← All resources

NIS2 France: are software vendors and IT providers in scope?

Published November 5, 2026 · 9 min read · CyberNovaLabs.io

Publishing software does not put you in NIS2 scope; running, hosting or securing a customer's systems does. And in France, regulated digital entities fall outside the national framework, under a directly applicable European regulation. Position as of 5 November 2026.

The short answer

Publishing software does not put you in scope of NIS2. Running, administering or securing your customers' systems does. The NIS 2 Directive never names a software vendor: among the 18 sectors retained in France, it targets ICT service management (business-to-business) — managed service providers (MSPs) and managed security service providers (MSSPs) — digital infrastructure (cloud computing, data centres, content delivery networks, DNS, top-level domain registries) and digital providers (online marketplaces, search engines, social networking platforms)^[1]. An IT firm selling licences and development work is out of scope. The same firm running managed IT for forty customers is in.

The second point is specific to France: if you are regulated on that basis, the French national baseline does not apply to you. Entities in digital infrastructure, B2B ICT service management and digital providers fall under Commission Implementing Regulation (EU) 2024/2690, which applies directly, rather than under the French set of security measures^[1][3]. You are reading a European text, not the French Cyber Framework.

NIS2 France: what changes for software vendors and IT providers

Four questions settle it, in this order.

1. What exactly do you do? The commercial label does not decide; the service delivered does. Installing, managing, operating or maintaining a customer's systems and networks, on site or remotely, is a managed service. Hosting, running a data centre, a cloud or a CDN is digital infrastructure. Selling a packaged product, building custom software, training people: none of that is listed.
2. What size are you? Essential entity (EE) from 250 staff, or with turnover above EUR 50 million and a balance sheet above EUR 43 million. Important entity (EI) otherwise, from 50 staff, or with turnover and balance sheet above EUR 10 million^[1]. The count covers the whole company, not only the regulated activity.
3. Does a size exemption apply? Yes, for activities covered irrespective of size: DNS service providers, top-level domain name registries, providers of public electronic communications networks and publicly available electronic communications services, and trust service providers^[1]. A ten-person registrar can be regulated; a 300-person software vendor may not be.
4. Where are you established? For the digital sectors, jurisdiction follows your main establishment in the Union, not the location of each customer.

Where France stands on 5 November 2026

Transposition has not happened. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity transposes three directives in three titles: CER (2022/2557), NIS 2 (2022/2555) and DORA (2022/2556). Tabled in the Senate on 15 October 2024, it was adopted by the Senate on 12 March 2025; the special committee of the National Assembly adopted a text on 10 September 2025, which still had not been debated in plenary as of the Senate special committee meeting of 26 October 2026. The reading scheduled for early October 2026 was pulled from the agenda; a November slot was mentioned without certainty, and the rapporteurs were aiming to conclude by February 2027^[2].

The delay carries a price. France faces proceedings before the Court of Justice of the European Union alongside three other late member states, and on 8 July 2026 the Commission announced it was seeking a lump sum plus daily penalty payments until full transposition^[2]. The same day, the director general of ANSSI told the Senate that NIS 2 is meant to set baseline rules for roughly 20,000 entities in France, against roughly 300 operators of vital importance over which the agency can impose measures today^[2].

The text that actually binds you: Regulation (EU) 2024/2690

This implementing regulation of 17 October 2024 sets, for managed service and managed security service providers, cloud, data centres, CDNs, DNS, top-level domain registries, online marketplaces, search engines, social networks and trust service providers, both the technical risk-management measures and the criteria that make an incident significant^[3]. Its annex has 13 headings: security policy, risk management, incident handling, business continuity, supply chain security, security in acquisition and development, effectiveness assessment, cyber hygiene and training, cryptography, human resources security, access control, asset management, and environmental and physical security^[3].

The reporting thresholds are numeric, and that is where many operators find their real problem.

If you are...	An incident is significant as soon as...
Managed service or managed security service provider (MSP, MSSP)	the service is completely unavailable for more than 30 minutes; or its availability is limited for more than one hour for over 5% of users in the Union or over one million users, whichever is lower; or the integrity, confidentiality or authenticity of service data is compromised by a suspected malicious action[3]
Cloud computing provider	complete unavailability for more than 30 minutes; or availability limited for more than 5% of users in the Union[3]
Any entity covered by the regulation	direct financial loss caused or capable of being caused exceeds EUR 500,000 or 5% of total annual turnover in the preceding financial year, whichever is lower; or the incident can cause exfiltration of trade secrets[3]

For an MSP, thirty minutes is an ordinary monitoring incident. The consequence is operational: knowing at what time a service went down and how many Union users sat behind it, without reconstructing that three days later. Penalties can reach 2% of worldwide turnover for an essential entity and 1.4% for an important entity^[1].

