tested backups. In construction, this lands first on subcontractors of public clients and network operators. Refusing to answer, or answering vaguely, costs you a tender, not a fine. Our supplier security questionnaire guide gives the template.

2. The GDPR on your vehicles and sites. This is the most underrated point in the sector, because construction tracks its vans and plant. The French data protection authority sets precise limits: vehicle tracking may not be used to check speed limits or to monitor an employee continuously, and an employee allowed private use of the vehicle must be able to switch off collection outside working hours, breaks included. Retention is quantified: two months as a rule, one year to optimise rounds or prove an intervention, five years for working-time data alone where tracking is used to monitor hours^[8].

3. Payment-redirection fraud. For 2025, Cybermalveillance.gouv.fr ranks, for companies and associations: account takeover 21% of assistance requests, up 52%; phishing 16%, up 29%; transfer fraud 13.5%, up 93%; ransomware 8.1%; data breaches 6.6%, up 40%^[6]. Construction ticks every box for this fraud: monthly work statements, long subcontracting chains, new parties on every site, and bank details that legitimately change mid-project.

4. Mandatory e-invoicing. Since 1 September 2026, every French company must be able to receive an electronic invoice where its supplier is required to issue one; SMEs and micro-businesses must issue from 1 September 2027^[9]. The direct consequence for the fraud above: the fake bank details slipped into an email lose ground, but your platform account becomes the target. Risk shifts to how you authenticate access.

The first five actions

1. Check your code, twice. Current APE code, then your future NAF 2025 code on sirene.gouv.fr^[5][12]. If either lands in division 33, waste management or network operation, treat the file as a NIS2 file.
2. Enforce two-factor authentication on email and on the invoicing platform. It is the single countermeasure against the top two threats of the 2025 ranking, account takeover and transfer fraud^[6].
3. Write down the bank-details change procedure. One channel, a call back to the number in the contract and never the one in the email, dual approval above a threshold you set. One page is enough, and accounting and site managers must know it.
4. Bring vehicle tracking into line. Retention periods, the ability to switch off outside working hours, written information to employees, and an entry in the processing register^[8].
5. Ask for a free diagnosis. MonAideCyber, run by the French cybersecurity agency, offers a first-level diagnosis carried out by a cyber helper^[10]; MesServicesCyber lists the public tools tied to NIS2^[11]. Both are public and free.

Going further

The same sector seen from a country that has already transposed: NIS2 in the Netherlands for construction firms, where the Cyberbeveiligingswet is in force and the obligations are real. Two other French sectors in the same waiting room: NIS2 France for transport and logistics, which is in the annexes, and NIS2 France for law firms. You can also take the NIS2 check, review the cybersecurity grants, and see our B2B appointment setting in Brussels page.

At CyberNovaLabs.io

CyberNovaLabs.io works in the Netherlands, Belgium, France and Luxembourg. For a construction firm we do three things: establish your real perimeter by reading your activity codes and your operating contracts, prepare your answers to your clients' security questionnaires, and lock down the email - invoicing - bank details chain, which is the sector's actual entry point. We do not sell NIS2 certification: the French law is not enacted, and nobody can certify a text that does not yet exist.

If you prospect developers, industrial clients or public bodies, our B2B appointment setting service is for you, with no minimum term and priced on quotation. Let's talk through your case in 20 minutes.

Sources

1. EUR-Lex - Directive (UE) 2022/2555 (NIS 2), annexes I et II
2. Assemblee nationale - Dossier legislatif, projet de loi resilience des infrastructures critiques et renforcement de la cybersecurite
3. Senat - Dossier legislatif PJL n 24-033
4. ANSSI - La directive NIS 2
5. INSEE - Nouveau code APE : les entreprises peuvent le consulter (NAF 2025)
6. Cybermalveillance.gouv.fr - Top 10 des cybermalveillances visant les professionnels en 2025
7. FFB - Le batiment en chiffres (donnees 2025)
8. CNIL - La geolocalisation des vehicules des salaries
9. impots.gouv.fr - A partir de quand suis-je concerne par la reforme de la facturation electronique
10. ANSSI - MonAideCyber
11. ANSSI - MesServicesCyber, NIS 2
12. INSEE / Sirene - Consulter son futur code APE

Read next