The NIS2 Directive: what impact on the healthcare sector?

Directive (EU) 2022/2555, known as NIS2, considerably widens the range of entities subject to cybersecurity obligations. The healthcare sector is listed among the highly critical sectors.

Governance and accountability

NIS2 makes management bodies accountable and imposes risk-management measures as well as an incident-reporting obligation. Governance becomes a board-level matter.

Who is in scope in healthcare

NIS2 changes scale compared with NIS1: beyond the hospitals already regulated, the scope now includes — subject to size and turnover thresholds — medical biology laboratories, manufacturers of critical medical devices, pharmaceutical research and development entities, and many players in the medicines supply chain. Organizations are classified as “essential” or “important” entities, with differentiated supervision and sanction regimes — up to €10 million or 2% of worldwide turnover for essential entities, €7 million or 1.4% for important ones. ANSSI, the French cybersecurity agency, expects around 15,000 regulated entities in France, compared with some 500 under NIS1.

And even outside the direct scope, the chain effect applies: regulated entities must control the security of their supply chain — so their software vendors, managed-services providers and contractors will see NIS2 requirements arrive through their contracts.

The concrete obligations

The core of the framework has two parts. First, cyber risk-management measures: security and risk-analysis policies, incident handling, business continuity and crisis management, supply-chain security, encryption, access control and multi-factor authentication, training — including for executives. Second, an obligation to report significant incidents in three stages: early warning within 24 hours, detailed notification within 72 hours, final report within one month.

The most structural novelty lies elsewhere: management bodies are personally accountable for approving and overseeing these measures. Cybersecurity stops being an IT matter and becomes a board matter.

French transposition: where things stand on 15 September 2026

The directive was due to be transposed by 17 October 2024. Nearly two years later, the French law has still not been enacted. The vehicle is the bill “on the resilience of critical infrastructure and the strengthening of cybersecurity”, which transposes three European texts in one move: NIS2, the CER Directive on the resilience of critical entities, and the accompanying measures for the DORA Regulation in the financial sector. Its journey so far: presented in the Council of Ministers in October 2024, adopted by the Senate at first reading in March 2025, then adopted unanimously by the National Assembly's special committee in September 2025 — but the plenary debate has been postponed several times since, and is expected at the September 2026 parliamentary session, with no confirmed date at the time of writing.

On the implementation side, ANSSI — designated as the national authority — has announced a gradual ramp-up of requirements (roughly three years before the first sanctions) and opened the MonEspaceNIS2 portal so entities can already test whether they are in scope. The exact scope of regulated entities and the enforceable timeline will be set by the law and then its implementing decrees.

France referred to the EU Court of Justice

The summer's landmark event: on 8 July 2026, the European Commission referred France to the Court of Justice of the European Union — along with Ireland, Spain and the Netherlands — for failure to transpose NIS2, after a letter of formal notice in November 2024 and a reasoned opinion in May 2025. The Commission is asking for financial sanctions: a lump sum and daily penalty payments running until full transposition is notified.

What to take away if you run a healthcare organization: the French delay is a scheduling reprieve, not an exemption. The directive exists, its content is known, the institutional pressure is mounting — and on the day the law is enacted, regulated entities will gain nothing from discovering their obligations at that moment. Organizations that map their exposure, their incidents and their supply chain now will reach entry into force months ahead.

NIS2, GDPR, HDS: three frameworks, one hygiene

A single incident — ransomware encrypting a patient data server — can simultaneously trigger a NIS2 notification (significant incident), a GDPR notification to the CNIL within 72 hours (personal data breach) and a review of the hosting provider’s HDS commitments. Rather than three compliance silos, the right approach is a single foundation: a shared map, a unified incident procedure that feeds all three obligations, and governance shared between the DPO, the CISO and management. That is exactly the articulation we build with our cybersecurity partners.