NIS2 and European Standards: What It Means for Quebec SMBs with European Clients

In this article

• What exactly is NIS2?: the directive has applied since 18 October 2024 to 18 sectors, with fines up to €10M or 2%.
• The domino effect on the supply chain: your European clients must secure their direct suppliers, and the pressure comes through the contract, not a regulator.
• The four pillars of NIS2: risk management, reporting at 24 h, 72 h and one month, supply chain security and accountable management.
• Two years on, the directive still is not in everyone's law: the Commission took four states to the Court of Justice, including France, which still has no law.
• NIS2 vs Law 25: cousins, not twins: Law 25 is a base, but NIS2 goes further on technical measures, deadlines and suppliers.
• What about GDPR in all of this?: Canada's adequacy decision still stands, and C-36, the successor to C-27, is still only a bill.
• What Quebec SMBs should do now: a written inventory, an incident response plan, contracts read closely and a list of your own suppliers.
• What we don't know yet: uneven transposition from country to country, amendments proposed in January 2026, and a mostly commercial risk.
• The link to digital sovereignty: answering a questionnaire is simpler when you know where your data lives and who holds the keys.
• Conclusion: NIS2 is a commercial reality, and most of the work is documenting what you already do.

You have a client in France, a partner in Belgium, or a subcontracting deal with a German company. Everything's running smoothly, deliverables ship on time, invoices get paid. Then one day, you receive a 40-page questionnaire about your cybersecurity posture. Your European contact is almost apologetic: "it's the new directive, we have no choice."

Welcome to the world of NIS2.

What exactly is NIS2?

NIS2 (Network and Information Security Directive 2) is the second version of the European cybersecurity directive. It replaced the original (NIS1) on 18 October 2024. Member States had until 17 October 2024 to adopt and publish it in their national law, and had to apply those measures from the day after.

In short: Europe decided that cybersecurity is too important to let each company decide its own level of effort. The directive covers 18 critical sectors: energy, transport, health, digital infrastructure, cloud services, and many more.

Targeted companies are classified into two categories: essential entities (the largest, most critical ones) and important entities (the rest of the covered sectors). Both must comply, but fines differ: up to 10 million euros or 2% of global revenue for essential entities, 7 million or 1.4% for important ones.

The domino effect on the supply chain

Here's what directly concerns us in Quebec: NIS2 doesn't just target European companies. The directive requires covered entities to secure their supply chain, including their non-EU suppliers.

In practice, if you're an IT subcontractor, a cloud services provider, a software developer, or even a professional services provider for a European client, that client now has a legal obligation to make sure you meet a minimum level of cybersecurity.

The pressure doesn't come from a European regulator showing up in Montreal. It comes from your clients themselves: security questionnaires, contractual clauses, supplier audits. If you can't demonstrate your security posture, you risk losing the contract. Not because your work is bad, but because your client simply isn't allowed to take the risk.

The four pillars of NIS2

The directive revolves around four main obligations:

1. Risk management: documented security policies, risk assessments, baseline technical measures (patching, access control, encryption). Nothing revolutionary for a well-managed company, but it has to be written down, formal, and verifiable.

2. Incident reporting: this is where it gets serious. NIS2 requires a three-stage reporting process: an early warning within 24 hours of becoming aware of the incident, a detailed notification within 72 hours, and a final report no later than one month after that notification. The month runs from the 72-hour notification, not from the incident, and that nuance changes how you plan for it. Your European client will expect you to respond within the same timeframes if the incident involves you.

3. Supply chain security: identify critical suppliers, assess their security practices, include cybersecurity clauses in contracts. The text is explicit about it: the measures must cover supply chain security, "including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers". Direct supplier means you. This is precisely the part that affects Quebec SMBs.

4. Governance accountability: the management body has to approve the risk-management measures, oversee their implementation, and can be held liable for failures. Not just the IT department: the board and senior management. One correction worth making, because the opposite gets written a lot: the directive does not provide for personal fines. It provides for something else. Where other measures have failed and a deadline to fix things has been missed, the authority can have the head of an essential entity temporarily barred from exercising managerial functions. It is a last resort, and it applies to essential entities only.

Two years on, the directive still is not in everyone's law

Here is the detail that throws people when the questionnaire lands: several Member States still have not finished transposing NIS2 into their national law.

The European Commission opened proceedings on 28 November 2024, with letters of formal notice to 23 Member States. On 7 May 2025 it sent reasoned opinions to 19 of them. And on 8 July 2026 it referred four laggards to the Court of Justice of the European Union, Ireland, Spain, France and the Netherlands, asking the Court to impose a lump sum and daily penalty payments until transposition is complete. In France, the transposition bill passed the Senate in March 2025 but is still waiting for its floor vote in the National Assembly.

What matters here is not the procedure, it is what the procedure implies for you. Your French client can perfectly well send you a NIS2 questionnaire while France has not finished writing its own law. That is not a contradiction: the requirement reaching you does not come from your client's national law, it comes from your client's contract. Large European companies have been preparing since 2024 because they know the law is coming, and they started by tightening up their suppliers.

The practical corollary is simple. Do not build your answer on the text of one national law, which may still change or may not exist yet. Build it on the directive itself, which is the common denominator across all twenty-seven, and let your client tell you what their own law adds on top.

NIS2 vs Law 25: cousins, not twins

We already have Law 25 in Quebec, which governs the protection of personal information. Is it enough to meet NIS2 requirements? Not quite. Here's why:

Law 25 is a good starting point. If you're already compliant, you have a solid foundation. But NIS2 goes further on technical measures, reporting timelines, and supplier assessments. It's a complement, not a replacement.

