Cybersecurity - NISS

NIS 2 self-registration

Legal obligation

Self-registration is a legal obligation that must be fulfilled within two months of the NIS 2 Act taking effect, i.e., no later than July 10, 2026.

Self-registrations completed before the NIS 2 Act takes effect remain valid, provided that the data they contain remains accurate and up to date; the entities concerned are required to keep this data continuously updated.

Failure to self-register does not exempt an entity from its obligations under the NIS 2 Act.

Self-registration

Official self-registration for NIS 2 is carried out using this form:

Simulator

A questionnaire is available to help you assess whether your organisation is subject to the NIS 2 Regulation (indicative result).

You will need information about your sectors of activity, your presence in the EU and the size of your organisation.

This simulation does not allow you to self-register.

Scope of the NIS 2 Act

The NIS 2 Act applies to entities active in one or more sectors listed in Annexes I and II of the Directive. The following list summarises the different sectors within the scope of application.

  • Energy
  • Transport
  • Health
  • Drinking water
  • Waste water
  • Digital infrastructure
  • ICT service management (B2B)
  • Public administration
  • Space
  • Postal and courier services
  • Waste management
  • Manufacture, production and distribution of chemicals
  • Production, processing and distribution of food
  • Manufacturing
  • Digital providers
  • Research

Some sectors are made up of several sub-sectors or types of entities, such as the digital infrastructure sector (see figure below).

Exemple de sous-secteurs

Definitions of sectors

For a more detailed view, please consult the annexes of the NIS 2 Act. Please find a document proposing definitions of the various sectors of activity covered by the NIS 2 Act below.

By default in scope of application

The NIS 2 Act introduces a rule for determining the entities that fall within the scope of application linked to the size of the company, also known as the ‘size-cap’. This means that a company that is active in one of the sectors of the annexe I or II, and that is of a certain size (see below the section ‘Explanations on the size-cap’), it will by default be affected by the NIS 2 Act.

Furthermore, the NIS 2 Act provides several exceptions to the application of the ‘size-cap’ rule (for example: for providers of public electronic communications networks or publicly available electronic communications services, for trust service providers or top-level domain name registries and domain name system service providers).

Regardless of its size, an entity may be identified as essential or important according to specific criteria (for example: an entity already identified as a critical entity; a sole supplier in its field of activity, etc.).

Some sectors are made up of several sub-sectors or types of entity, such as the digital infrastructure sector (see figure below).

NIS 2 size cap rules - Annex 2

Explanations on the size-cap

The user guide to the SME definition published by the European Commission can facilitate the interpretation of the size cap rule in the NIS 2 Act.

An entity is considered medium-sized if it has at least 50 and no more than 249 employees, or if it has an annual turnover of between €10 million and €50 million, or if its annual balance sheet total is between €10 million and €43 million.

If any of these criteria are exceeded, the company is considered large.

The ceiling rule is applied at the group level. To calculate the size of the entity under review, it must take into account not only its own workforce and turnover, but also the workforce and turnover of its partner enterprises and linked enterprises.

According to Article 6 of the Annex to Commission Recommendation 2003/361/EC, the following data must be taken into account:

1) 100% of the data of the enterprise under review;

2) 100% of the data of all linked enterprises and of all linked enterprises to these linked enterprises;

3) the pro rata (based on control) data of the partner enterprises of the entity under review, as well as the companies related to the partner companies.

The partner companies of the partner companies are not taken into account.

More details and calculation examples can be found in the user guide to the SME definition.

The legal framework

Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité et portant modification de :
1°la loi modifiée du 14 août 2000 relative au commerce électronique ;
2°la loi modifiée du 23 juillet 2016 portant création d’un Haut-Commissariat à la Protection nationale ;
3°la loi du 17 décembre 2021 sur les réseaux et les services de communications électroniques.
Cadre légal Législation nationale, Lois Cybersécurité - NISS May 6, 2026
More information
Règlement d’exécution (UE) 2024/2690 de la Commission du 17 octobre 2024 établissant des règles relatives à l’application de la directive (UE) 2022/2555 pour ce qui est des exigences techniques et méthodologiques liées aux mesures de gestion des risques en matière de cybersécurité et précisant plus en détail les cas dans lesquels un incident est considéré comme important, en ce qui concerne les fournisseurs de services DNS, les registres des noms de domaine de premier niveau, les fournisseurs de services d’informatique en nuage, les fournisseurs de services de centres de données, les fournisseurs de réseaux de diffusion de contenu, les fournisseurs de services gérés, les fournisseurs de services de sécurité gérés, ainsi que les fournisseurs de places de marché en ligne, de moteurs de recherche en ligne et de plateformes de services de réseaux sociaux, et les prestataires de services de confiance
Cadre légal Textes européens, Règlements UE Cybersécurité - NISS October 18, 2024
More information
The entire legal framework of the sector

News

Check our latest news

All the news from the sector
  • Securing your organisation

    The NISS department ensures that legislation on network and information system security is properly enforced across a range of sectors.

    More information
  • NIS 2 Act

    Find out more about the NIS 2 Act.

    More information
  • Incident Notification

    Please use SERIMA to report incidents.

    More information