NIS2 France: are estate agents and letting firms in scope?
NIS2 does not list real estate, and France still has no transposition law. Here are the tests that settle it, the French rules that already bind you, and the five actions worth taking.
The short answer
No. NIS2 does not cover real estate. Neither Annex I nor Annex II of Directive (EU) 2022/2555 mentions property transactions, letting management or building management[1]. A French estate agency, managing agent or block manager therefore has, in principle, no direct duty to register, to adopt risk-management measures or to report incidents under NIS2.
The second answer is less comfortable. If you were looking for a French deadline, there is none yet. As of 31 October 2026, France has still not transposed NIS2. Bill no. 1112 on the resilience of critical infrastructure and the strengthening of cybersecurity was pulled from the National Assembly's agenda on 6 October 2026, with no new date announced[2]. The European transposition deadline was 17 October 2024[1].
The third answer is the one that creates work. Your obligations already exist. They are called decree no. 2015-1437, the GDPR, the Hoguet Act and the anti-money-laundering regime. And the cyber pressure that actually hits agencies does not come from ANSSI: it comes from bank-detail fraud.
NIS2 France real estate: the tests, in order
Three questions settle it. Take them in order; the first one usually closes the file.
- Is your activity on the list? The annexes cover energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management business-to-business, public administration and space; then postal and courier services, waste management, chemicals, food, certain manufacturing, digital providers and research[1]. Real estate appears nowhere.
- Are you above small-enterprise size? The baseline threshold follows Recommendation 2003/361/EC: more than 50 staff, or more than EUR 10 million in turnover or balance-sheet total[1]. The question is moot if the first answer is no. Size never adds a sector to the scope.
- Do you happen to run a listed service? This is the sector's only real trap. A manager who operates a data centre, resells hosting, runs a heat network or a water supply for an estate, or provides managed IT services to its principals, can fall in scope through that activity, never through property work.
Two indirect doors stay open, and they are the ones that will keep you busy.
- Supply chain. Article 21(2)(d) requires in-scope entities to secure their relationships with direct suppliers[1]. If you manage property for a hospital, an energy operator, a bank, a port or a public body, your client will push requirements down to you: a security questionnaire, a contract clause, a notification deadline. You are not regulated, you are audited.
- Individual designation. A national authority can designate a named entity outside the thresholds and outside the lists where disruption of its service would have significant effects. Rare in real estate; not impossible for a manager of strategic assets.
If a client, a fund or a social landlord sends you a questionnaire citing NIS2, it is the first door opening, not the second. The same logic applies in the Netherlands, where the law has in fact been passed: see our guide on NIS2 for Dutch estate agents and letting firms if you manage assets there.
Where France actually stands
ANSSI is the authority set to receive registrations and to supervise. It opened a pre-registration route and a dedicated help space, MonEspaceNIS2, before the law exists[3][11]. The mechanics and the hard deadlines for mandatory registration still wait on the transposition text[3].
The figures in the bill show the scale for those who will be in scope: up to EUR 10 million or 2 % of annual worldwide turnover for an essential entity, up to EUR 7 million or 1.4 % for an important entity[2]. These are figures from a pending bill: they can change on a vote.
What to take from the French delay. Nothing to register today if you are an agency or a block manager. But a bill pulled from the agenda can come back fast, and the announced French perimeter covers more than eighteen sectors[3]. Set an alert on the parliamentary file rather than a compliance binder in a drawer.
The French rules that already bind you
This is the real baseline, the one that produces penalties in French real estate today.
| Rule | Who | What it requires | Exposure |
|---|---|---|---|
| Decree no. 2015-1437 of 5 November 2015 | Landlord and agency | Two exhaustive lists: Annex 1 for the applicant tenant, Annex 2 for the guarantor. Off-list items include the family record book, the health-insurance card, bank statements, a marriage contract, a divorce judgment and a criminal record extract[4][5]. | Up to EUR 3,000 for an individual, EUR 15,000 for a company[5] |
| GDPR and CNIL decision no. 2021-057 of 6 May 2021 | Controller | Solvency assessment stays within the stated categories: identification, contact details, employment, income. Bank statements, medical documents and criminal records are in principle irrelevant[6]. | Formal notice, CNIL fine |
| CNIL retention guidance | Agency, manager | Supporting documents from rejected applicants are deleted once they no longer serve the decision; three months in the active database is treated as adequate in principle[5]. | Formal notice, CNIL fine |
| Hoguet Act | Holder of a T or G card | Professional card issued by the chamber of commerce, valid three years; authorisation certificates for negotiators; financial guarantee of at least EUR 110,000 per activity, EUR 30,000 for the first two years in the cases provided; an escrow account distinct from the guarantee[7]. | Loss of the right to trade |
| Anti-money-laundering and Tracfin | Real-estate professionals | Customer due diligence at onboarding, record keeping, suspicious-activity reporting[8]. | Supervisory sanction |
The sector's paradox fits in one sentence: NIS2 asks nothing of you, yet you hold identity documents, payslips, tax notices and bank details for hundreds of people. Law firms live the same gap, documented in our guide on NIS2 in France for law firms.
