NIS2 in France: where the law stands and what to do now

The key points

NIS2 is a European directive from December 2022. It requires thousands of organizations in 18 sectors to adopt cybersecurity measures. Member states had to transpose it by October 17, 2024 at the latest.
As of October 12, 2026, France has not yet transposed it. The "Resilience" bill was adopted by the Senate on March 12, 2025. Its floor debate in the National Assembly, scheduled for October 7, 2026, has been postponed again, and no new date has been set.
The European Commission referred France, Ireland, Spain and the Netherlands to the Court of Justice of the European Union (CJEU) on July 8, 2026. It is asking for financial penalties.
According to parliamentary debates, about 15,000 entities would be affected in France, including nearly 1,500 local authorities, compared with about 500 under the current regime.
The obligations do not yet apply under French law, but ANSSI (France's national cybersecurity agency) has already published its tools: a simulator, voluntary pre-registration and a framework of measures (ReCyF).
Waiting for the law is not a good strategy. The required measures are basic good practices, and ANSSI already recommends them.

What are we talking about?

Directive (EU) 2022/2555, known as NIS2 (Network and Information Security), replaces the first NIS directive of 2016. In France, that directive covered only a few hundred "operators of essential services." NIS2 greatly widens the scope. It requires the organizations concerned to manage their cyber risks, report significant incidents and involve their leadership.

In France, NIS2 is to be transposed by the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, known as the "Resilience" bill (loi Résilience). The text also transposes two other European acts: the CER directive (resilience of critical entities) and the directive accompanying the DORA regulation on digital operational resilience in the financial sector. It has three parts, one for each European act. The part on cybersecurity gives supervision to ANSSI, the French National Cybersecurity Agency.

For a first overview, see also our article NIS2: what changes for businesses and local authorities.

Where does the transposition stand?

The bill was submitted to the Senate on October 15, 2024, under the accelerated procedure. Senators adopted it on March 12, 2025. In the National Assembly, a special committee chaired by Philippe Latombe adopted its version on September 10, 2025. The rapporteur is Éric Bothorel.

Since then, the text has been waiting for a floor debate. A debate hoped for in July 2026 did not take place. The most frequently cited point of disagreement is article 16 bis, added by the Senate. It prohibits requiring encryption providers to adopt mechanisms that deliberately weaken security, such as "master" decryption keys. According to the specialist press, this article pits some lawmakers against the intelligence services.

On October 6, 2026, the Conference of Presidents removed the text from the agenda for October 7 and 9. The official reason is a busy schedule. The rapporteur says he hopes it will be put back on the agenda "within two or three weeks," without any commitment. The next Conference of Presidents meets on October 13, 2026. Our article NIS2: the Resilience law postponed again in the National Assembly traces these delays.

After the Assembly vote, if the two chambers do not adopt the same text, a joint committee (commission mixte paritaire) will have to reach an agreement. Then the implementing decrees and orders must be published. These texts will specify, among other things, the detailed criteria, registration and reporting procedures. NIS2 will apply fully in France only once all of these texts are published.

Who is affected?

The sectors

The directive covers 18 sectors, split across two annexes.

Sectors of high criticality (Annex I, 11 sectors): energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT (information and communication technology) service management between businesses, public administration, space.
Other critical sectors (Annex II, 7 sectors): postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery, vehicles, etc.), digital providers, research.

Essential entities and important entities

The general rule is based on size. Companies in a covered sector that are at least medium-sized enterprises, as defined by European recommendation 2003/361, are affected. ANSSI summarizes the thresholds as follows:

Essential entity: a large company in an Annex I sector, meaning at least 250 employees, or revenue above €50 million and a balance sheet above €43 million.
Important entity: a medium-sized company in an Annex I sector, or a medium-sized or large company in an Annex II sector. The threshold starts at 50 employees, or annual revenue and balance sheet above €10 million.

There are exceptions. Some entities are affected regardless of their size: qualified trust service providers, domain name registries, sole providers of an essential service in a country, and entities designated as critical. A small organization can therefore be covered. Conversely, an SME that is not directly affected may have to meet NIS2 requirements set by its customers, as part of their supply chain security.

The case of local authorities

The bill plans to include local authorities, but their exact scope depends on the final text. In the initial version of the bill, regions, departments, municipalities with more than 30,000 inhabitants, urban communities, metropolitan area communities and metropolises are essential entities. Communities of communes are important entities. The Senate approved the 30,000-inhabitant threshold. The treatment of communities of communes still had to be clarified at the end of 2025. According to figures cited in the debates, about 1,500 local authorities would be affected, including about 300 municipalities with more than 30,000 inhabitants.

