Behind the daily stream of announcements, several regulatory and security files are progressing without making headlines, even as they concretely change the obligations of businesses and administrations. The transposition of the NIS2 directive, the application of the DSA by Arcom, new rules for telephone accessibility: these topics structure the French digital landscape well beyond the usual media cycles.
Transposition of NIS2 in France: a regulatory blur weighing on businesses
The European NIS2 directive, intended to raise the cybersecurity level of organizations across the continent, is still awaiting its definitive transposition into French law. This delay places thousands of entities in an uncomfortable situation: they know they will be subject to new obligations, particularly regarding security incident notification, without having a stabilized national framework to prepare for it.
The problem goes beyond simple administrative waiting. Without a finalized French text, digital service providers, local authorities, and medium-sized enterprises struggle to calibrate their investments. Should they hire a security officer right now or wait for the implementing decrees to know the exact scope of the requirements?
Several specialized publications are closely following this file, and these updates can be found on web-ouest.fr allow for measuring the concrete progress of the transposition over the weeks. The subject remains technical, but its consequences affect a much broader spectrum of actors than just the IT sector.
Cybersecurity in France: recent incidents highlight a lack of execution
The high-profile cyberattacks of recent weeks illustrate a shared observation by authorities: the main problem is not the sophistication of the attacks but the failure to apply basic rules. Unapplied updates, poorly managed privileged accounts, lack of network segmentation: the exploited vulnerabilities remain elementary.
Vulnerabilities recurring in incident reports
- Absence of network segmentation between critical systems and web-exposed services, allowing an attacker to move laterally after initial access
- Delays in applying security patches, sometimes lasting several months, on components identified as vulnerable
- Insufficient management of access rights, with high-privilege accounts used for routine tasks
These gaps do not stem from unprecedented threats. They reflect a persistent gap between published recommendations and their daily implementation, a gap that NIS2 aims to reduce.
DSA oversight in France: Arcom opens an investigation into the MYM platform
The Digital Services Act (DSA) is no longer a theoretical text. In October 2026, Arcom formally requested information from MYM, a French subscription content platform, regarding possible violations of minor protection and service transparency. The investigation focuses on the terms of use, recommendation systems, and age verification mechanisms.
This action marks a turning point. Until now, the application of the DSA in France primarily targeted very large platforms (Google, Meta, TikTok). The fact that Arcom is targeting a smaller, French-origin platform indicates that the regulator is not limiting its oversight to American giants.
What the MYM investigation reveals about Arcom’s strategy
Arcom is not just checking for the formal presence of a “report” button. It examines the very design of recommendation systems and their ability to expose inappropriate content to minor users. The question posed is about the architecture of the service, not just its legal mentions.
For other French platforms, the signal is clear: compliance with the DSA is not solely determined by the terms of service. It involves technical documentation of recommendation algorithms and moderation mechanisms, documentation that Arcom can demand at any time.
Digital and telephone accessibility: an expanded obligation since October 2026
As of October 1, 2026, a telephone accessibility obligation has been expanded. The relevant public organizations and certain customer service departments must now provide communications adapted for deaf, hard of hearing, blind, or aphasic individuals during all their telephone reception hours, not just part of these time slots.
This modifies the obligations of public services, but also of certain private companies providing customer service missions.
What this concretely changes
- Call centers must integrate solutions for French sign language (LSF) translation or real-time transcription throughout their opening hours
- Administrations that have not yet deployed these systems are exposed to reports, even if sanctions remain to be clarified in some cases
This topic remains underreported by general tech media, which prioritize announcements about artificial intelligence or GAFAM. Digital accessibility progresses through successive regulatory obligations, often without the visibility it deserves in the current web news in France.
Keeping up with digital news daily requires going beyond product announcements to monitor these regulatory files. The transposition of NIS2, the concrete application of the DSA by Arcom, and the expansion of accessibility obligations redefine the framework within which French web actors operate.