Out of scope is not off the hook

A French software vendor outside the regulated perimeter is still caught by two documented forces.

The first is the threat itself. In its Cyber Threat Overview 2025, published on 11 March 2026, ANSSI handled 3,586 security events, down 18% year on year, including 1,366 incidents reported to it, stable against 1,361 in 2024 after 1,112 in 2023 and 831 in 2022^[4]. The agency explicitly names the risk of fast propagation when an attack targets a widely deployed software supplier or a local or sector-specialised digital services firm, and reports that in 2025 it saw numerous compromises in which attackers moved laterally from providers' information systems into their customers', exploiting existing interconnections and stolen credentials^[4].

The second is contractual and regulatory. Supply chain security sits inside the measures imposed on your regulated customers: they must map their ecosystem and carry digital security into their contracts. You will not get a formal notice from ANSSI, you will get a security questionnaire in a tender. And if you place on the market a product with digital elements, the Cyber Resilience Act targets you directly: in force since 10 December 2024, its Article 14 has required since 11 September 2026 the reporting of actively exploited vulnerabilities and severe incidents, including for products placed on the market before the regulation's general application date of 11 December 2027^[6].

One parliamentary nuance worth knowing if you operate on both sides of a border: on 26 October 2026 the chair of the Senate special committee noted that in Belgium and several other countries ISO/IEC 27001 certification is a route to NIS 2 compliance, and that this route had not even been suggested to French companies^[2]. That is not French law, it is a difference in method to plan for inside a multi-country group. For comparison, our guides on software vendors and IT providers in the Netherlands and on software vendors and IT providers in Belgium set out the two other regimes in the same sector.

The first five actions

1. Write down your actual activities, service by service, with the contract behind each. That is the first ReCyF objective and what separates a vendor from a managed service provider.
2. Put the numbers on paper: headcount, turnover, balance sheet for the last financial year, at group level. You will know whether you land as EE, EI or below threshold, and the answer will be ready for the next customer questionnaire.
3. Instrument the thirty minutes. If one activity turned out to be a managed service, you would have to produce a start time for the outage and a count of Union users. Check today that your monitoring and logs allow that, for every billed service.
4. Pre-register with ANSSI if the test points to you, and subscribe to the legislative tracking: the law is not voted and sector parameters will be set by decree.
5. Answer the customer questionnaire once. A single evidence pack — security policy, access management, tested backups, incident procedure, subcontractors — turns a recurring commercial blocker into an attachment. Our guides on construction in France and healthcare in France show the same reflex from the customer side.

At CyberNovaLabs.io

Start with the free NIS2 check: it places you as essential, important or out of scope, and separates publishing activity from managed services. If your tenders stall on security, our supplier security questionnaire guide gives the answering structure. For what follows — building custom software that holds up under the CRA, or B2B appointment setting with IT decision makers, including IT services and MSPs — we work on quotation, with no minimum term.

Discuss your NIS2 position and your IT pipeline

Sources

1. ANSSI / MesServicesCyber - Directive NIS 2 : secteurs, seuils EE et EI, sanctions, ReCyF et exclusion des secteurs numeriques du socle francais
2. Senat, commission speciale Cybersecurite - compte rendu de la semaine du 26 octobre 2026 (etat du projet de loi, procedure CJUE, audition du directeur general de l'ANSSI)
3. Reglement d'execution (UE) 2024/2690 de la Commission du 17 octobre 2024 (mesures techniques et seuils d'incident important pour les entites numeriques)
4. ANSSI / CERT-FR - Panorama de la cybermenace 2025, CERTFR-2026-CTI-002, publie le 11 mars 2026
5. ANSSI - Referentiel Cyber France (ReCyF), version de travail v2.5 du 17 mars 2026
6. Reglement (UE) 2024/2847 du 23 octobre 2024 (Cyber Resilience Act) - dates d'application, article 14 et article 71
7. Directive (UE) 2022/2555 du 14 decembre 2022 (NIS 2) - annexes I et II
8. ANSSI - MonEspaceNIS2, foire aux questions sur le perimetre et les obligations

Read next