French lawmakers finally debate the NIS2 cybersecurity bill, which would cover 15,000 organizations

The bill has been waiting since March 13, 2025, when it was submitted to the National Assembly. On Monday, November 9, lawmakers finally open the floor debate on the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, according to the Assembly's legislative file. Discussions are scheduled through Friday, November 13, except on the 11th, a public holiday, the Silicon website reports.

The bill transposes three European texts adopted in 2022: the NIS2 cybersecurity directive, the directive on the resilience of critical entities, and a part related to DORA, the regulation on digital operational resilience for the financial sector. France had until October 17, 2024 to transpose NIS2 and the critical entities directive, and until January 17, 2025 for the DORA-related part. On July 8, 2026, the European Commission referred France to the Court of Justice of the European Union for failing to transpose NIS2.

A bill pulled from the agenda several times

Adopted by the Senate on March 12, 2025, the bill was due to be examined during the extraordinary session in July, then on October 7. The day before, on October 6, the Assembly's Conference of Presidents removed it from the agenda: the examination of another text was taking longer than planned, as Cyberiack reported. Rapporteur Éric Bothorel then hoped for it to be put back on the agenda “within two weeks or three weeks,” according to Projet Arcadie. The bill finally returns a month later.

From 300 to 15,000 organizations affected

The stakes are considerable for businesses and local authorities. The NIS2 part would raise the number of organizations subject to cybersecurity obligations from about 300 to 15,000, across eighteen sectors, including nearly 1,500 local authorities, according to NosParlementaires. Healthcare, manufacturing, chemicals, research, postal services and digital infrastructure fall within the scope, Silicon explains. For so-called essential entities, penalties could reach €10 million or 2% of worldwide revenue.

The other part modernizes the system protecting activities of vital importance, created in 2006. It notably adds district heating and cooling networks, hydrogen and sanitation.

Encryption, a point of friction

Lawmakers will have to review 397 amendments, according to NosParlementaires. The most anticipated ones concern Article 16 bis, added by the Senate on an amendment by Senator Olivier Cadic and adopted by 181 votes to 134. It prohibits requiring encryption service providers to adopt measures that would deliberately weaken their security, such as master decryption keys. On October 1, Minister Anne Le Hénanff announced that the government would support its deletion. It tabled an amendment to that effect in the name of national security, NosParlementaires reports. Ten amendments target this article.

What to do in the meantime?

The vote will not be the end of the road. Because the government has triggered the fast-track procedure, a joint committee (commission mixte paritaire) of lawmakers and senators may be convened to agree on a common text. Implementing decrees will then be needed. Organizations that may be affected nonetheless have an interest in preparing now:

• check whether their sector and size place them within the scope of the directive;
• designate who internally will report on cybersecurity to senior management;
• prepare the incident reporting procedure to ANSSI, France's national cybersecurity agency.

Our guide to what NIS2 changes details these obligations. One unknown remains: the date on which they will actually apply in France.

Update of November 12, 2026

Lawmakers settled the encryption question on the second day of debate on the bill transposing the NIS2 directive. On Tuesday, November 10, they deleted Article 16 bis, added by the Senate. The article prohibited requiring providers of encrypted messaging services to build in “backdoors,” the hidden access points that make it possible to read communications. The deletion was voted by 69 votes to 37, according to LCP and Next.

The government supported the deletion. Junior Minister for Digital Affairs Anne Le Hénanff pledged not to reintroduce any provision weakening messaging encryption before the end of the parliamentary session. Interior Minister Laurent Nuñez echoed that pledge and judged the article “written too broadly.” For rapporteur Éric Bothorel (Ensemble pour la République), the provision “would tomorrow put our investigators in difficulty.” La France insoumise and the Écologiste et social group voted against. LFI lawmaker Arnaud Saint-Martin denounced “an immense setback for our digital freedoms,” Next reports. Philippe Latombe (Les Démocrates), chair of the special committee, added a nuance: “Rejecting Article 16 bis does not mean backdoors will be authorized.”

According to LCP, the formal vote on the whole bill is scheduled for Tuesday, November 17. The government has triggered the fast-track procedure. A joint committee (commission mixte paritaire) of seven lawmakers and seven senators may therefore then be convened to reconcile the Assembly's version with the Senate's, which had voted for Article 16 bis.