← All resources

NIS2 France: are transport and logistics firms in scope?

Published October 11, 2026 · 7 min read · CyberNovaLabs.io

A road haulier is not in NIS2 scope because it moves freight. But two regimes already bind French operators today, and a third arrives through their customers. The texts, the dates and the figures, with no invented fines.

The short answer

No, not as a carrier. A road freight company is not in scope of NIS2 simply because it moves goods: for road transport, Annex I of Directive (EU) 2022/2555 names only road authorities responsible for traffic management control and operators of intelligent transport systems^[3]. And as of 11 October 2026 there is no applicable NIS2 obligation in France: the national cybersecurity agency ANSSI states that transposition is still under way and the bill carrying it has not been enacted^[1]. This NIS2 France transport and logistics guide sets out who is actually in scope, what already binds you without waiting for the law, and what a shipper can legitimately demand from you this week.

Are you in scope? The tests, in order

Ask the questions in this order. The first no takes you out of direct scope.

1. Is my activity named in Annex I? For haulage, freight forwarding, parcel distribution or ordinary warehousing: no. The table below gives the entities actually named, sub-sector by sub-sector.
2. Size thresholds. Essential entity: at least 250 staff, or turnover above 50 million euros and a balance sheet above 43 million euros. Important entity: at least 50 staff, or turnover and balance sheet above 10 million euros^[3]. Crossing a threshold never pulls in an activity the annexes do not name.
3. Am I a supplier to a regulated entity? This is the question that really matters in logistics, and we come back to it below.
4. Am I already a designated vital-importance operator? If so, your obligations exist today, and they do not come from NIS2.

ANSSI publishes MonEspaceNIS2, with a self-assessment tool for a specific entity^[2]. Ten minutes. Run it once, archive the answer, date it: that is what you hand to the first customer who asks.

What Annex I actually says about transport

Two consequences that are rarely spelled out. First, road is the only sub-sector where no transport undertaking is named at all: road enters through traffic management, not through freight^[3]. Second, if your business is mail and parcels, you do not sit in the transport sector but in postal and courier services, which appear in Annex II among important entities^[3]. The same truck can give two different answers depending on which annex applies.

Where France stands on 11 October 2026

ANSSI is explicit: transposition is under way, and future essential and important entities are invited to start securing themselves now, in line with NIS 2^[1]. Three practical consequences for an operations director.

• A framework already exists. Since 17 March 2026 ANSSI has published the Referentiel Cyber France (ReCyF), listing the measures it recommends to meet the security objectives set by NIS 2. It is issued as a working document, non-binding by default, and corresponds to the framework referred to in article 14 of the Resilience bill; an entity that chooses to apply it will be able to rely on it during an ANSSI inspection^[1].
• Registration can be prepared, not imposed. ANSSI provides a space to anticipate NIS 2 registration, but no French legal deadline is running today^[1][2].
• The change of scale is real. Parliamentary work describes the shift from roughly 500 critical infrastructures under NIS 1 to some 15 000 essential or important entities^[4]. Your name may appear through temperature-controlled warehousing, food production or managed IT services, not through transport.

A word on fines. The percentage-of-turnover figures a vendor will quote you come from the directive and the bill, not from any French law in force. Be wary of anyone selling you a dated French penalty. We keep the real dates on our cyber deadlines calendar by country.

What already binds you, without waiting for NIS2

Two regimes already apply to French transport, and neither is waiting for the Resilience bill.

1. The vital-importance activities regime. A Prime Minister order of 2 June 2006, amended on 3 July 2008, sets the list of 12 sectors of vital importance; the regime covers more than 300 designated operators and around 1 500 points of vital importance^[4]. Transport is one of them, and that is no accident: together with energy, it was one of only two sectors covered by the 2008 European critical infrastructure directive, where the critical entities resilience directive now counts eleven^[4]. If you are designated, the bill under discussion will add an operator resilience plan, a dependency analysis and a specific resilience plan for each point of vital importance^[4]. The word to remember is dependency: your forwarder, your TMS vendor and your telematics provider all sit inside it.

