Apec, the French association for managerial employment, surveyed 1,150 companies of ten employees or more by telephone between 13 January and 12 February 2026, all of which had hired at least one manager in 2025: 50% reported recruitment difficulties, down five points on 2024. We open on that figure because it argues against us. Hiring a senior technical manager is easier today than it was three years ago, and the standard opening pitch for external technical leadership — "you will never manage to hire" — weakens as the market loosens.
What remains is the time it takes to hire. The same body measured twelve weeks on average simply to find a managerial candidate, a figure published in May 2024 that the 2026 edition does not renew — so we cite it as a dated order of magnitude, not a current measurement. A notice period comes on top. The gap between deciding to hire and the first useful day is counted in months, and that is the only thing the external model genuinely removes.
This article sets out the conditions under which external technical leadership actually produces decisions, the volume past which it costs more than an employee, and what it cannot carry on your behalf. We sell this service, and sometimes turn it down.
The arithmetic, with its assumptions
The figures below are French, and they do not transfer: employer social contributions, statutory leave and salary benchmarks are all national. Apec's remuneration benchmark puts an IT leadership role in the Paris region at around €77,000 fixed and €7,000 variable. Rebuilding employer contributions line by line from the applicable 2026 Urssaf rates gives 41.4% on a gross salary of €84,000 and an employer cost of roughly €122,000 a year, or about €191,000 for a very senior profile on €133,000 gross. Spread over 217 working days — 365 less weekends, nine weekday public holidays, twenty-five days of leave and around ten days of statutory time off — that is about €560 a day, or €880 for the senior profile.
| External day rate | Volume matching a median employee's cost | Per week |
|---|---|---|
| €800 | 152 days/year | ~3.2 days |
| €1,000 | 122 days/year | ~2.5 days |
| €1,200 | 102 days/year | ~2.1 days |
| €1,400 | 87 days/year | ~1.8 days |
As far as we know there is no defensible public measurement of an external technical director's day rate: the ranges in circulation come from marketplaces or from firms selling the service. We take €1,000 to €1,200 as a stated assumption. At that rate, the external model stops being cheaper past roughly two and a half days a week against a median profile, and three and a half against a very senior one. These are our assumptions; redo the calculation with yours.
Two corrections nobody writes down. VAT is neutral for a client that reclaims it, but it is a real cost for one that cannot: the threshold drops to about two days a week. And this is a steady-state threshold — a salary runs twelve months even when the workload is nil, while a retainer stops with it, so a six-month engagement at three days a week can still cost less across the year than a hire.
The model buys delay, not price
Below the threshold the saving is real, but it is not the best argument. What the model buys is a start in weeks, no recruitment fees, and no casting error to carry for twelve months.
Two claims common to the trade deserve dismantling, and the second is ours. "Diverse experience" is not falsifiable: nobody can verify that patterns from other sectors apply to you. What does not transfer can be named, though — your organisation's decision history, its balances of power, the specifics of a regulated sector. "Objectivity, no internal politics" is worse, because it is false: the outsider swaps one bias for another. They have no attachment to past decisions; they have an economic interest in the engagement continuing — and when the same firm sells both the strategy and the delivery, which is our case, they have a direct interest in recommending work they will later invoice. The only safeguard that works is to have structural decisions arbitrated by someone who will not be executing them.
What cannot be delegated
An external technical director can settle an architecture, arbitrate build versus buy, qualify a risk. They cannot provide ongoing line management on a one-day-a-week schedule, carry an engineering culture that forms through daily work, or take part in an on-call rota they do not personally cover. Without written authority — a reporting line, a scope of arbitration, a seat where decisions are taken — they are not a technical leader but a consultant who gets listened to when it suits.
Accountability stays with the organisation. NIS2 is transposed member state by member state, and as of 28 September 2026 it is not applicable in French law: the "Résilience" bill, which transposes it alongside DORA and the critical-entities directive, was passed by the Senate on 12 March 2025 and reaches the floor of the National Assembly on 7 October 2026, nineteen months later, despite an accelerated procedure. ANSSI, the designated competent authority, publishes no date for the obligations entering into force; it has however made the Référentiel Cyber France available since 17 March 2026 — not mandatory by default, but a framework an entity may rely on during an inspection. A company cannot know today whether it will be an essential or an important entity, on what date, or against which framework it will be audited. Deciding to act anyway, and deciding what to do, is precisely a technical leadership decision.
