NIS2 France: are law firms in scope?
Legal services are absent from Annexes I and II of NIS2, and France had not finished transposing as of 16 October 2026. Yet the directive reaches firms through their in-scope clients' supply chain, through the GDPR and through CARPA transfer fraud. Here is what is enforceable today, and in what order to act.
The short answer
No. A law firm in France is not in scope of NIS2 because of what it does: Annexes I and II of Directive (EU) 2022/2555 list eighteen sectors, and legal services are not among them[5]. There is also a calendar fact. As of 16 October 2026 France has not finished transposing. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity was tabled in the Senate on 15 October 2024, adopted by the Senate at first reading on 12 March 2025, and the special committee text was tabled in the National Assembly on 10 September 2025[3][4]. ANSSI states that the legislative and regulatory work remains to be done[1].
That is not good news, though. NIS2 reaches a law firm through the side door: your in-scope clients must secure their supply chain, and you are a supplier holding their most sensitive files. This guide separates what is enforceable against you today from what will arrive by contract.
Are you in scope? The tests, in order
Three questions, in this order. If all three answers are no, the direct NIS2 obligation does not target you.
- Is your activity one of the eighteen sectors in Annexes I and II? Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space; then postal and courier, waste management, chemicals, food, manufacturing, digital providers, research organisations[5]. "Legal services" is not on the list.
- Do you run a listed activity alongside legal practice? A firm that hosts and administers the IT of other entities, or sells a managed IT service, should look at the Annex I category "ICT service management (B2B)"[5]. This is the trap for firms that pooled their IT across several entities.
- Do you pass the size thresholds? The directive reasons on entity size as defined by the EU SME recommendation, and the essential-or-important classification follows from it[5]. The question only arises if one of the first two answers is yes.
Worth knowing. The announced French perimeter is roughly 15,000 essential or important entities, plus close to 1,500 local authorities and similar bodies added by the transposition[2]. The 76,000 lawyers in the profession[8] are not targeted as lawyers.
NIS2 France and law firms: where the text actually stands
Saying "NIS2 has applied since October 2024" is wrong for France. Member States had to transpose the directive; France is transposing three European instruments in a single text — the REC directive on the resilience of critical entities, NIS2, and the DORA strand for the financial sector[2]. Until the law is promulgated and the implementing decrees published, there is no named list of entities, no enforceable registration deadline and no penalty scale applicable in French law[1].
What does already exist is usable today:
- the Référentiel Cyber France (ReCyF), published by ANSSI since 17 March 2026[1];
- MonEspaceNIS2 and its scope simulator, with voluntary pre-registration open to future in-scope entities[1][10].
For a firm the value of ReCyF is not compliance, it is vocabulary. Your in-scope clients will ask their questions in those terms, and a firm that answers in the same framework clears a supplier questionnaire in two hours instead of two weeks.
The three doors NIS2 uses to get into a firm anyway
1. Your in-scope client's security questionnaire
NIS2 requires in-scope entities to address supply chain security and the quality of their direct suppliers[5]. A firm advising a clinic, a carrier, a manufacturer or a digital infrastructure operator is a direct supplier holding litigation files, due diligence, contracts and employee data. The obligation is not yours; the clause that passes it down to you is. It arrives in the security annex of your engagement contract, not in a letter from ANSSI.
2. The GDPR, which does not wait for NIS2
A firm processes personal data, sometimes sensitive, for its clients, its files and its staff. In a breach, the baseline rule is notification to the CNIL within 72 hours of becoming aware of it, and informing the individuals where the risk is high[9]. The CNIL and the Conseil national des barreaux renewed their partnership on 17 July 2025 for three years, precisely on GDPR compliance, cyber risk management and the rollout of AI-powered legal analysis tools[8].
3. Legal professional privilege, which is not a security control
A French lawyer's professional secrecy covers advice, correspondence with the client, meeting notes and case documents. It even holds during inspections: an organisation cannot invoke professional secrecy to deny CNIL investigators access, except where the data is correspondence between a lawyer and their client[9]. But that regime protects information; it does not encrypt a backup or detect an exfiltration. Ransomware that publishes a case file does not breach privilege, it makes it pointless.