2. The smart tachograph. This deadline is never presented as a cyber obligation, but it is one. New vehicles registered from 21 August 2023 carry a second-generation smart tachograph; retrofitting analogue and non-smart digital units was due by 31 December 2024, first-generation smart units by 18 August 2025 at the latest, and the requirement extends to light commercial vehicles above 2.5 tonnes used in international transport or cabotage from 1 July 2026^[6][7]. In practice, every vehicle becomes a connected device transmitting position and activity data, and every unit is an access path into your information system and into driver personal data.

The real risk for a French carrier, in figures

In its Panorama de la cybermenace 2025, published on 11 March 2026, ANSSI handled 3 586 security events, down 18 % year on year, with 2 209 reports and 1 366 incidents. Four sectors were particularly targeted: education and research (34 %), ministries and local authorities (24 %), healthcare (10 %) and telecommunications (9 %)^[5]. Transport does not appear. That does not mean it is spared: it means it reports little.

Two findings in the same report point straight at a transport operation. Edge devices, meaning the firewalls, VPNs and remote access used by your depots and drivers, remain a favoured target because of the vulnerabilities affecting them. And out of 460 events classified as possible data leaks, only 42 % could be linked to a confirmed leak^[5]: most of the cost of such an incident is investigation, which you pay even when nothing left the building.

One framing figure: the French transport statistics service counts around 41 000 legal units in freight transport, a category wider than road freight alone^[8]. The vast majority stay below the 50-employee threshold. For them the issue is not the fine, it is the customer questionnaire.

The real way in: the supply chain

When an airport, a port, a rail infrastructure manager, a hospital or a manufacturer becomes an essential or important entity, the directive requires it to secure its supply chain^[3]. It then turns to its suppliers, and the carrier is near the top of the list, because it holds access to the warehouse, to the schedule and sometimes to the ordering system. We described that mechanism for your neighbours in our NIS2 guide for transport and logistics in the Netherlands, where the law is already passed: there, questionnaires arrive long before inspectors do.

The useful reflex is not to wait. Fill in a reusable file once, using our supplier security questionnaire, and serve it as is at every tender. A carrier that answers in 48 hours with a dated document wins work against a competitor who asks for three weeks.

The first five actions

1. Run the MonEspaceNIS2 self-assessment and archive the dated answer^[2]. Ten minutes, and a written answer ready for the first customer who asks.
2. List your regulated customers. Airport, port, infrastructure manager, hospital, utility, manufacturer, public body. That is where the obligation will come from, and you already know which ones they are.
3. Enforce two-factor authentication on every remote access: TMS, mail, telematics portal, depot VPN. It is the measure the 2025 Panorama makes most profitable, edge devices first^[5].
4. Write the procedure for changing a bank account or a subcontractor's details. Every change is confirmed by phone, on a number you already hold, never the one in the email. Subcontracted haulage is paid by transfer: that is where fraud walks in.
5. Test four hours of operations without the TMS. Who loads, from which list, on which paper document, with which driver numbers? If nobody can answer, you have found the continuity plan to write before month end.

At CyberNovaLabs.io

We do not sell NIS2 compliance to a carrier that is not in scope. We do two useful things: we give you a written, dated answer to hand to your principals, and we go and get meetings with the shippers and manufacturers who need a carrier able to answer a security questionnaire. Start with our free NIS2 check, then look at how we run B2B appointment setting, including for transport and logistics companies.

Let us talk about your operation for 20 minutes

→ Get qualified meetings

Sources

1. ANSSI - La directive NIS 2 (transposition, ReCyF, enregistrement)
2. MesServicesCyber (ANSSI) - MonEspaceNIS2 et simulateur
3. Directive (UE) 2022/2555 (NIS2), annexe I - texte consolide
4. Senat - Rapport sur le projet de loi relatif a la resilience des infrastructures critiques et au renforcement de la cybersecurite
5. ANSSI - Panorama de la cybermenace 2025 (publie le 11 mars 2026)
6. Commission europeenne - Questions-reponses sur les tachygraphes, paquet mobilite
7. Commission europeenne - Renforcement du controle du tachygraphe intelligent (19/08/2025)
8. SDES - Chiffres cles des transports : entreprises de transport routier

Read next