Seeing Clearly in the European Regulatory Ecosystem

Since October 2024, NIS2 has considerably broadened the scope of cybersecurity in Europe. Eighteen sectors are now covered in France — from energy, transport, healthcare, and public administrations, to digital service providers and critical services such as water or datacenters. In total, about six hundred types of entities are included, with a reinforced focus on the supply chain. Executives are directly accountable and may be sanctioned in case of non-compliance. The timeline is progressive: first, securing the essentials and strengthening dependencies (2025–2026), then industrializing evidence and supply chain supervision (2026–2027).

In September 2025, the French transposition added software publishers, subject to “security by design” requirements. ANSSI will lead inspections. Encryption — long at the center of passionate debates between cybersecurity experts, authorities, and law enforcement — has reached a point of balance: Article 16 bis prohibits any backdoor or voluntary weakening mechanism. This strengthens defenses and avoids opening the door to adversaries who would inevitably exploit such access.

In parallel, DORA targets the financial sector. It imposes ICT risk governance, resilience testing, strict oversight of critical providers, and a dual ANSSI/AMF notification system. Deterrence relies on national authorities, with sanctions up to license withdrawal in extreme cases.

The AI Act, which regulates AI according to risk level, and the Cyber Resilience Act, which mandates security for digital products placed on the market, add further layers. Together, these texts form a dense landscape, sometimes perceived as a maze. For companies, the challenge is clear: turn this regulatory patchwork into a clear trajectory by building a single proof pipeline and aligning governance and operations with recognized standards.

Costs, Competitiveness, and Economic Reality: How Much to Invest?

Behind the acronyms — NIS2, DORA, AI Act, Cyber Resilience Act, GDPR — lie hard numbers. Each directive, each regulation, means another audit to fund, new technologies to deploy, employees to train. These investments are essential, but they are costly. In France in particular, the average hourly labor cost exceeds €41, compared with €30 in Italy, €26 in Spain, €28 in the United States, and less than €10 in India. In other words, every compliance effort costs three to four times more here than for some global competitors.

On top of this comes the reality of the labor market: cybersecurity is already suffering from a chronic talent shortage. Each new regulation increases the pressure. Hiring an expert is a fierce competition, with rising salaries and an insufficient pool of candidates. You must do more, but with fewer available resources.

And the risks don’t stop there: ignoring or postponing compliance exposes you to hefty fines, reputational damage, or even the loss of clients in case of a data breach. With shrinking margins, heavy taxation, and competitors playing by looser rules, you are walking a tightrope.

Cybersecurity is no luxury. It is a necessity. The only remaining question is no longer “should we invest?” but “how do we decide without putting ourselves at risk?”

Our firm often observes that the minimum target range is between 8% and 10% of the IT budget, depending on exposure and maturity.
In Europe, the share of IT investments devoted to security reached 9% in 2024, according to the ENISA NIS Investments 2024 study. In practice, for €10 million in IT, about €0.9 million is dedicated to cybersecurity. By comparison, U.S. companies allocate about 13% of their technology budgets to security.

Responding to regulatory requirements pragmatically and proportionately costs less than enduring a major cyberattack. ENISA’s latest analyses show a growing number of incidents, with DDoS and ransomware among the dominant threats; finance remains one of the most affected sectors. Financially, the global average cost of a data breach is close to €5 million, and even higher in finance. The main attack vectors remain exploitation of vulnerabilities, credential compromise, and phishing — attack surfaces directly reduced by controls already required by NIS2 and DORA: active vulnerability management, extended MFA, hardening, monitoring, and tested backups. In short, what you do to “tick the box” for NIS2 or DORA is exactly what reduces your risk — and your bill.

For a business leader, the equation is clear: invest now or pay much more later.

Turning the Jungle into a Trajectory: The Compass of Standards

The multiplication of texts — NIS2, DORA, GDPR, AI Act, Cyber Resilience Act — looks like a dense forest, where every step costs time, money, and energy. The temptation is to endure or look away. But you can take back control by transforming this regulatory stack into a clear trajectory.

How? By relying on the compass of standards. ISO/IEC 27001 to establish governance, policies, and controls. NIST CSF 2.0 to structure operations around five simple verbs: Identify, Protect, Detect, Respond, Recover. ISO 22301 for business continuity, OWASP SAMM for software, IEC 62443 for OT. These foundations are tried and tested.

Map your regulatory obligations onto this framework, then maintain a proportionality register — a regulatory requirement — that justifies your choices against actual risks. This is what a regulator or auditor will expect: not immediate perfection, but proportionate, documented, governance-validated decisions. Finally, align your supplier contracts and internal metrics with these same requirements.

You gain three concrete benefits. First, stability: a framework resilient to new texts and waves of directives. Second, speed: audits and notifications flow more smoothly thanks to already structured evidence. Third, value: credible cybersecurity that protects your business, reassures clients, and strengthens competitiveness.

The path is clear: secure the essentials, extend it to your third parties, industrialize proof. Compliance will no longer be a burden — it will be the natural consequence of solid, measurable security.