NIS 2 in France: Transposition Enters Its Final Phase

Key points

The transposition of NIS 2 into French law is entering its final stretch: the National Assembly is examining the Resilience Bill in plenary session from Wednesday 7 October 2026. The text comes two years after the European deadline of 17 October 2024.

The delay comes at a price. On 8 July 2026, the European Commission referred France to the Court of Justice of the European Union for failure to transpose, exposing the State to financial penalties.

For businesses, the stakes are immediate. Around 15,000 organisations are expected to be designated as essential or important entities and will have to strengthen their cyber risk management, report incidents and handle vulnerabilities, under the direct responsibility of their management.

Article up to date as of 5 October 2026. It will be updated after the National Assembly vote and again after the law is promulgated.

NIS 2 transposition: the Resilience Bill timeline

The bill on the resilience of critical infrastructure and the strengthening of cybersecurity, known as the Resilience Bill (loi Résilience), now only awaits the National Assembly to complete its passage. It transposes the NIS 2 Directive (Title II) and the Critical Entities Resilience Directive, known as CER (Title I), and adapts French law to the DORA Regulation for the financial sector (Title III). The progress of the bill can be followed on the National Assembly’s legislative file.

The special committee substantially expanded the text. In particular, it made software publishers subject to NIS 2 obligations, classified health and medico-social establishments as essential entities and retained Article 16 bis, which prohibits requiring backdoors in encryption tools.

The law will only be fully operational once its implementing decrees are published. These will set, in particular, the criteria for designating entities and the deadlines for compliance.

Essential and important entities: who is subject to NIS 2?

NIS 2 changes the scale: around 300 operators of essential services were covered under NIS 1, whereas more than 15,000 entities in 18 sectors will be covered, plus nearly 1,000 groupings of municipalities and 300 municipalities with more than 30,000 inhabitants.

The basic test combines sector and size. Medium-sized companies (at least 50 employees, or more than €10 million in turnover and balance sheet total) and large companies in these sectors are covered. Some players are covered regardless of size, such as DNS service providers, domain name registries, trust service providers and providers of electronic communications.

The French bill broadens this baseline. The version adopted in committee brings software publishers within scope and classifies health and medico-social establishments, local authorities and educational establishments carrying out research activities as essential entities; local authorities are, however, exempt from fines.

The size calculation may include linked enterprises: a small subsidiary of a large group should therefore check its position. ANSSI has already opened a pre-registration portal, the first step in entities’ obligations.

NIS 2 obligations: governance, security, incidents and suppliers

NIS 2 imposes four families of obligations, and the first falls on management itself.

Cyber governance at board level

Management bodies must approve cybersecurity risk-management measures, oversee their implementation and undergo cybersecurity training (Article 20 of the directive). Cybersecurity becomes a matter for the board or the executive committee, and no longer just for the IT department.

“All-hazards” risk-management measures

Article 21 of the directive requires, as a minimum:

• policies on risk analysis and information system security;
• incident handling;
• business continuity: backups, disaster recovery and crisis management;
• supply chain security;
• security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure;
• assessment of the effectiveness of the measures;
• basic cyber hygiene and training;
• cryptography and encryption;
• human resources security, access control and asset management;
• multi-factor authentication and secured communications.

In France, ANSSI published the ReCyF (Référentiel Cyber France) in beta in March 2026, listing the measures recommended to meet the security objectives of NIS 2.

Reporting significant incidents

Any incident with a significant impact on services must be reported to the authority on a tight timeline (Article 23):

1. an early warning within 24 hours of becoming aware of it;
2. an incident notification within 72 hours, with an initial assessment;
3. a final report within one month.

If the incident affects personal data, the 72-hour notification to the CNIL required by the GDPR is added to this process. The two procedures are best managed together.

Supplier security, including outside the European Union

Each entity is responsible for the security of its direct suppliers. It will have to audit its providers, review its contracts and include security, audit and incident notification clauses.

A provider established in Tunisia, such as an offshore development centre, will most often be affected indirectly, through the clauses imposed by its French clients. Some players outside the EU may, however, fall directly within NIS 2: managed service providers and cloud or data centre providers offering their services in the EU must designate a representative there (Article 26).

NIS 2 fines and management liability

An essential entity in breach faces a fine of up to €10 million or 2% of its total worldwide annual turnover, whichever is higher. The ceiling is €7 million or 1.4% for an important entity.

ANSSI’s supervisory powers are extended: on-site inspections, targeted security audits, requests for information and evidence, and orders to comply.

Management may also be held liable. For essential entities, the directive even allows the responsible manager to be temporarily prohibited from exercising managerial functions where a formal notice remains unheeded; the exact scope of this measure in French law will depend on the final text.

Beyond administrative penalties, a documented breach could ground a liability claim against the directors and weaken the company’s position with its cyber insurer.

NIS 2, GDPR, DORA, the Cyber Resilience Act and the AI Act: building compliance as a whole

A company already engaged in GDPR compliance has a solid foundation for NIS 2: governance, oversight of processors and a breach management procedure. NIS 2 extends this logic to all information systems, beyond personal data alone.

As the software publisher Adequacy observed when interviewed by ChannelNews, lawyers, CISOs and DPOs have for too long handled these obligations separately. The new texts call for unified governance, in which legal, security and data protection teams move forward together.

NIS 2 compliance: six steps to take now

Waiting for promulgation would be a mistake: ANSSI has long urged companies to anticipate compliance, since most of the requirements are already known.

