It has been awaited for nearly two years by digital professionals: the law transposing the European directive NIS2 is due to be debated in the plenary session in September 2026. For web agencies, hosts and digital service providers, this text greatly broadens the circle of companies subject to cybersecurity obligations — well beyond large groups.
A text that increases the number of companies concerned thirtyfold
The NIS2 directive, adopted at European level at the end of 2022, was to be transposed into French law before October 17, 2024. Like the majority of Member States, France missed this deadline: the text, carried by the law on the resilience of critical infrastructures, was only examined in committee during the first half of 2026, with a plenary session expected in September. Once voted, it will raise the number of French entities subject to cyber obligations from about 500 to nearly 15 000 French entities, according to estimates relayed by several specialist firms. The text designates the ANSSI as the supervisory authority for almost all sectors concerned, the financial sector remaining governed by the European regulation DORA.
Digital service providers on the front line
Unlike the first NIS directive, which primarily targeted large critical infrastructures (energy, health, transport), NIS2 expands its scope to digital service providers: hosts, cloud service providers, online marketplaces, but also, depending on their size, web agencies and development companies that manage infrastructures on behalf of third parties. The triggering threshold is generally set at 50 employees or 10 million euros in turnover, which brings a large number of SMEs in the sector into the scope of the law, as “important” or “essential” entities depending on their activity.
For these B2B providers, compliance involves mapping digital assets, securing privileged access, verifying the isolation of backups and documenting incident recovery procedures — a task that many organizations with fewer than 200 employees are only just discovering.
A reference framework already published by ANSSI
Ahead of the vote, ANSSI published on March 17, 2026 the Référentiel Cyber France (ReCyF), which translates the requirements of NIS2 into concrete security objectives: 20 objectives for essential entities, 15 for important entities. This framework does not yet have binding force; it will become so once the implementing decrees of the law are published. Nevertheless, it gives companies in the IT sector a working basis to anticipate their compliance before the effective entry into force of controls.
- Around 15 000 French entities affected, compared with 500 under the previous NIS directive
- Sanctions up to 10 million euros or 2% of global turnover
- Registration of affected entities expected at the end of 2026, first inspections in 2027
- ANSSI designated as the supervisory authority for almost all sectors, excluding finance (DORA)
The provisional timetable mentioned by industry specialists foresees a transition period before sanctions become fully applicable, around 2028. This gives agencies and digital providers time, but a timeframe that tightens as the text progresses through its parliamentary course.
Frequently asked questions
Are all web agencies affected by NIS2?
No, only those that exceed the chosen size thresholds (around 50 employees or 10 million euros in turnover) or that manage sensitive digital infrastructures on behalf of third parties fall within the scope of the law.
When will the Resilience law come into force?
Its examination in the plenary session is expected in September 2026; if adopted, a transition phase should follow, with registration of entities at the end of 2026 and the first inspections in 2027.
What do companies that fail to comply risk?
The text provides for financial sanctions that can reach 10 million euros or 2% of worldwide turnover, depending on the severity of the breach found.
Sources
Profil de l'auteur
Derniers articles
Development, Digital Marketing & SEO12 August 2026NIS2 and loi Résilience : what awaits web agencies and digital service providers- Weddings & Special Occasions11 August 2026Wedding cancellation insurance: the protection most couples neglect
- Development, Digital Marketing & SEO10 August 2026Advertising on ChatGPT : what's being prepared for French advertisers
- Psychology10 August 2026Post-depression brain fog : an unexpected lead with an existing drug
This article was written with the help of artificial intelligence. Editorial policy
Table of Contents