What about GDPR in all of this?

Canada benefits from a partial adequacy decision from the European Commission for personal data transfers. In plain terms, Europe considers that PIPEDA (the federal law) offers an "adequate" level of protection for commercial data. In January 2024, after a review, the Commission concluded that PIPEDA continues to offer adequate protection. The decision still stands, and the next review is expected around 2028.

But be careful: "adequate" doesn't mean "identical." The decision only covers commercial organizations under PIPEDA, not government bodies or provincial organizations that aren't subject to the federal law. And one thing needs correcting here, because it is still written everywhere: Bill C-27, which was to replace PIPEDA with the Consumer Privacy Protection Act, died on the Order Paper when Parliament was prorogued on 6 January 2025. Its successor, Bill C-36, was introduced on 15 June 2026 and has not yet passed second reading in the House of Commons. The federal law governing your transfers today is therefore still PIPEDA, unchanged.

NIS2 and GDPR are two different but complementary things. GDPR protects personal data. NIS2 protects systems and networks. A cybersecurity incident can trigger obligations under both frameworks at the same time.

What Quebec SMBs should do now

Most Quebec SMBs will never be directly targeted by NIS2. But if you have clients in Europe, here's what's likely coming in the next few months:

Take stock of where you stand: document what you already have in place. Password policy, backups, updates, access control. Often, SMBs do the right things but don't write them down. NIS2 requires evidence.

Prepare an incident response plan: even a simple one. Who does what if a server gets compromised? How do you notify your client within 24 hours? We covered this in our article on disaster recovery planning.

Review your contracts: your agreements with European clients will likely include new clauses. Read them. Understand what you're committing to.

Document your supplier chain: you have subcontractors too. If your European client has to assess their chain, they're going to ask you to assess yours.

What we don't know yet

We'd rather be upfront about what we don't know yet:

NIS2 transposition varies from one European country to another. Germany has applied its transposition law since 6 December 2025. France does not have one yet. And where the law exists, the rules are not identical from one country to the next. If you serve clients in multiple EU countries, the requirements may differ in the details.

The European text itself is still moving. On 20 January 2026, the Commission proposed targeted amendments to NIS2: clarifying who is covered, lightening obligations for a new category of small mid-cap companies, and covering submarine cables more fully. It is a proposal, not a law: the European Parliament and the Council still have to agree on the text.

Enforcement against companies is still hard to read. The visible litigation is about Member States that have not transposed, not about companies being penalised. How many non-EU suppliers will actually lose a contract for failing to show their posture, nobody knows: that plays out in commercial conversations that never get published.

Most Quebec SMBs will never receive a fine from the EU. The real risk is commercial: losing a client or a contract because you can't demonstrate compliance. It's less dramatic than a 10-million-euro fine, but it's just as real for a 15-person SMB.

Finally, we're not lawyers. What we're writing here is a plain-language overview to give you context. For the legal details specific to your situation, talk to a lawyer who specializes in digital law.

The link to digital sovereignty

There's an angle that rarely comes up in NIS2 discussions: control over your infrastructure. When a European client asks where your data is hosted, who has access, and which jurisdiction it falls under, it's a lot easier to answer when you control your own systems.

That's our approach at Blue Fox: we help SMBs set up infrastructure they understand and control. Not out of ideology, but because it's concretely simpler to answer a compliance questionnaire when you know exactly what's running on your servers, where the backups are, and who holds the keys.

We've covered these issues from other angles in our articles on privacy-respecting jurisdictions and on digital sovereignty and organizational resilience.

Conclusion

NIS2 isn't a direct threat to Quebec SMBs. It's a commercial reality that will show up through the requirements of your European clients. Better to prepare now, while it's still a competitive advantage, than in six months when it becomes a prerequisite.

If you're already compliant with Law 25, you have working backups, an incident response plan, and a clear idea of who has access to what in your organization, you're probably further along than you think. The bulk of the work is just documenting it.

That's what we're here for. Let's talk about your compliance.

Sources

• EUR-Lex, Directive (EU) 2022/2555, the NIS2 Directive: the text itself. Article 20 for governance, 21 for supply chain security, 23 for reporting deadlines, 34 for fines and 41 for the transposition date.
• European Commission, the NIS2 Directive: the official overview and the 18 sectors covered.
• European Commission, NIS2 transposition in EU countries: where each Member State stands, country by country.
• European Commission, referral of Ireland, Spain, France and the Netherlands to the Court of Justice: the 8 July 2026 decision, and the lump sum and daily penalties requested.
• European Commission, reasoned opinions to 19 Member States: the 7 May 2025 step, and the 28 November 2024 letters of formal notice before it.
• European Commission, cybersecurity package questions and answers: the 20 January 2026 proposal to amend NIS2, and what it changes.
• French Senate, legislative file for the bill on critical infrastructure resilience and cybersecurity (in French): the French transposition, passed by the Senate on 12 March 2025 and still pending in the National Assembly.
• German Federal Government, NIS2 transposition in force (in German): the German law, in force since 6 December 2025.
• European Commission, adequacy decisions: Canada's status and the scope of the decision.
• HillNotes, Library of Parliament, Privacy and Artificial Intelligence in Canada: Bill C-27 dying on the Order Paper at the 6 January 2025 prorogation.
• LEGISinfo, Parliament of Canada, Bill C-36: the successor to C-27, introduced on 15 June 2026, and where it stands.
• Law 25, Publications du Québec: the Quebec text, for comparison.