NIS2 is the European cybersecurity directive (EU) 2022/2555. It applies to medium-sized and large companies in 18 sectors, including a large part of manufacturing: chemicals, food, pharmaceuticals, medical devices, electronics, electrical equipment, machinery, automotive and other transport equipment. It requires risk management measures and the reporting of significant incidents within 24 hours, and it makes management accountable. In France, the law transposing it had still not been adopted as of 4 November 2026.
NIS2: definition
The NIS2 Directive was adopted on 14 December 2022 and published in the Official Journal of the European Union on 27 December 2022. It replaces the first NIS Directive of 2016, which only covered a limited number of operators of essential services. Its principles:
- a wider scope: 18 sectors, including the manufacturing of critical products;
- a size criterion: as a rule, all medium-sized and large companies in these sectors are covered, without case-by-case designation;
- common obligations: security measures, incident reporting, registration with the national authority;
- penalties proportionate to worldwide turnover.
Member States had to transpose it by 17 October 2024. In France, the authority in charge of implementing it is ANSSI, the national cybersecurity agency.
Which manufacturers are in scope
The directive sorts sectors into two annexes. Manufacturing is mostly in the second, entitled "other critical sectors":
- manufacture of medical devices and in vitro diagnostic devices;
- manufacture of computer, electronic and optical products (division 26 of the European NACE classification);
- manufacture of electrical equipment (division 27);
- manufacture of machinery and equipment (division 28);
- manufacture of motor vehicles, trailers and semi-trailers (division 29);
- manufacture of other transport equipment (division 30), such as rail, aerospace or shipbuilding;
- manufacture and distribution of chemicals, within the meaning of the REACH regulation;
- industrial production and processing of food, and its wholesale distribution.
The "sectors of high criticality" in the first annex also include manufacturers: energy production, water and, in health, the manufacture of basic pharmaceutical products and preparations (division 21), as well as medical devices considered critical during a public health emergency.
On size, ANSSI summarises the thresholds as follows:
- essential entity: at least 250 employees, or more than 50 million euros in turnover and more than 43 million euros in balance sheet, in a sector of high criticality;
- important entity: at least 50 employees, or more than 10 million euros in turnover and balance sheet.
A medium-sized or large machinery plant or food company is therefore in principle an important entity. A large drug manufacturer is an essential entity. ANSSI estimates that several thousand entities will be covered in France and provides an online test to check.
The obligations
The obligations are the same for both categories; what changes is the intensity of supervision and the level of penalties.
Management is accountable. Management bodies approve the cybersecurity measures, oversee their implementation and can be held liable for infringements. Their members must take training.
Ten minimum risk management measures, under an "all-hazards" approach that also covers the physical environment of systems:
- risk analysis and information system security policies;
- incident handling;
- business continuity: backups, disaster recovery, crisis management;
- supply chain security, including relationships with direct suppliers and service providers;
- security in the acquisition, development and maintenance of systems, including vulnerability handling;
- assessment of the effectiveness of the measures;
- basic cyber hygiene and training;
- cryptography and, where appropriate, encryption;
- human resources security, access control and asset management;
- multi-factor authentication and secured communications.
Reporting of significant incidents to the authority, meaning those causing severe disruption or financial loss:
- an early warning within 24 hours of becoming aware of it;
- an incident notification within 72 hours, with an initial assessment;
- a final report no later than one month after the notification.
Registration: an entity in scope registers with ANSSI, which has opened a pre-registration service.
For a manufacturer, these obligations cover all of its network and information systems, which includes shop-floor systems as soon as they support its activity. The technical protection of these systems (controllers, supervision, plant networks) is covered in our guide SCADA security.
Penalties
The directive sets minimum ceilings, which each country can raise:
- essential entities: up to at least 10 million euros or 2% of the group's total worldwide annual turnover, whichever is higher;
- important entities: up to at least 7 million euros or 1.4% of worldwide annual turnover.
These fines target breaches of the security measures and the reporting obligations.
