NIS2, DORA, AI Act: why cyber compliance is becoming a business issue in 2026-2027

Why compliance is unavoidable in 2026-2027

A regulatory net that changes scale

The first NIS directive targeted operators of essential services and digital service providers: around 500 entities in France, according to the French Senate. With NIS2, the scope grows to some 15,000 essential or important entities across 18 sectors, compared with 7 in the annex of the first directive, to which digital service providers were added. Energy, transport, health, banking, but also manufacturing, food, digital services and waste management: thousands of companies come into scope, well beyond critical operators alone.

Penalties change scale too: up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher, for an essential entity; up to 7 million euros or 1.4% for an important entity. The directive also involves management: it must approve the risk management measures, oversee their implementation and undergo training.

Three texts, three timelines

NIS2. The directive was due to be transposed by 17 October 2024. In France, the Resilience bill was adopted by the Senate in March 2025: it transposes NIS2, the critical entities resilience directive and directive (EU) 2022/2556 that accompanies DORA, and adapts French law to the DORA regulation, which applies directly. At the time this article was published, it was still awaiting its debate in the National Assembly: on 6 October 2026, it was once again withdrawn from the agenda. Meanwhile, in July 2026, the European Commission referred France to the Court of Justice of the European Union.

DORA. The regulation has applied since 17 January 2025 to the financial entities within its scope: banks, insurers, payment institutions and asset management companies, among others. They submitted their first register of information on their ICT providers to the authorities in spring 2025, and in November 2025 the European authorities designated nineteen critical technology providers, placed under their direct oversight.

Related readResilience in the Financial Sector - Lessons from Human EvolutionFinancial-sector resilience mirrors the human body's homeostasis: a four-step framework for advancing technology resilience and operating-model resilience together.Read the article

AI Act. The European AI regulation applies in stages. Prohibited practices have applied since February 2025, as has the obligation to take measures promoting AI literacy, which the July 2026 “digital omnibus” regulation relaxed. Obligations for general-purpose AI models have applied since August 2025, and transparency obligations from August 2026, with a transitional period for some of them. Requirements for high-risk systems have been postponed: they will apply on 2 December 2027 to Annex III systems, used in particular in recruitment, education, credit scoring or biometrics, and on 2 August 2028 to Annex I systems, embedded in products that are already regulated.

Don't wait for the law

The timeline trap

The transposition delay is often used as an argument to postpone the topic. That is a misreading. On 17 March 2026, ANSSI, the French national cybersecurity agency, published the Référentiel Cyber France (ReCyF), which translates NIS2 into twenty security objectives. These twenty objectives foreshadow the expected security framework; the proposed means make it possible to document that they are met. The document remains a working document until the law is passed. And once the law is enacted, compliance deadlines will be tight: an organisation that has already analysed its risks will only need to adjust, while one discovering the topic will have to build everything in a hurry.

The threat does not wait

According to the 2026 CESIN barometer, which surveys its members, information security officers, 40% of organisations suffered at least one significant cyberattack in 2025, and 81% of victims measured its impact on their business. Phishing remains the leading vector, cited in 55% of incidents, ahead of vulnerability exploitation (41%) and attacks through third parties (35%). According to ANSSI's 2025 cyber threat overview, 1,366 incidents were brought to its attention in 2025, including 128 ransomware compromises.

And the cost is real: in France, a data breach cost 3.59 million euros on average in 2025, according to IBM's annual study.

Related readAnthropic Says AI Is Making Cybercrime Easier: Here's How to RespondThe Anthropic report of August 2025 on how AI lowers the barrier to entry for cyberattacks, and what it means for defence.Read the article

The knock-on effect: the supply chain

This is the most underestimated point. NIS2 requires regulated entities to secure their supply chain, and DORA requires financial entities to keep a register of information on their ICT providers, to include specific clauses in their contracts and to be able to exit a contract with a provider that does not meet their requirements.

Organisations already apply this logic. Again according to CESIN, a third of them believe that more than half of their incidents are caused by third parties. In response, 85% include security clauses in their contracts and 74% send security questionnaires to their suppliers. A company working for a bank, an energy operator or a regulated manufacturer is therefore affected indirectly, even if it falls under neither text itself.

