NIS2: France's "Resilience" bill postponed again in the National Assembly

Another delay for the transposition of the NIS2 directive in France. On October 6, the Conference of Presidents of the National Assembly removed the floor debate on the "Resilience" bill (projet de loi Résilience) from the agenda. It was due to start the next day. According to the trade press, the cause is a crowded parliamentary calendar: the review of the bill on sexist and sexual violence took longer than expected. The rapporteur hopes the bill will be put back on the agenda within two to three weeks, with no firm commitment.

A bill pending since 2024

• October 17, 2024: deadline for transposing NIS2, set by the European Union.
• March 12, 2025: the Senate adopts the text on first reading.
• September 10, 2025: adoption by the National Assembly's special committee.
• July 2026: the debate is postponed, notably because of a disagreement over Article 16 bis, which protects the encryption of messaging apps.
• July 8, 2026: the European Commission refers France to the EU Court of Justice, along with Ireland, Spain and the Netherlands, and requests financial penalties.

The bill combines the transposition of NIS2, of the CER directive on the resilience of critical entities, and of part of DORA for the financial sector.

About 15,000 entities affected

According to figures presented during parliamentary debates, about 15,000 entities would be affected in France across 18 sectors, including nearly 1,500 local authorities.

Don't wait for the law to act

The legislative delay must not become an excuse for inaction. ANSSI (France's national cybersecurity agency) has already provided the tools:

• a voluntary pre-registration on the MonEspaceNIS2 platform, open since November 24, 2025 (local authorities, whose status still depends on the law, did not have access at launch);
• the ReCyF framework, published in March 2026, which translates NIS2 obligations into 20 concrete security objectives.

On October 1, before lawmakers, the director general of ANSSI said the agency was considering requiring full compliance by the end of 2028. That is an intention, not yet a written rule. Given the scale of the work involved (governance, risk management, incident reporting, supply chain security), it is better to start now.