NIS2 France: are healthcare providers and labs in scope?
Health sits in Annex I of NIS2, yet no NIS2 obligation is enforceable in France on 25 October 2026. Meanwhile a separate French decree already requires five categories of care providers, medical labs included, to report incidents without delay. Here is which, and what to do.
The short answer
Two answers, and that is what makes NIS2 France healthcare a trap. On substance: yes, health is listed in Annex I of Directive (EU) 2022/2555, among the sectors of high criticality[5]. On timing: no, no NIS2 obligation is enforceable in France on 25 October 2026, because the transposition bill has not been passed[3].
And yet a French care provider is already among the most tightly supervised in Europe on this subject. Article L.1111-8-2 of the public health code creates the duty to report information-system security incidents, and its implementing decree of 27 April 2022 names five categories of organisations — including medical biology laboratories and social care establishments, which the NIS2 size thresholds would leave out[1]. In plain terms: France already asks more of you than the directive does, through a different counter.
Are you in scope? The tests, in order
Three questions, and the order matters, because the first one binds you today.
- Do you fall under decree no. 2022-715 of 27 April 2022? It names healthcare establishments, military hospitals, radiotherapy centres, medical biology laboratories and social care establishments[1]. No size threshold, no transition period: if you are on that list, the duty to report without delay already applies to you.
- Do you fit one of the Annex I health categories of NIS2? Healthcare providers, EU reference laboratories, entities carrying out research and development of medicinal products, manufacturers of basic pharmaceutical products and preparations, and manufacturers of medical devices[5].
- Do you clear the size thresholds? Important entity: at least 50 staff, or turnover and balance sheet above 10 million euros. Essential entity: more than 250 staff, or turnover above 50 million and balance sheet above 43 million[5].
The word “laboratory” is a trap. Annex I does not talk about high-street analysis labs: it names “EU reference laboratories”[5]. A 30-person French medical biology laboratory is therefore very probably outside the direct scope of NIS2 — and squarely inside the scope of the 2022 decree[1]. Concluding “we are not concerned” from the directive alone is the sector's most common mistake.
Where the French text actually stands on 25 October 2026
The Senate file leaves no room for doubt. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity was tabled in the Senate on 15 October 2024, with the accelerated procedure triggered by the Government the same day; the Senate adopted it at first reading on 12 March 2025 (text no. 78) and sent it to the National Assembly, where the special committee tabled its text no. 1779 on 10 September 2025[3]. The file records no adoption in plenary at the Assembly[3].
The practical consequence deserves to be said plainly: until the law is promulgated and the decrees published, there is no named list of essential or important entities, no enforceable registration deadline, and no penalty scale applicable in French law. Be wary of any supplier quoting you a precise French NIS2 fine: it does not exist yet.
What does exist is worth an hour of your time: the scope simulator and the voluntary pre-registration on MonEspaceNIS2, plus the Référentiel Cyber France published by ANSSI[6]. For a hospital or a clinic the value of that framework is not compliance, it is vocabulary: your group, your partners and your in-scope customers will question you in those terms.
What France already requires, and through which counter
| Obligation | What it means in practice | Source |
|---|---|---|
| Report without delay | Any serious information-system security incident, through the national portal for adverse health events | [1] |
| Qualify severity | Three tests: potential or actual consequences for the safety of care; harm to the integrity or confidentiality of health data; impact on the normal running of the organisation | [1] |
| Report elsewhere too | Depending on your status (OIV, OSE, future essential or important entity) and the nature of the incident: ANSSI, the CNIL, police or gendarmerie | [1] |
| Notify the data breach | Within 72 hours of becoming aware, to the CNIL, informing data subjects where the risk is high | [9] |
| Run exercises | Digital health roadmap target: an annual or biennial cyber crisis exercise in every establishment by 2027 at the latest | [8] |
A report is not a form that vanishes into a drawer: it starts a chain. CERT Santé, run by the French digital health agency, acknowledges the report, qualifies it on behalf of the competent authorities, offers support in handling it, then alerts — depending on the case — the digital health delegation, the information-system security officer of the social ministries, the directorate general of health through CORRUSS where there is a health impact, the health agencies in a major incident affecting patient care, and ANSSI for an OIV or OSE organisation[4]. Handling the incident itself remains your responsibility[4].
The sector's figures, and what they say about your risk
In 2025, 764 security incidents were reported to CERT Santé, an almost flat figure year on year, and 606 organisations reported at least one — the number of organisations involved keeps rising, driven by the social care sector[2]. Only two major incidents were recorded, against three in 2024[2].
| Year | Reports | The notable fact |
|---|---|---|
| 2023 | 581 | 35% of reports affected patient care; 529 audits carried out and 451 organisations warned of a compromise risk[2] |
| 2024 | 749 | Up 29% year on year, driven by uptake in the social care sector[2] |
| 2025 | 764 | Ransomware down 30%; 2 major incidents against 3 in 2024[2] |
The useful reading is not “ransomware is falling, let us relax”. It is the shift in the threat: account compromises, data leaks and payment fraud of the fake-transfer-order type are all rising[2]. Those three are not solved with an infrastructure budget, but with multi-factor authentication, mailbox logging and a written procedure for changing bank details. That is good news for a 60-person clinic: the countermeasures are within reach.