1. Qualify the entity: sector, size, group membership, essential or important entity status, documenting the reasoning.
2. Engage management: present the obligations to the executive committee, appoint a lead and plan training for directors.
3. Measure the gaps: risk analysis and audit against ANSSI’s ReCyF or the ISO/IEC 27001 standard.
4. Organise incident management: a single procedure covering the 24-hour, 72-hour and one-month deadlines, aligned with GDPR notification and tested through crisis exercises.
5. Secure the supply chain: map critical providers and revise contracts (security, audit, notification and reversibility clauses), including with providers outside the EU.
6. Document and prove: policies, minutes of management meetings, evidence of training and incident logs, which will form the file presented in the event of an inspection.

Why involve a lawyer in NIS 2 compliance

NIS 2 is first and foremost a legal obligation. A lawyer secures the entity’s qualification, drafts supplier clauses, aligns NIS 2 with the GDPR and assists the company in the event of an incident, an inspection or sanction proceedings. A lawyer’s advice is also protected by professional secrecy.

Based at 7 place Saint-Michel, in the 5th arrondissement of Paris, the firm assists French and Tunisian companies with GDPR and NIS 2 compliance: assessments, legal audits, supplier contracts, notification procedures and outsourced DPO services.

About the author. Maître Mohamed Zied El Air is a lawyer admitted to the Paris and Tunis Bars and a PECB-certified DPO. He advises companies on data protection, cybersecurity and technology law, particularly between France and Tunisia. He co-authored Tunisia’s national cloud strategy and is included on ENISA’s list of experts and on the reserve list of experts of the European Data Protection Board (EDPB).

Is your company subject to NIS 2? Contact the firm for an initial assessment of your situation. How the firm works is set out on the Fees page.

FAQ: NIS 2 transposition and the Resilience Bill

What is the NIS 2 Directive?

The NIS 2 Directive is Directive (EU) 2022/2555 of 14 December 2022 on cybersecurity. It replaces the 2016 NIS Directive, greatly increases the number of organisations covered and imposes governance, risk-management and incident-reporting obligations on them, backed by penalties.

Where does NIS 2 transposition stand in France?

NIS 2 transposition is entering its final phase. The Resilience Bill, adopted by the Senate in March 2025 and then by the National Assembly’s special committee in September 2025, is being examined in plenary session from 7 October 2026. The joint committee, promulgation and implementing decrees remain.

What is the Resilience Bill?

The Resilience Bill is the bill on the resilience of critical infrastructure and the strengthening of cybersecurity. It transposes the NIS 2 Directive and the CER Directive on critical entities, and adapts French law to the DORA Regulation applicable to the financial sector.

Is my company subject to NIS 2?

Your company is probably subject to NIS 2 if it operates in one of the 18 sectors covered and has at least 50 employees, or more than €10 million in turnover and balance sheet total. Some digital players are covered regardless of size, and group membership must also be examined.

What is the difference between an essential entity and an important entity?

Essential entities are mainly large companies in the 11 sectors of high criticality; important entities are the other entities covered. The security obligations are the same, but essential entities are supervised ex ante and face higher fines.

What penalties does NIS 2 provide for?

An essential entity faces up to €10 million or 2% of its total worldwide annual turnover, an important entity up to €7 million or 1.4%, whichever is higher. ANSSI also has powers of inspection, audit and injunction.

Are directors personally liable?

Yes, NIS 2 places cybersecurity under the responsibility of management. Directors must approve security measures, oversee their implementation and undergo training. They may be held liable, and the directive allows a temporary ban on exercising managerial functions in essential entities.

What are the deadlines for reporting a NIS 2 incident?

A significant incident requires an early warning within 24 hours, a notification within 72 hours and a final report within one month. If personal data are affected, the CNIL notification required by the GDPR applies in parallel.

Should we wait for the law to be promulgated before complying?

No. The requirements of the directive are known and ANSSI has published its ReCyF framework. Compliance takes several months: qualification, gap analysis, procedures and supplier contracts. Companies that anticipate will be ready when the decrees set the deadlines.

What is the link between NIS 2 and the GDPR?

NIS 2 protects the security of information systems; the GDPR protects personal data. The two texts overlap on governance, the security of processors and incident notification. A joint approach avoids duplication, and NIS 2 rules out a double administrative fine for the same conduct.

Is a Tunisian IT provider subject to NIS 2?

Most often indirectly: its French clients subject to NIS 2 will impose security, audit and notification clauses on it. A managed service, cloud or data centre provider established outside the EU and serving European clients may, however, fall directly within NIS 2 and have to designate a representative in the EU.

Why use a lawyer for NIS 2 compliance?

Because NIS 2 creates legal obligations backed by penalties. A lawyer qualifies the company’s situation, drafts supplier contracts, aligns NIS 2 with the GDPR and defends the company in the event of an inspection. A lawyer’s advice is protected by professional secrecy.

References

• Directive (EU) 2022/2555 of 14 December 2022 (NIS 2), Articles 20, 21, 23, 26, 32, 34 and 35
• French National Assembly, legislative file of the Resilience Bill (in French)
• Regulation (EU) 2022/2554 (DORA)
• Regulation (EU) 2024/2847 (Cyber Resilience Act)
• ChannelNews, La transposition de NIS 2 entre dans sa phase finale, 2 October 2026 (in French)
• Solutions Numériques, Le projet de loi NIS2 et DORA est adopté à l’unanimité en commission spéciale, 15 September 2025 (in French)
• Banque des Territoires (Localtis), la CSNP presse le Parlement d’examiner sans délai le projet de loi de résilience, 18 March 2026 (in French)
• Next, NIS 2 : l’ANSSI publie son ReCyF, 19 March 2026 (in French)

Further reading

• The legal framework for cybersecurity in Tunisia in 2025
• GDPR, Tunisian law and artificial intelligence: the obligations to know in 2026
• Data protection and GDPR compliance