What actually hits a French firm
On 27 August 2026 the Conseil national des barreaux set out the threats that genuinely target firms, and its advice is more useful than a generic audit[6].
| Threat | What it targets in a firm | The CNB countermeasure[6][7] |
|---|---|---|
| Phishing | A partner's mailbox, then the live thread of an ongoing case | Check the sender address, hover over links before clicking, scan attachments with up-to-date antivirus |
| Ransomware | Business paralysis for an indefinite period and a straight financial loss | MFA, regular backups including one offline, patching, antivirus and firewall on every device, restricted admin rights |
| Bank-details change fraud and CARPA transfer fraud | The client funds the firm handles | Always verify any change of bank details through a second channel, never by email alone; send bank details through e-Partage |
| FOVI ("CEO fraud") | An urgent payment order presented as coming from a partner | Second verification channel and a secured professional mail service for sensitive exchanges |
Two deadlines to pin on the wall. 72 hours to file a police report after discovering an attack, a condition most cyber insurance policies set for cover; and a backup restore test every 3 months — a backup never restored is not a backup[6].
The first five actions
- Run the scope simulator and record the decision. One dated page, signed by the responsible partner: activity not listed in Annexes I and II, therefore out of direct scope; or ancillary ICT activity, therefore to be examined. That page is the first document an in-scope client will ask for.
- Turn on MFA for mail, the document vault and remote access. It is the first measure the CNB names against ransomware[6], and the only one that breaks the phishing-to-account-to-case-file chain.
- Take one backup off the network and test the restore this quarter. Offline, actually restored, with the test date written down[6].
- Write the "change of bank details" procedure and apply it to CARPA transfers. Second channel mandatory, no approval on an email alone, and a confirmation email is not a verification[6].
- Prepare your supplier questionnaire answer sheet. Hosting and data location, sub-processors, MFA, backups, logging, notification timeframe, incident contact. Written once, it serves every in-scope client.
The mechanics of a client questionnaire are the same for a law firm as for an accounting practice: see NIS2 France: are accounting firms and fiduciaries in scope?. And to compare with a country that already has its law, read NIS2 Netherlands: are law firms in scope of the Cbw? — the calendar gap changes the conversation with a Dutch client.
At CyberNovaLabs.io
Start with the free tools: the NIS2 check tells you in a few questions whether your organisation falls inside the perimeter, and the email security check tests SPF, DKIM and DMARC on your domain — the entry point for all four threats in the table above. We track regulatory deadlines country by country, France included, on our cybersecurity hub.
We also work upstream of that: if your firm wants to meet general counsel and company directors, our B2B appointment setting runs with no minimum term, per appointment or on a flat fee, with qualification criteria written down before launch. Pricing on request.
Let us talk about your firm for 20 minutes
Sources
- ANSSI - La directive NIS 2
- Senat - Projet de loi resilience des infrastructures critiques et renforcement de la cybersecurite (la loi en clair)
- Senat - Dossier legislatif PJL n 24-033
- Assemblee nationale - Dossier legislatif (17e legislature)
- EUR-Lex - Directive (UE) 2022/2555 (NIS 2), annexes I et II
- Conseil national des barreaux - Menaces cyber : le CNB fait le point (27/08/2026)
- Conseil national des barreaux - La securite numerique du cabinet d'avocat (guide)
- CNIL - La CNIL et le Conseil national des barreaux renouvellent leur partenariat (17/07/2025)
- CNIL - Violations de donnees personnelles : les regles a suivre
- ANSSI - MesServicesCyber, NIS 2
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 16, 2026 · 7 min readAlbert Heijn down four days: the supplier's view (11/10/2026)
Four working days with no systems at a major retailer. Seen from the supplier's side, that is not news: it is a week of revenue moved. The dated sequence, the three mechanisms that cost real money, and the list to clear before next Friday.
Read the article →October 16, 2026 · 7 min readB2B appointment setting: 7 levers that cut no-shows
No ghosts in your calendar. A missed B2B meeting costs the prep, the slot and the follow-up. Here are 7 levers to cut your no-show rate, and what the public evidence does — and does not — let you expect.
Read the article →October 15, 2026 · 7 min readAI in SMEs: 42% already use it, 49% held back by law (14/10/2026)
On 14 October 2026 the European Commission published a survey of 12 826 SME owners across the 27 Member States. The 42% adoption headline matters less than the detail: only 12% have genuinely deployed, and the law holds firms back as much as the price does.
Read the article →October 15, 2026 · 8 min readNIS2 Luxembourg: are accounting firms and fiduciaries in scope?
The Law of 5 May 2026 never once mentions accountancy. That does not make your firm safe: three entry points remain, and only one really concerns Luxembourg fiduciaries.
Read the article →