France NIS2 Transposition (Résilience Bill)

French bill transposing NIS2, DORA and CER still in parliament as of August 2026; France is one of three member states referred to the Court of Justice for non-transposition. ANSSI is the designated authority.

JurisdictionFrance
CategoryCybersecurity
StatusProposed
Latest development

Analysis

France’s Loi Résilience (bill on the resilience of critical infrastructures and cybersecurity) is the French vehicle to transpose NIS2, CER/REC and align national law with DORA, with ANSSI designated as the national competent authority for NIS2; as of mid/late‑2026, the bill is still in Parliament and France has been referred to the Court of Justice of the European Union (CJUE) for failure to notify full transposition measures by the NIS2 deadline. See: Sénat – Rapport sur le projet de loi Résilience, Directive‑NIS2.fr – Loi Résilience, European Commission – NIS2 transposition referrals, OpenKRITIS – EU NIS2 in France, ANSSI – site institutionnel.

Key Requirements (France NIS2 Transposition – Loi Résilience)

Although the law is not yet finally adopted, the project text and official analyses describe the main obligations for entities that will fall under the French NIS2 regime.

Scope and categorisation of entities

  • Transposition of NIS2 to “essential” and “important” entities across 18 critical sectors, covering ~15,000 entities in France. The Sénat report explains that NIS2 extends regulation from 6 to 18 critical sectors and will apply to around 15,000 essential and important entities and about 1,500 local authorities in France.Sénat – Rapport Résilience A detailed French analysis confirms that the Loi Résilience extends cyber regulation to approximately 15,000 entities in 18 sectors with categories entités essentielles (EE) and entités importantes (EI).Laucked – Loi Résilience/NIS2 statut officiel An implementation overview for France also notes that the bill is structured to implement NIS2 across multiple critical sectors.OpenKRITIS – EU NIS2 in France
  • Combined transposition: NIS2, CER/REC and DORA in one bill. The Sénat legislative report states explicitly that France is transposing three EU texts to strengthen resilience and cybersecurity: Directive NIS2, Directive (EU) 2022/2557 on the resilience of critical entities (REC/CER), and the provisions adapting national law to Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA).Sénat – Rapport Résilience A specialist tracking site on NIS2 confirms that the Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité (PRMD2412608L) is the French legislative vehicle for NIS2, CER/REC and support/adaptation of DORA.Directive‑NIS2.fr – Loi Résilience Another French overview states that this bill “transposes three European texts: NIS2 (cybersécurité), DORA (secteur financier) et REC/CER (résilience des entités critiques)”.Cyber‑Diagnostic – NIS2 en France 2026

ANSSI’s role and supervisory powers

  • ANSSI designated as national competent authority and supervisory body for NIS2. The Loi Résilience tracking page states that ANSSI (Agence nationale de la sécurité des systèmes d’information) is designated as the national competent authority for NIS2, responsible for registration, supervision and sanctions.Directive‑NIS2.fr – Loi Résilience A technical overview of EU NIS2 in France notes that the national implementation is overseen by ANSSI as the National Agency for the Security of Information Systems.OpenKRITIS – EU NIS2 in France ANSSI’s official site confirms its role as the French national authority for cybersecurity and operator oversight.ANSSI – Présentation
  • Registration, supervision and sanctions framework. The Loi Résilience commentary explains that the bill defines application thresholds, registration modalities with ANSSI, a sanction scale, and ANSSI’s powers of control over regulated entities.Directive‑NIS2.fr – Loi Résilience A French legal analysis notes that the bill provides supervision mechanisms by ANSSI, including inspections and enforcement powers.OpenKRITIS – EU NIS2 in France Laucked’s synthesis describes requirements for registration with ANSSI, risk management measures, incident notification and supervision, consistent with NIS2’s model.Laucked – Loi Résilience/NIS2 statut officiel

Cybersecurity risk management measures

  • Obligation to implement technical and organisational cybersecurity risk management measures. The Sénat report summarises NIS2’s objective to ensure a high level of cybersecurity and notes obligations for entities to adopt appropriate risk management measures.Sénat – Rapport Résilience Laucked explains that entities will be required to implement risk management measures, aligning French law with NIS2 and DORA, including IT risk management and operational resilience testing.Laucked – Loi Résilience/NIS2 statut officiel The Directive‑NIS2.fr monitoring site lists key NIS2 obligations as cybersecurity risk management, incident reporting, supply‑chain security and crisis management, reflected in the French bill.Directive‑NIS2.fr – Loi Résilience
  • Inclusion of software publishers and supply‑chain actors. A report on the bill’s adoption in special committee notes an amendment that subjects software publishers to NIS2 obligations, recognizing them as an essential link in the digital supply chain, and enabling ANSSI to impose minimum security requirements by design and development and to exercise control.Solutions‑Numériques – Projet de loi NIS2/DORA adopté en commission This inclusion aligns with NIS2’s emphasis on supply‑chain security.Directive‑NIS2.fr – Loi Résilience OpenKRITIS’ France page also highlights that the bill covers sectors including postal and courier services, reflecting the broad supply‑chain focus.OpenKRITIS – EU NIS2 in France

Incident reporting and crisis management

  • Mandatory reporting of significant incidents and cyber threats to ANSSI. Laucked explains that entities will have obligations of incident notification to ANSSI, consistent with NIS2, alongside risk management and supervision.Laucked – Loi Résilience/NIS2 statut officiel The Loi Résilience trackers summarise that the bill mirrors NIS2’s incident reporting timelines and thresholds for “significant incidents”.Directive‑NIS2.fr – Loi Résilience The Sénat report stresses the need for improved incident reporting and information sharing to strengthen national and EU‑wide resilience.Sénat – Rapport Résilience

Sanctions and enforcement

  • Administrative fines and enforcement actions for non‑compliance. The Loi Résilience overview notes that the bill sets out sanction scales aligned with NIS2, allowing ANSSI to impose administrative fines and other measures on non‑compliant entities.Directive‑NIS2.fr – Loi Résilience Laucked indicates that, while formal obligations require the law’s adoption, the framework anticipates supervision and sanctions mechanisms once in force.Laucked – Loi Résilience/NIS2 statut officiel The European Commission’s NIS2 page describes that NIS2 requires Member States to set effective, proportionate and dissuasive penalties, which France is implementing through the Loi Résilience.European Commission – NIS2 Directive

Compliance Challenges

Because the Loi Résilience is still in the legislative process, organizations in France face specific challenges related to regulatory uncertainty, timing, and capacity.