The first five actions
- Settle your scope in writing, on one dated page. Two lines are enough: “do we fall under the decree of 27 April 2022?” and “do we fall under Annex I and the NIS2 thresholds?”. Signed by management, that page is the first document a partner or an insurer will ask for.
- Make sure you know how to report before you need to. An active account on the reporting portal, a named reporter, a deputy, and the number to call at night. A report nobody can file at three in the morning does not exist[1].
- Turn on multi-factor authentication for email, remote access and privileged accounts. It is the control that breaks the chain from phishing to account to patient file — the one aimed at the threats that grew in 2025[2].
- Take one backup off the network and test the restore this quarter. Offline, actually restored, with the test date recorded. A backup that has never been restored is not a backup.
- Schedule your degraded-mode crisis exercise. Half a day, an encryption scenario, a written debrief and three improvement actions: precisely what the roadmap expects of every establishment by 2027[8].
To compare with a country that has finished transposing, read our guide on healthcare and labs under the Dutch Cyberbeveiligingswet, and the Belgian case in NIS2 Belgium: healthcare, hospitals and laboratories. For a French sector that is not listed yet still reached through its clients, the reasoning is set out in NIS2 France: are law firms in scope?. To settle your own case in ten minutes, use the free NIS2 check.
At CyberNovaLabs.io
We do not sell compliance by the kilo. We work in the Netherlands, Belgium, France and Luxembourg, and for the vendors and service providers who need to reach healthcare organisations we book the meetings: qualification criteria written down before launch, pay per appointment or a flat fee, no minimum term. The method is set out on our B2B appointment setting page.
Talk about appointments in healthcare
Sources
- Portail du CERT Santé (ANS) — Le cadre législatif et les déclarations (14/04/2026)
- Portail du CERT Santé (ANS) — L'Observatoire des incidents (11/05/2026)
- Sénat — Dossier législatif : projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité
- Portail du CERT Santé (ANS) — Les services : qualification des incidents et appui à la réponse
- Directive (UE) 2022/2555 (NIS2) — annexes I et II
- ANSSI — MonEspaceNIS2
- ANS / CERT Santé — Rapport public de l'Observatoire des signalements d'incidents de sécurité des SI 2025 (PDF)
- Ministère de la Santé — Feuille de route du numérique en santé 2023-2027 (PDF)
- CNIL — Notifier une violation de données personnelles
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Belgian tax portal attacked: deadline moved (28/10/2026)
Four days without MyMinfin, Tax-on-Web or Biztax, and a filing deadline that did not move. No data was stolen, so the cost sits elsewhere. What the Belgian tax portal cyberattack changes in practice for an SME in Belgium, France, the Netherlands and Luxembourg.
Read the article →November 3, 2026 · 9 min readAI Act 2026: what SMEs actually need to know
Applicable since 2 August 2026, the AI Act comes down to three duties for an SME that buys AI. The heavy Annex III rules now wait until 2 December 2027. Here are the dates, the fine ceilings that actually apply to an SME, and who enforces in the Netherlands, Belgium, France and Luxembourg.
Read the article →October 26, 2026 · 7 min readBelgium: 47 entities hit by data breaches in 2026 (24/10/2026)
Dark web monitoring, confirmed by the Centre for Cybersecurity Belgium, counts at least 47 Belgian entities hit by a data breach since January 2026. Incident reports received by the CCB have already passed the full-year 2025 total. Here is the useful reading for an SME in our four countries, plus the list to clear this week.
Read the article →October 26, 2026 · 8 min readNIS2 Netherlands: is your manufacturing plant in scope?
In the Netherlands NIS2 is called the Cyberbeveiligingswet, in force since 15 August 2026. For a factory the test is not "we make things": six precise Annex II categories decide, then company size. This guide gives the grid, the regulator, the registration desk and the reporting clock.
Read the article →October 24, 2026 · 8 min readNIS2 Luxembourg: are transport and logistics firms in scope?
Luxembourg's law does not put road hauliers inside NIS2. It puts road authorities, intelligent transport system operators, aviation, rail and ports there — and, through Annex II, forwarding services. Here is how to settle your own case, with the articles, the authority and the real deadlines.
Read the article →October 23, 2026 · 7 min readSigned Siemens app hijacked: the ClickFix alert (19/10/2026)
A genuine Siemens executable with a valid signature, used as the carrier for malware. The patch takes a minute. The lesson about your allowlisting rules takes longer.
Read the article →