NIS2 in France: preparing without waiting for the transposition law

Up to date as of October 18, 2026. France has not yet transposed the NIS2 directive. This article reviews the situation and will be updated as soon as the law is adopted.

Two years after the deadline set by the European Union, the NIS2 directive has still not been transposed into French law. Does that mean you should wait? No: the content of the obligations is known, ANSSI (the French national cybersecurity agency) has published its framework, and once the law is passed, the compliance deadlines will be short given the work involved.

Where does France stand?

Directive (EU) 2022/2555, known as NIS2, was adopted on December 14, 2022. Member States had until October 17, 2024 to transpose it.

In France, it is to be transposed by the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, which transposes three directives in a single text: NIS2, the directive on the resilience of critical entities (CER) and the directive that accompanies the DORA regulation for the financial sector. Its path has been long:

the Senate adopted it at first reading in March 2025;
the special committee of the National Assembly adopted it in September 2025;
its debate in plenary session, scheduled from October 7, 2026, has been postponed once again. No new date has been set so far.

In the meantime, on July 8, 2026, the European Commission referred France, Ireland, Spain and the Netherlands to the Court of Justice of the European Union for failing to transpose the directive, and asked for financial penalties.

In practice, the NIS2 obligations therefore do not yet legally apply in France. But there is little doubt about their content: it is set by the directive, which the French law must incorporate.

Who will be covered?

NIS2 greatly extends the scope of the first NIS directive of 2016. It covers 18 sectors, split between two annexes:

sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space;
other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, machinery, vehicles…), digital providers (online marketplaces, search engines, social networks) and research.

In these sectors, the directive in principle covers medium-sized and large companies: from 50 employees, or with more than 10 million euros in turnover and balance sheet total. Some entities are covered regardless of their size, for example trust service providers and DNS service providers. The public sector is also covered.

Organizations fall into two categories:

essential entities, subject to enhanced supervision, including before any incident;
important entities, supervised mainly after the fact, when there is evidence of non-compliance.

To find out whether your organization is in scope, ANSSI provides a dedicated online space, MonEspaceNIS2 (in French).

What the directive requires

Accountability at management level

Management bodies must approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements. They must also follow training (Article 20).

Risk-management measures

Article 21 requires an “all-hazards” approach covering at least:

risk analysis and information system security policies;
incident handling;
business continuity: backups, disaster recovery, crisis management;
supply chain security and the relationships with suppliers;
security in the acquisition, development and maintenance of systems, including vulnerability handling;
assessment of the effectiveness of the measures;
cyber hygiene and training;
cryptography and, where appropriate, encryption;
human resources security, access control and asset management;
multi-factor authentication and secured communications.

To turn these objectives into concrete measures, ANSSI has provided the Référentiel Cyber France (ReCyF), the French cyber framework, since March 17, 2026. It is not mandatory by default, but an entity that applies it will be able to rely on it during an ANSSI inspection.

Very short reporting deadlines

In the event of a significant incident, Article 23 sets three deadlines:

an early warning within 24 hours of becoming aware of it;
an incident notification within 72 hours, with an initial assessment;
a final report within one month.

Dissuasive penalties

The directive provides for fines of up to 10 million euros or 2% of total worldwide annual turnover for essential entities, and 7 million euros or 1.4% for important entities, whichever is higher.

Why the SOC is at the heart of the matter

Issuing an early warning within 24 hours means you must detect fast and qualify accurately. This is often where organizations discover their blind spots:

logs that are not collected, or not all of them: endpoints, cloud, business applications, service providers;
correlation rules that generate noise instead of flagging what matters;
no written criteria to decide that an incident is “significant” within the meaning of the directive;
an unclear decision chain between the SOC, management and the business teams;
evidence that is hard to piece together for the final report.

A well-equipped SOC (SIEM, SOAR, XDR) and documented response procedures are not just good practice: they are the concrete means to meet the deadlines imposed by NIS2.

Where to start right now

Check your scope: sector, size, likely category (essential or important), with ANSSI’s MonEspaceNIS2 service.
Involve management: appoint an owner, present the stakes and plan training for executives.
Map your critical assets and your dependencies, including your suppliers and service providers.
Measure your gaps against the measures of Article 21, using the ReCyF.
Test the detection and reporting chain: who decides that an incident is significant, how quickly and with what evidence.
Put continuity to the test: isolated backups, restore tests, crisis exercise.
Strengthen supplier contracts: security clauses, incident notification, right to audit.
Build a roadmap prioritized according to your risks, to present to management.

What to watch

the resumption of the bill’s debate in the National Assembly, then its final adoption;
the implementing decrees, which will specify, among other things, how much time entities will have to comply;
developments at EU level: on January 20, 2026, the Commission proposed targeted amendments to the directive to clarify some of its provisions.

Sources

← All insights