Regulatory uncertainty and “law not yet adopted”

  • France referred to the CJUE for non‑transposition, while entities are asked to prepare without a final national law. The European Commission’s infringement notice confirms that France (with Ireland, Spain and the Netherlands) has been referred to the Court of Justice for failing to notify measures transposing NIS2 into national law.European Commission – NIS2 transposition in EU countries A French analysis notes that France has been renvoyée devant la Cour de justice de l’UE for delay in transposition and at the same time asks thousands of entities to prepare for compliance with a law not yet adopted, meaning formal obligations are not yet enforceable in national courts.Shattered.io – NIS2 en France 2026 : 10 000 entités Another commentary explains that, until the Loi Résilience is adopted, formal NIS2 obligations are not opposable before French courts.Shattered.io – NIS2 France CJUE

Ambiguity about deadlines and effective dates

Capacity and coverage challenges

Real examples of challenges

Implementation Best Practices

Even before final adoption, organizations can implement NIS2‑aligned controls and prepare for the Loi Résilience using established frameworks and guidance.

Governance and risk management

  • Align internal governance with NIS2 and DORA risk management principles. The NIS2 Directive requires entities to implement risk management measures, including policies for risk analysis, incident handling, business continuity, supply‑chain security and vulnerabilities management.NIS2 Directive – EUR‑Lex DORA sets detailed requirements for ICT risk management, governance, and testing, particularly for financial entities.DORA Regulation (EU) 2022/2554 – EUR‑Lex Laucked notes that the Loi Résilience aims to align national law with DORA by requiring IT risk management and operational resilience tests (including TLPT).Laucked – Loi Résilience/NIS2 statut officiel

Actionable steps (supported by these texts):

Incident management and reporting preparation

Actionable steps:

Supply‑chain and software security

  • Integrate supply‑chain security and software publisher obligations. The amendment subjecting software publishers to N

Recent developments

  • — An August 2026 practitioner guide stresses that, as of 10 August 2026, there is still **no French NIS2 law in force**, no application decrees and no enforceable registration or reporting duties under the Résilience Bill, underscoring a gap between EU transposition deadlines and the current French legal reality for cybersecurity operators and entities.[5] (source)
  • — Analysis as of 2026-08-06 indicates that France has not yet completed the principal legislative transposition of NIS2; the main vehicle remains the *Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité*, with final adoption still expected during 2026 following completion of the parliamentary process.[1] (source)
  • — A July 2026 update reports that the so‑called Resilience law, intended to transpose NIS2, was not placed on the July parliamentary agenda and that its examination has slipped to the autumn session, further delaying legal certainty for covered entities.[6] (source)
  • — French press in mid‑July 2026 notes that the National Assembly’s examination of the Résilience Bill, which transposes NIS2 into French law, has been postponed yet again, with debate now expected no earlier than the September 2026 parliamentary return, highlighting continued legislative slippage.[7] (source)
  • — A July 2026 policy analysis explains that the Résilience Bill—covering NIS2, CER and REC—has been adopted by the Senate (March 2025) and in committee at the Assemblée nationale (September 2025), but its plenary examination remains pending due to disputes over encryption provisions, prolonging uncertainty on obligations and timelines.[10] (source)
  • — A June 2026 calendar update states that the NIS2 transposition law (Résilience Bill) was initially expected to reach the National Assembly in July 2026 but has been rescheduled to September; the text simultaneously transposes NIS2, the CER Directive and DORA, with promulgation anticipated shortly after plenary examination if there is no extended shuttle between chambers.[8] (source)
  • — A May 2026 regulatory overview describes France’s **combined transposition** approach via a single bill covering NIS2 and CER, and notes that ANSSI published the *Référentiel Cyber France (ReCyF)* on 17 March 2026 as a pre‑law compliance reference, with an estimated 15,000–18,000 entities expected to fall within scope, signaling significant impact across critical sectors.[12] (source)
  • — An April 2026 specialist blog confirms that the Résilience Bill is the French legislative instrument transposing NIS2 and the CER Directive, currently under parliamentary examination in 2026, and stresses that it will redefine cybersecurity obligations for *entités essentielles et importantes* operating in France, expanding duties beyond the previous OIV framework.[15] (source)
  • — A March 2026 industry advisory notes that the “cyber resilience bill” was adopted by the Senate in March 2025 and unanimously approved in a special National Assembly committee in September 2025, with floor debate initially scheduled for summer 2026, and highlights expected obligations, fines and enlarged scope affecting French SMEs once NIS2 is transposed.[9] (source)
  • — A January 2026 compliance roadmap describes France as being in the “final stretch” of adopting the Résilience Bill, forecasting promulgation in Q1 2026 and technical decrees from ANSSI in Q2 2026, with full NIS2 regime entry into force in early to mid‑2026—though subsequent updates show this timeline slipping due to parliamentary delays.[4][6][7] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates