NIS2 and HR SaaS: what changes for French vendors in 2026

NIS2 in a nutshell

The NIS2 directive, now transposed into French law, dramatically widens the scope of entities with cybersecurity obligations. Where NIS1 mainly concerned vital infrastructure operators, NIS2 also covers their critical suppliers.

And that's where HR SaaS vendors come in.

Why HR SaaS is in scope

A hospital uses your HR management software. A local government manages its staff through your HRIS. A telecom operator runs payroll on your platform. All of these clients are essential or important entities under NIS2.

NIS2 requires these entities to ensure their critical suppliers maintain adequate security levels. Your software processes their employees' data? You're a critical supplier.

What your clients will ask for

If you can't provide these, your clients will either find another vendor or document why they accept the risk. Most will choose the first option.

Concrete obligations

Risk analysis

You must have a formalized risk analysis covering:

Incident management

In case of a security incident affecting availability or confidentiality:

Supply chain security

Using Supabase, Firebase, AWS? You must document your own suppliers' security measures and assess associated risks.

How to prepare

What CleanIssue offers

Our Full Audit covers NIS2 requirements for suppliers: attack surface analysis, access control evaluation, configuration checks, and a detailed report reusable in your client questionnaire responses.

For teams that want to stay compliant over time, Ongoing Monitoring maintains continuous proof without hiring a security lead.