Contents5
On 6 October 2026, the day before its debate in plenary, the French bill on the resilience of critical infrastructure and the strengthening of cybersecurity was once again withdrawn from the National Assembly’s agenda. It is the bill meant to transpose into French law the European NIS2 directive, which Member States were supposed to apply from 17 October 2024.
This guide from our Infrastructure and cloud section takes stock on 19 October 2026. It is not legal advice: to know whether your business is in scope and in which category, ANSSI’s online test and your adviser remain the reference.
In short
The NIS2 directive is still not transposed in France: the bill passed by the Senate in March 2025 is waiting for the National Assembly.
The European Commission referred France to the Court of Justice on 8 July 2026 and is asking for financial penalties.
Thousands of entities in 18 sectors will be covered, businesses from 50 employees in some cases, and their suppliers through contracts.
ANSSI has published its framework of measures and opened pre-registration: this work pays off whatever the date of the vote.
Where does the Resilience bill stand?
The bill was tabled in the Senate on 15 October 2024, two days before the European deadline, then passed by senators on 12 March 2025, according to the Senate’s legislative file. The National Assembly’s special committee tabled its text on 10 September 2025. The bill actually transposes three directives: NIS2, DORA for the financial sector, and the directive on the resilience of critical entities.
- 17 October 2024
Deadline for transposing NIS2 in every Member State.
- 28 November 2024
The European Commission sends France a letter of formal notice.
- 12 March 2025
The Senate passes the Resilience bill.
- 7 May 2025
Reasoned opinion from the Commission.
- 10 September 2025
The National Assembly’s special committee adopts its text.
- 8 July 2026
The Commission refers France to the Court of Justice of the European Union.
- 6 October 2026
The debate planned for 7 and 9 October is withdrawn from the agenda, with no new date.
The official reason for the delay is a crowded agenda, in particular a comprehensive law against sexual and gender-based violence, Next reports. The political sticking point is article 16 bis, added in the Senate, which forbids requiring encryption providers to deploy measures that deliberately weaken security. The rapporteur, Éric Bothorel, hoped on 6 October for the bill to be rescheduled “within fifteen days or three weeks”, according to Leto. On 19 October, we found no new date published.
On the European side, the delay has a potential price. In its press release of 8 July 2026, the Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice and asks it to impose a lump sum and daily penalties until full transposition.
Who will be covered by NIS2?
ANSSI, which leads the transposition, announces on its NIS2 page “several thousand entities across 18 sectors of activity”, mostly medium and large businesses, local authorities and administrations. NosParlementaires, which follows the bill, puts the change at about 300 operators of vital importance today to about 15,000 essential and important entities.
ANSSI’s NIS2 page invites organisations to prepare “from now on” and already offers pre-registration of entities. Captured on 19 October 2026.
Two categories, by size, within the listed sectors:
Essential entity
At least 250 people, or more than 50 million euros in turnover and more than 43 million euros on the balance sheet
Possible penalty of up to 2% of worldwide turnover
Important entity
At least 50 people, or more than 10 million euros in turnover and on the balance sheet
Possible penalty of up to 1.4% of worldwide turnover
A company of 20 to 500 people can therefore be directly covered if it operates in one of the 18 sectors (energy, health, transport, manufacturing, food, digital providers, waste management, among others). And even outside that scope, it will often be covered indirectly: ANSSI’s framework asks regulated entities to manage their ecosystem, including digital security in contracts with their suppliers. Your large customers’ questionnaires will arrive before the law does.
What to do while waiting for the vote?
ANSSI has made public a working version of its Référentiel Cyber France (ReCyF), which lists the measures it recommends to meet NIS2’s objectives, while noting that it may be adjusted after the parliamentary debate. Its objectives (inventory of systems, governance, control of suppliers, access management, continuity, incident handling, monitoring) do not depend on the date of the vote. Five steps, in the order in which they pay off:
- Find out whether you are in scope.
ANSSI’s online test tells whether your entity would be regulated, and in which category; pre-registration is open.