The third trigger: the insurer

Cyber insurance has taken hold among mid-sized companies: according to AMRAE's LUCY 2026 study, the number of insured mid-sized companies rose from 1,145 to 2,002 in one year, 75% more, and the amount of their claims quadrupled, from 6.8 to 28.8 million euros. Across the whole market, claims rose from 55 to 83 million euros. To take out or renew a policy, companies must now demonstrate concrete measures: multi-factor authentication, isolated and tested backups, patches applied. The insurer becomes, in effect, one more auditor.

ISO 27001: a common foundation, to be completed

Why start with ISO 27001

With three texts on different timelines, the most useful question is simple: which framework to start with? ISO 27001 is often a good starting point. It is an international information security management standard, recognised in every sector, which structures a risk-based approach rather than a checklist. And it is a voluntary certification: it can be built at your own pace, without waiting for a text to be enacted.

An ISO 27001 certified organisation already has formalised security governance, a documented risk analysis, incident management and supplier control: a good share of the foundations that NIS2 and DORA require. But certification is not enough on its own:

• The scope may differ: an ISO 27001 certification can cover a limited scope, whereas the NIS2 regulatory scope can be significantly broader.
• NIS2 adds its own requirements: registration with the authority, incident notification within short deadlines, supervision and inspections, ReCyF security objectives, the role of management bodies.
• So does DORA: register of information on ICT providers, contractual clauses set out in Article 30, incident classification and reporting, and, for the entities concerned only, threat-led penetration testing (TLPT).
• The AI Act follows a different logic: ISO 42001 helps structure AI governance, but does not give a presumption of conformity with the regulation.

A common foundation, then the requirements specific to each text

Treating NIS2, DORA and the AI Act as three separate projects, with three sets of documentation and three timelines, is the most expensive way to proceed. Many requirements overlap: the same measure often addresses several texts at once. We build this common foundation in three steps, then complete it with what each text specifically requires.

The first step is the most structuring: the risk analysis follows ANSSI's EBIOS Risk Manager method, in five workshops that each build on the previous ones.

Two free resources from ANSSI

To get started without waiting for a consulting budget, ANSSI provides two free resources. The IT hygiene guide brings together 42 essential security measures, a baseline of good practice that prepares the ground for a more formal approach. The ReCyF, published in March 2026, recognises ISO 27001 for certain objectives, within the scope covered by the certification. An ISO approach started today will therefore count the day NIS2 becomes enforceable, provided its scope is checked.

The most expensive pitfalls

• Waiting for the law: the legislative timeline dictates neither that of customers, nor that of insurers, nor that of attackers.
• Believing a certification is enough: an ISO 27001 certification on a limited scope covers neither the full NIS2 scope nor the obligations specific to DORA or the AI Act.
• Opening one project per text: three teams, three sets of documentation and three audits for requirements that largely overlap.
• Confusing documentation with proof: a continuity plan that has never been tested commits no one on the day of the incident.
• Forgetting suppliers: attacks through third parties are among the top three incident vectors.
• Leaving AI out of scope: uninventoried AI uses make the risk classification required by the AI Act impossible.

Related readAI agents shouldn't be a security nightmarePrompt injection, data exfiltration, rogue agents: a six-layer framework to deploy AI agents safely in production, from least privilege to the kill switch.Read the article

Where to start

What is most often missing: a cross-cutting view

In many organisations, the topic is already being addressed, but piecemeal: a certification here, a security policy there, customer questionnaires handled as they come. What is missing is a cross-cutting view: which texts apply, what existing measures already cover, and where the gaps are. Without it, every new requirement restarts a project.

The right approach is not to read each text in full before acting. It is to start from who you are: your business, your size, your sector, your customers and your existing certifications. This context tells you which texts apply and which requirements to address first.

Five actions make it possible to start this very week and frame the roadmap, without waiting for “the right moment”, which never comes.

How Adservio supports you

This is the approach of our Cyber resilience offering: EBIOS RM risk analysis, Zero Trust, continuity proven through real exercises, aligned with NIS2 and DORA. For AI, our AI governance offering takes over: mapping of high-risk systems, model governance and continuous compliance monitoring.