The best way to find out whether your organization is affected is the ANSSI simulator on MonEspaceNIS2. When it launched, it could not give a conclusive answer for local authorities, because the law had not been passed.

The obligations

Managing risks

Article 21 of the directive requires "proportionate" measures following an "all-hazards" approach. They cover at a minimum:

risk analysis and information system security policies;
incident handling;
business continuity (backups, recovery) and crisis management;
supply chain security, including service providers;
security in the acquisition, development and maintenance of systems, including vulnerability management;
assessment of the effectiveness of the measures;
basic IT "hygiene" and training;
cryptography and encryption;
human resources security, access control and asset management;
multifactor authentication and secure communications.

In France, these requirements will be translated into the Référentiel Cyber France (ReCyF), the French cyber framework. ANSSI published it on March 17, 2026 as a working document (version 2.5), which may change after the law is passed. It is not mandatory by default. An entity that applies it will be able to rely on it during an inspection. ANSSI has also announced a framework of basic measures for the least mature organizations.

Reporting significant incidents

Article 23 of the directive sets three steps for any significant incident:

an early warning within 24 hours of becoming aware of it;
a notification within 72 hours, with an initial assessment;
a final report no later than one month after the notification.

In France, reports will be made to ANSSI, through CERT-FR. The exact procedures depend on upcoming decrees.

Registering

Entities will have to register with ANSSI and report changes in their situation. This requirement will become mandatory once the law and its decree are published.

Involving leadership

Under article 20, management bodies approve security measures, oversee their implementation and can be held liable for breaches. Their members must undergo training. For essential entities, the directive even allows, as a last resort, temporarily banning an executive from exercising their functions. This measure does not apply to public administrations.

Inspections and penalties

The directive sets minimum ceilings for administrative fines:

Category	Maximum fine (whichever amount is higher applies)
Essential entity	€10 million or 2% of worldwide annual revenue
Important entity	€7 million or 1.4% of worldwide annual revenue

Essential entities will be subject to ex-ante inspections. Important entities will be inspected after the fact, in particular following an incident. Under the bill, the State, local authorities and their public administrative bodies are not subject to these fines. They remain bound by the security and reporting obligations, however.

In April 2024, the director general of ANSSI mentioned a three-year transition period before full enforcement. This announcement has no legal value: only the law and its decrees will set the actual deadlines.

Timeline

Date	Step
December 27, 2022	NIS2 published in the Official Journal of the EU
October 15, 2024	Resilience bill submitted to the Senate
October 17, 2024	Transposition deadline (application planned for October 18, 2024)
November 28, 2024	Formal notice sent to 23 member states, including France
March 12, 2025	Adopted by the Senate on first reading
May 7, 2025	Reasoned opinion from the European Commission
September 10, 2025	Adopted by the National Assembly's special committee
November 24, 2025	ANSSI opens voluntary pre-registration
March 17, 2026	ReCyF published (working document)
July 8, 2026	Referral of France to the CJEU, with a request for financial penalties
October 6, 2026	Floor debate planned for October 7 removed from the agenda
Upcoming	Assembly vote, possible joint committee, promulgation, implementing decrees

Where to start

These actions are useful whether or not your organization is affected. They form the baseline NIS2 expects.

Check your status. Run the MonEspaceNIS2 simulator. If you are an affected company, complete the voluntary pre-registration on ANSSI's Club SSI: the form takes about 5 to 10 minutes. If you are a local authority, create an account on Club SSI to follow the announcements.
Appoint a lead and brief leadership. Name a cybersecurity contact. Present NIS2 to the executive team or local executive, and plan their training.
Take inventory. List your systems, your critical data, your privileged accounts and your IT service providers.
Handle the basic measures. Enable multifactor authentication on email, remote access and administration accounts. Apply security updates. Set up offline backups and test restoration.
Prepare incident handling. Write a short procedure: who to alert, how to classify an incident, how to report within 24 hours. Run a simple crisis exercise.
Review contracts. Add security and incident notification clauses to your contracts with service providers and cloud providers.
Measure yourself against ReCyF. Compare your practices with the framework, or with the future framework of basic measures if your organization has limited tooling. Then draw up an action plan over twelve to twenty-four months.