As we enter the second half of 2026, the French transposition of the NIS2 (Network and Information Security) Directive remains pending. This delay relative to the initial timetable has prompted infringement proceedings from the European Commission. Yet, for the thousands of essential and important entities affected, waiting for the final publication of the law in the Official Journal would be a strategic mistake. The urgency is not legislative; it is operational.
The waiting trap: why ANSSI is not waiting for the law
While the national legal framework is still under discussion, the French National Cybersecurity Agency (ANSSI) has already set things in motion. The agency does not make its expectations contingent upon the finalization of the legislation.
Demonstrating this commitment to supporting the economic fabric without delay, ANSSI has made the Référentiel Cyber France (ReCyF) available. This operational document provides a clear roadmap of the expected risk management measures. In parallel, the pre-registration service on the official platform MesServicesCyber is already active. This proactive initiative from the French State sends a strong signal: organizations that have initiated their compliance based on these frameworks will be in a position of strength during the initial audits, regardless of the final legislative adjustments.
The 1.4% sanction: a governance lever rather than a mere fine
This figure is frequently cited, at times alarmingly: administrative sanctions for non-compliance with the obligations of the NIS2 Directive can reach up to 1.4% of the entity's total worldwide annual turnover (or €10 million for essential entities, whichever is higher).
Beyond the punitive aspect, this amount has an educational value. It officially establishes that cybersecurity is no longer a mere technical concern for the IT department, but a major governance risk directly involving the liability of executive management bodies. Future ANSSI audits will not be limited to verifying a firewall or an antivirus solution; they will audit the traceability of decisions, team training, and the organization's ability to report an incident within the mandatory deadlines (24 hours for the early warning).
Transforming regulatory uncertainty into a competitive advantage
This transitional context creates a window of opportunity for organizations that choose to stay ahead of the deadline. This is where ITrust’s expertise proves crucial.
Faced with the sovereignty and supply chain control requirements inherent to NIS2, our approach relies on end-to-end controlled solutions. Our sovereign SIEM, hosted in France, ensures that our clients' logging and security data does not leave the national territory, thereby meeting the strictest expectations of regulatory bodies.
Coupled with our Managed SOC offering, it enables entities—often constrained by internal resource limits—to benefit from 24/7 monitoring. The integration of our Reveelium technology introduces an essential predictive dimension: it is no longer just about detecting an intrusion, but about identifying behavioral anomalies proactively, thereby reducing response times and facilitating the incident reporting mandated by the directive.
A practical roadmap with ITrust
Rather than passively enduring the legislative timeline, we support our clients through a continuous improvement process. This involves targeted maturity audits to assess gaps between the current state and the requirements of the Référentiel Cyber France, followed by a prioritized action plan for implementing risk management measures.
Structuring your approach
NIS2 compliance is an enterprise-wide project requiring a clear vision of obligations and adapted tools. To understand the scope of the directive, entity classifications, and industry-specific requirements in detail, please consult our comprehensive guide to the NIS2 directive.
Do not let transposition delays turn into security delays. The ITrust teams are available to evaluate your readiness level and guide you toward controlled, sovereign digital resilience.
