NIS2 is Directive (EU) 2022/2555, which Member States had to transpose by 17 October 2024. In France, ANSSI leads the transposition and designed the Référentiel Cyber France, or ReCyF, which lists the measures the agency recommends for meeting the security objectives of NIS2 and is meant to become the foundation of French cybersecurity regulation.
What ReCyF is and where to find it
The latest version is 2.5, dated 17 March 2026 and published as a working version on the NIS 2 space of MesServicesCyber where the MonEspaceNIS2 address also leads, together with the change log, a comparison tool covering the ISO 2700X family and the « ReCyF en pratique » practical sheets released since 7 September 2026. ANSSI states that the framework may still change to reflect parliamentary debates and regulatory work.
Twenty security objectives and 152 acceptable means of compliance
ReCyF presents itself as the framework referred to in Article 14 of the French transposition bill and pairs each security objective with acceptable means of compliance:
- The objective says what to achieve, it matches the obligation the decree will set and meeting it is mandatory
- The means says how to get there, it is not mandatory in principle but applying it lets you rely on it to show that the objective is met
- An alternative measure remains possible if you justify it in your compliance analysis
Objectives 1 to 15 apply to both important and essential entities, from the inventory of information systems to incident handling and business continuity, while objectives 16 to 20 apply to essential entities only with the risk-based approach, audits, secure configuration, administration from dedicated resources and security monitoring. Each of the 152 means states who it is for and roughly half of them concern essential entities only.
Which entities NIS2 covers in France
According to ANSSI, several thousand entities across 18 sectors will be covered, mostly medium and large companies along with public bodies. Essential entities are generally the large organisations in highly critical sectors, from 250 staff or above €50 million in turnover and €43 million on the balance sheet, while important entities employ at least 50 people or exceed €10 million in turnover and balance sheet. ANSSI's online test tells you your category and pre-registration is already open.
Where the French transposition law stands
The bill on the resilience of critical infrastructure and the strengthening of cybersecurity transposes the CER, NIS2 and DORA texts in one go. The Senate adopted it on 12 March 2025 and the special committee of the Assemblée nationale voted on it on 10 September 2025, but as of mid-October 2026 the Assemblée nationale's legislative file shows no vote in plenary session, so the law has not been adopted.
ANSSI points out that NIS2 will only enter into force in France once the law, its decrees and its orders have been promulgated, and it invites future entities to strengthen their security right now, especially as the work on inventory, governance and evidence will remain useful whatever the final version looks like.
Running CyFun® and ReCyF side by side in a Belgian and French group
A group is not regulated as such because each company is assessed separately and in principle falls under the law of the Member State where it is established, so your Belgian subsidiary follows the law of 26 April 2024 under the supervision of the CCB while your French subsidiary will follow French law under ANSSI's supervision.
Yet both frameworks build on the same measures in Article 21 of NIS2. In Belgium a validated CyFun® implementation gives a presumption of conformity, and in France ANSSI states that ISO 27001 certification is not enough on its own but can serve as a method for rolling out ReCyF. We therefore recommend that you:
- Keep a single inventory of systems and a single evidence base for the whole group
- Link each document to the CyFun® requirements and ReCyF means it covers, using ANSSI's comparison tool as a guide
- Keep country-specific expectations visible, such as the per-system compliance analysis and action plan that ReCyF asks for
How Sinplify helps you prepare ReCyF and CyFun® together
Sinplify's European AI reads the documents you already have, recognises the good practices in place and prepares what is missing, then every piece of evidence your team confirms counts for CyFun®, ISO 27001 and ReCyF at once so that your Belgian and French entities move forward without redoing the work. Sinplify structures and accelerates your approach and prepares your file, without replacing ANSSI's supervision or an assessment by an accredited body.
Explore the Sinplify platform, read our article on NIS2 in Belgium and the role of the CCB or book a demo to see Sinplify at work on your own documents.