Where NIS2 stands in France
Transposition is behind schedule:
- 15 October 2024: the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, which transposes NIS2 and two other directives, is tabled in the Senate;
- 12 March 2025: adopted by the Senate;
- 10 September 2025: the text is adopted by the special committee of the National Assembly;
- 6 October 2026: the text, scheduled for debate on 7 and 9 October, is withdrawn from the agenda, with no new date.
As of 4 November 2026, no law has therefore been enacted and the NIS2 obligations do not yet apply under French law. Decrees and orders will then be needed. In the meantime, ANSSI encourages future entities to prepare and has published its set of measures, ReCyF, as a working version. France is also the subject of proceedings before the Court of Justice of the European Union for incomplete transposition. At European level, the Commission proposed targeted amendments to the directive on 20 January 2026 to simplify its application.
NIS2 and the Cyber Resilience Act: the company and the product
A manufacturer can be covered by two different European texts:
- NIS2 targets the company: the security of its own systems and the reporting of its incidents;
- the Cyber Resilience Act (Regulation (EU) 2024/2847) targets products with digital elements, hardware or software, placed on the European market.
The Cyber Resilience Act entered into force on 10 December 2024. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products, including those already on the market. Its other obligations apply from 11 December 2027. A maker of connected machinery or equipment can therefore fall under NIS2 for its plant and under the Cyber Resilience Act for what it sells.
What manufacturers said at Tech for Industry Show
At Tech for Industry Show 2026, at Paris Expo Porte de Versailles:
- Exotec, a French maker of warehouse robots, is classified as an important entity. The company estimates it already covers around 80% of the NIS2 requirements through its ISO 27001 certification and its annual SOC 2 Type II report. It is also preparing for the Cyber Resilience Act, a condition for the CE marking of its products. For its customers, large industrial groups, cybersecurity has become a prerequisite for commercial discussions. Read the article
- Cement maker Vicat, cited by the president of Schneider Electric France, installed probes, firewalls and sensors to become compliant. The data collected, then used for performance, brought 6% more productivity in two years, the equivalent of one extra cement plant's output. Read the article
- Dassault Aviation sees an average of two attacks a week on its supply chain. To avoid each aerospace prime contractor imposing similar but different requirements on its suppliers, the industry has pooled a cyber awareness and protection service for subcontractors, AirCyber. Read the article
The talks can be watched again as replays: Cybersecurity and the industrial supply chain (Exotec), Tech and industry: a decisive alliance in the global battle.
How to prepare for NIS2
1. Check whether the company is in scope: sector and NACE code of each company in the group, headcount, turnover and balance sheet; ANSSI's online test gives a first answer.
2. Appoint the person accountable at management level and plan training for executives.
3. Inventory the systems, office and shop floor included, and the suppliers that access them.
4. Compare the current state with the ten measures of the directive, using ANSSI's ReCyF; an ISO 27001 certification already covers part of the way.
5. Write the reporting procedure: who detects, who qualifies the incident, who alerts ANSSI within 24 hours.
6. Review supplier contracts: security clauses, remote access, incident reporting.
7. Follow the law's timeline and register with ANSSI as soon as the entity knows it is in scope.
Frequently asked questions
What is NIS2?
The European cybersecurity directive (EU) 2022/2555, which requires security measures and incident reporting from medium-sized and large companies in 18 sectors.
Which industries are covered by NIS2?
Chemicals, food, pharmaceuticals, medical devices, electronics, electrical equipment, machinery, automotive and other transport equipment, as well as energy and water.
Is a manufacturing SME covered?
Yes from the size of a medium-sized company, meaning at least 50 employees or more than 10 million euros in turnover and balance sheet, if its activity is in the directive's sectors. A smaller company may also receive requirements from customers in scope, under the security of their supply chain.
When does NIS2 apply in France?
After the transposition law is enacted and its decrees are published. As of 4 November 2026, the bill, adopted by the Senate in March 2025, is still awaiting debate in the National Assembly.
What penalties does NIS2 provide for?
Up to at least 10 million euros or 2% of worldwide turnover for an essential entity, and 7 million euros or 1.4% for an important entity.
What is the difference between NIS2 and the Cyber Resilience Act?
NIS2 concerns the security of the company's systems; the Cyber Resilience Act concerns the security of the digital products it places on the market.