The other three texts are further along, and two of them point explicitly at the top of the house. DORA has applied in full to financial entities since 17 January 2025, and its article 5 places ultimate responsibility for ICT risk on the management body, with no delegation to the technical function. The Cyber Resilience Act has required, since 11 September 2026, an early warning within 24 hours for any actively exploited vulnerability, and the rest is set at 11 December 2027; the party responsible there is the manufacturer — which, in a development subcontracting relationship, is the client and not the supplier. As for the AI Act, its transparency obligations have applied since 2 August 2026, but the Annex III high-risk obligations were postponed to 2 December 2027 by Regulation (EU) 2026/1744: writing that they apply today would be wrong.
The artefacts to demand at 30, 90 and 180 days
A technical leadership engagement is judged on artefacts, not workshops. Here is what an executive should be able to claim, and what an engagement can be declared a failure against.
At thirty days, nothing that presupposes any change: a map of what runs, where, under which account and paid for by whom; a risk register where each entry carries an impact in euros or in days of downtime; an inventory of supplier dependencies with an estimated exit time for each; the cloud bill broken down by service; a named list of the people whose departure would block a system.
At ninety days: an open decision record in which the rejected options are written down; for each critical system, a third-party recovery procedure tested at least once, which is the core of any exit plan; a backup restore performed and dated, not "configured"; the capacity plan set against the product plan; and the compliance perimeter qualified text by text, in scope or out, on what criterion.
At a hundred and eighty days: a technical budget defensible line by line, two or three named debt programmes with the cost of inaction, the job description for the role the client must now hold internally, and an exit report stating what remains dependent on the supplier.
On measurement, two families not to confuse. Honest: the delay between "it is decided" and "it is live", the change failure rate, time to restore, infrastructure cost per user and team turnover. Theatre: deployment frequency taken alone — the 2025 DORA report documents that AI assistance raises throughput and instability — along with story points, test coverage made a target, and a maturity score computed by the supplier against a framework it wrote itself.
What we turn down
What does not work: a technical leadership engagement with no written mandate, producing recommendations nobody is obliged to apply. What works is boring — a scope of arbitration, a standing slot where decisions are made, and a decision record kept at the client's, not at ours.
A word on who this is for, because the trade describes it badly: Insee counted 7,031 mid-sized companies in France in 2023, on data published 10 December 2025, against 163,992 small and medium enterprises excluding micro-businesses. The mid-sized ones almost all have an IT department and buy interim management; the real market for this model is the SMEs.
Technical scope counts too: deciding whether you need a platform at all, and what it will ask for every week, belongs to the same conversation as what a cluster asks of you the week after go-live. We say no when the team has fewer than three developers, because there are not yet decisions to arbitrate; when an internal profile is growing into the role, because the mandate belongs to them; when the real need is a hire and not advice; and when the client is looking for a signature to cover a decision already taken. Nor do we claim this model replaces internal technical leadership: above the threshold calculated above, the right advice is to hire, and we give it knowing what it costs us.
So what to ask of a candidate, external or salaried, does not come down to their career. Rather: "show me, from your last engagement, the list of decisions you recorded, and the ones you revisited." Technical leadership is judged on decisions that still hold years after they were taken, and that can only be verified in writing.
Sources
- Apec, Pratiques de recrutement de cadres 2026 (1,150 companies, surveyed 13 January to 12 February 2026), Les rémunérations des cadres dans 111 familles de métiers — édition 2025, and the May 2024 release on recruitment lead times
- Insee, Les entreprises en France, Insee Focus no. 372, 10 December 2025, 2023 data
- National Assembly, legislative file on the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, and ANSSI, La directive NIS 2
- European regulations: DORA (EU) 2022/2554, Cyber Resilience Act (EU) 2024/2847 and AI Act (EU) 2024/1689
- Urssaf, private-sector contribution rates, applicable rates for 2026
- DORA, State of AI-assisted Software Development, 2025 — a self-reported survey published by Google Cloud, to be read with that caveat