Bank-detail fraud is your real risk
The 2025 activity report from Cybermalveillance.gouv.fr, published in March 2026, records 504,810 assistance journeys. For businesses and associations, account hijacking accounts for 21 % of journeys, phishing 16 %, fraudulent payment orders 13.5 % and ransomware 8.1 %[9]. Those are shares of assistance journeys, not incidence rates across all French businesses.
The standard letting scenario: a mailbox is compromised, the fraudster poses as the landlord, the notary or the seller, and sends new bank details. A deposit, a quarter of rent or sale proceeds leave the account[10]. A block manager holding a building's funds is a prime target, because the transfers are large, irregular and expected.
The reflex costs nothing: before any transfer to new bank details, confirm them through an independent channel, the creditor's usual number, never the channel that sent the details[10].
The first five actions
- Write down that you are out of scope. One page: activity not listed in Annexes I and II, no side activity such as a data centre or managed ICT service, date of the check. That is the answer you will reuse for the next client questionnaire, in ten minutes instead of two days.
- Put dual validation on transfers. Any change of bank details for a landlord, a supplier or a contractor is confirmed by a call to the number already on file, and logged. In this trade it is the best ratio of cost to loss avoided.
- Purge rejected applicant files. Set three months in the active database and automate deletion[5]. While you are there, check that your form asks for nothing outside the annexes of decree 2015-1437: it is the easiest non-compliance to establish at a real-estate professional[4].
- Turn on two-factor authentication on mailboxes. Account hijacking is the leading category of assistance journeys for businesses[9], and it is the entry point for bank-detail fraud. Start with accounting and letting management.
- Prepare your supplier answer. If even one of your principals is in scope, draft your security sheet in advance: backups with a dated restore test, incident notification deadline, list of your own subcontractors, a security contact. You will negotiate instead of complying under pressure.
At CyberNovaLabs.io
Our free NIS2 check settles the scope question in minutes, country by country, and tells you what still applies when your sector is not listed. If clients send you security questionnaires, our cybersecurity section sets out the response framework.
We also work with real-estate businesses on B2B appointment setting: see our commercial real-estate offer and our guide on appointment setting for estate and letting agents.
Unsure about your scope or about a client questionnaire? Ask for a review: you get a written position you can hand to your client. Work is quoted on request.
Sources
- Directive (UE) 2022/2555 (NIS2), annexes I et II - EUR-Lex
- Transposition de NIS2, DORA et REC de nouveau reportee (IREDIC, 13/10/2026)
- NIS 2 - MesServicesCyber (ANSSI)
- Decret n° 2015-1437 du 5 novembre 2015 fixant la liste des pieces justificatives pouvant etre demandees au candidat a la location et a sa caution
- CNIL - Location d'un bien immobilier : quels justificatifs peut-on demander ?
- Deliberation CNIL n° 2021-057 du 6 mai 2021
- CCI Paris Ile-de-France - Conditions d'obtention d'une carte professionnelle loi Hoguet
- Tracfin - Relations entre Tracfin et le declarant (LCB-FT)
- Cybermalveillance.gouv.fr - Rapport d'activite 2025 (mars 2026)
- Cybermalveillance.gouv.fr - Fiche reflexe : la fraude au virement ou au faux RIB
- MonEspaceNIS2 - aide et pre-enregistrement (ANSSI)
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Belgian tax portal attacked: deadline moved (28/10/2026)
Four days without MyMinfin, Tax-on-Web or Biztax, and a filing deadline that did not move. No data was stolen, so the cost sits elsewhere. What the Belgian tax portal cyberattack changes in practice for an SME in Belgium, France, the Netherlands and Luxembourg.
Read the article →November 3, 2026 · 9 min readAI Act 2026: what SMEs actually need to know
Applicable since 2 August 2026, the AI Act comes down to three duties for an SME that buys AI. The heavy Annex III rules now wait until 2 December 2027. Here are the dates, the fine ceilings that actually apply to an SME, and who enforces in the Netherlands, Belgium, France and Luxembourg.
Read the article →November 2, 2026 · 8 min readNIS2 Belgium: are hotels and tourism firms in scope?
Accommodation and restaurants are not in the annexes of the Belgian law of 26 April 2024. Three duties still catch you, and one of them already decides corporate contracts.
Read the article →November 1, 2026 · 8 min readNIS2 Netherlands: are webshops and marketplaces in scope?
Dutch law does not target "e-commerce". It targets three digital services, one of which is online marketplaces. Here is the exact test, the real obligations, and what still catches a webshop that is out of scope.
Read the article →October 30, 2026 · 7 min readApp trackers: CNIL fines Fnac Darty 7 million euros (29/10/2026)
One tracker, one mobile app, a 7 million euro fine. The CNIL decision made public on 29 October 2026 targets an application, not a website — which is exactly why it matters to any SME in the Netherlands, Belgium, France or Luxembourg that keeps a flawless cookie banner on its site and has never audited its app.
Read the article →October 30, 2026 · 8 min readAI for SMEs: the 5 tasks to automate first
20.0% of EU enterprises with 10 or more employees used AI in 2025, up from 13.5% a year earlier. Measured usage gives an SME a clear order of priority: five tasks, in this order, and three to leave alone.
Read the article →