NIS2: does it apply to you, and what should you do?

Artifhack · July 2026 · 6 min read

The European NIS2Directive, adopted in December 2022, imposes cybersecurity obligations on a much broader range of companies than the previous regulation. In France, its transposition (the “Resilience Act”) is being finalised in 2026 under ANSSI's oversight. Around 15,000 French entities are affected — and many do not yet know it.

Does it apply to me? The two criteria

NIS2 combines a sector criterion with a size criterion :

• Essential entities (EE) : companies in the most critical sectors (energy, transport, health, water, digital infrastructure…) with at least 250 employees or turnover above €50 million.
• Important entities (IE) : a broader scope — starting at 50 employees or €10 million turnover in the sectors covered (food, chemicals, waste, postal services, digital providers…).

The cascade effect: a trap for small businesses

Even below these thresholds, NIS2 can affect you as a supplier or subcontractor of a regulated entity: the Directive requires affected entities to secure their supply chains. Your large corporate customers may therefore demand security assurances — questionnaires, audits and evidence of monitoring.

Main obligations

• Risk management : identify your assets and vulnerabilities and address them — which means knowing your attack surface.
• Incident notification : report significant incidents to the authorities within short deadlines.
• Governance : management is directly responsible for implementation — executives may face personal liability.
• Documentation : be able to demonstrate compliance during an inspection.

First practical steps

1. Check whether your sector is listed in the NIS2 annexes and assess where you stand against the size thresholds.
2. Inventory your Internet-facing assets: this is the foundation of the required risk management.
3. Set up continuous monitoring and retain reports: they are your evidence of compliance.
4. Involve management now: this is an explicit obligation under the Directive.

Continuous attack surface monitoring and data leak detection — the core ofArtifhack— directly address the “risk management” aspect of NIS2, with timestamped reports that can be used as evidence.

Sources: Directive (EU) 2022/2555 · ANSSI, cyber.gouv.fr (NIS2 transposition in France). This article is an introduction, not legal advice.