- Take inventory.
Your systems, your online services, your suppliers and the access they have: it is the framework’s first objective, and the basis for everything else.
- Sort out access and secrets.
Separate admin accounts, two-factor authentication, passwords and API keys in a vault rather than in files.
- Test restores.
A backup you have never restored does not count; business continuity is an objective of its own in the framework.
- Write the incident procedure.
Who decides, who notifies whom, and where the logs are: that is what you will be asked to show.
These are the habits of a well-run infrastructure foundation, which we describe in the common foundation for all your cloud projects. The two most often neglected each have their own article: backups and what really breaks and a secrets vault in the age of AI.
From the field
On 5 July 2026, a badly targeted clean-up command destroyed the containers of ten services at once on our own server. The data, kept in separate volumes, was saved, and what came out of it is exactly what a framework like ReCyF asks for: written operating rules that govern destructive commands, rather than a promise to be careful.
What it changes for a team of 20 to 500 people
Waiting for the vote gains nothing. If you are in a covered sector, the inventory and the incident procedure take weeks, not days. If you are not, your regulated customers will ask for them by contract. Either way, this work first reduces your own risk. To set up this foundation on infrastructure you control, see our self-hosted stack offer.
Cybersecurity is not the only timetable this autumn: our October AI news for leaders sums up the month’s other facts, including Meta’s new terms on crawling websites. On the AI side, deadlines follow the timetable revised by the Digital Omnibus in the AI Act, with marking of AI-generated content by 2 December 2026.
Frequently asked questions
Does NIS2 already apply in France?
Not to French businesses, since no transposition law has been passed: the Resilience bill, adopted by the Senate in March 2025, is still waiting for the National Assembly. The directive is binding on the State, however, which explains the European Commission’s referral to the Court of Justice on 8 July 2026. Implementing decrees will then be needed.
Is my 80-person company covered by NIS2?
It may be, as an important entity, if it operates in one of the 18 covered sectors, since the threshold starts at 50 people or 10 million euros in turnover and balance sheet. The simplest way is to take ANSSI’s online test. Outside those sectors, your regulated customers will probably ask you for guarantees in your contracts.
What penalties does NIS2 provide for?
According to ANSSI, financial penalties may reach 2% of worldwide turnover for an essential entity and 1.4% for an important entity, in proportion to the breaches. The exact amount applicable in France will depend on the law that is passed. Before any penalty, ANSSI announces supervision to check that obligations are met.
Where to start preparing for NIS2?
With an inventory of your systems, your online services and your suppliers, along with their access. It is the first objective of ANSSI’s framework and the basis of the others: access management, tested backups, incident procedure. These measures reduce your risk even if the law is delayed again, and they will carry over unchanged once the bill is passed.
Sources
- The Senate’s legislative file (new tab)senat.fr
- Next reports (new tab)next.ink
- Leto (new tab)leto.legal
- Its press release of 8 July 2026 (new tab)ec.europa.eu
- On its NIS2 page (new tab)messervices.cyber.gouv.fr
- Puts the change (new tab)nosparlementaires.fr
Jim · founder of Brain Plus AI
Also in infrastructure and cloud
Practical guide13 min The topic guide
Cloud infrastructure: the foundation for all your projects
Before the first project, a cloud infrastructure foundation settles accounts, access, backups and budget once and for all, and every later project inherits it. What it contains, where to put it, what it costs and why running it matters more than installing it.
Practical guide7 min
Backing up your own server: what really breaks
Everyone knows the 3-2-1 rule, but what loses data is more mundane: a backup never restored, a forgotten volume, a global clean-up command run in production. Here is what we learned from operating our own server.
Understand7 min
Digital Omnibus: what changed in the AI Act
Regulation (EU) 2026/1744, in force since 27 July 2026, revised the AI Act: high-risk rules postponed, AI literacy relaxed, two more prohibitions, relief extended to mid-sized companies. What changes, what does not, and the updated timetable.