NIS2 Transposition in France Stalled, and the EU Went to Court

France has not transposed NIS2. The directive’s deadline was 17 October 2024, and as of 24 July 2026 the French law that would bring the NIS2 directive into force has cleared the Sénat at first reading, has not passed the Assemblée nationale, has not been promulgated, and does not appear in the Journal officiel. On 8 July 2026 the European Commission referred France to the Court of Justice of the EU over the delay. The honest summary of where NIS2 transposition in France stands is that the obligations are drafted, the regulator has published more than the legislator has, and the law is stuck.

Has France Transposed NIS2 Yet?

No. France has not transposed NIS2 as of 24 July 2026, which puts it among the seven member states still in breach, against 20 of 27 that had transposed by January 2026. ANSSI’s director general, Vincent Strubel, told a security conference that on 17 October nothing would happen, and he was right. The bill cleared the Sénat at first reading on 12 March 2025. The Assemblée nationale’s commission spéciale then worked through it on 9 and 10 September 2025 and adopted the text. It has not reached a floor vote, and the earliest realistic date for one is the parliamentary rentrée in autumn 2026. A text that clears committee and still cannot get onto the plenary agenda is not held up by drafting. Scheduling a government bill is the executive’s call, not parliament’s, so the block sits with the government, not the deputies.

Why the French Transposition Is Stuck on Encryption

Two things hold the bill back. Two years of government instability, and a single clause on encryption. The clause is the reason the bill keeps slipping off the agenda. The dissolution of the Assemblée nationale in June 2024, followed by the collapses of the Barnier and Bayrou governments, pushed the calendar back by quarters, moving a text that should have been debated at the end of 2024 first to January 2025 and then to no fixed date. The specific blockage is article 16 bis, an amendment introduced by senator Olivier Cadic that forbids the state from ordering providers of encrypted services to build in backdoors. The Direction générale de la sécurité intérieure opposes it, and an attempt to soften the clause in committee was rejected. So a cybersecurity law is being held up by an argument over whether the state may weaken cybersecurity.

The loi Résilience Bundles NIS2, CER and DORA Into One Text

France is transposing NIS2 through the projet de loi Résilience, a single bill that also transposes the CER directive on critical entities and the directive that accompanies DORA for the financial sector. For most readers the practical question is which regulator holds the file. ANSSI supervises the NIS2 part, with CERT-FR as the national CSIRT, in the same role the BSI plays in Germany. If you are a bank, an insurer or an investment firm, your operational resilience sits under DORA, supervised by the ACPR and the AMF rather than ANSSI, and the DORA regulation has applied since 17 January 2025 regardless of where the French bill sits. Reading the NIS2 directive in France without separating these three strands is the fastest way to apply the wrong obligations to the wrong entity.

Who NIS2 Will Cover in France, and Who It Won’t

The French text will bring somewhere between 10,000 and 15,000 entities into scope across 18 sectors, up from about 500 under the original NIS regime, with the Sénat’s rapport using the higher figure. Not every reader is one of them, and the classification decides which fine you face, not just whether you comply. Two axes run the classification, and they do different jobs. The annexe decides whether you are in scope at all. Size decides which tier you land in. A large entity in an Annexe I sector is essential. A medium-sized entity in the same Annexe I sector is important, not essential. Every entity in an Annexe II sector that clears the medium-sized threshold is important whatever its size above that line, so an 800-person manufacturer does not fall out of scope by being large. To narrow where you sit against the directive’s criteria, which the French text may still adjust, the NIS2 Applicability Checker runs sector against size.

Some categories skip the size test entirely. DNS providers, TLD registries and qualified trust service providers under eIDAS are essential entities regardless of headcount, per Article 3(1) of the directive, which puts their ceiling in the 10 million euro band rather than 7. Entities that a member state designates as critical under the CER directive are essential too, which matters here because the same French bill transposes CER. Public bodies are the mirror image. They are covered, but the text carries them outside the administrative fines, so state administrations and local authorities face injunctions and daily penalty payments instead of the euro amounts below. And France reaches past the directive’s floor by pulling in around 1,500 local authorities, every region and department, roughly 1,000 communautés de communes and about 300 communes above 30,000 inhabitants.

French Fines Reach 10 Million Euros, Then Switch Off for Three Years

Under the text the Sénat passed, essential entities face fines up to 10 million euros or 2% of worldwide turnover, and important entities up to 7 million or 1.4%, whichever is higher. Then the same text turns the penalties off for three years. These are the figures in the version the Sénat adopted on 12 March 2025, not a promulgated law. They are the current direction, not the final number. The ceilings mirror Article 34 of the NIS2 directive. The size of the exposure changes, and so does its nature. The regime that NIS2 replaces runs on criminal fines aimed at directors. Under article L. 1332-7 of the Code de la défense, the operator-of-vital-importance regime caps that fine at 150,000 euros, or 750,000 for a legal person. NIS2 swaps it for an administrative fine on the company itself, set as a slice of group turnover. The number is bigger, but the move from a personal criminal ceiling to a percentage of revenue is the part worth taking to your board.

The moratorium suspends the fines, not the duties. Incident reporting and the accountability the directive places on management bodies run regardless, and the threat behind them does not pause. The Sénat’s rapport cites an ANSSI and CLUSIF survey from June 2024 putting the average cost of a cyberattack at 466,000 euros for a small or mid-sized firm and 13 million for a mid-cap. Our read is that the moratorium is not the most consequential French choice in the bill. Article 16 bis is, because the sanctions clock cannot start until the law is promulgated, and the law cannot be promulgated until the encryption fight is settled.

The Commission Referred France to the EU Court on 8 July 2026

On 8 July 2026 the European Commission referred France, Ireland, Spain and the Netherlands to the Court of Justice of the EU for failing to notify full transposition of NIS2, and it is asking for a lump sum and daily penalties. The wording matters, because failing to notify is what lets the Commission seek financial penalties at the first referral under Article 260(3) TFEU, rather than waiting for a second judgment. This followed letters of formal notice in November 2024 and a reasoned opinion in May 2025. The Netherlands adopted its transposing law on 7 July 2026, the day before the referral, with entry into force set for 15 August 2026, which shows how close to the wire states are running. France did not.

The Commission usually withdraws these cases once the member state notifies its law, which is why few reach judgment. When they do reach judgment, the Court imposes the money. In July 2020 it ordered Romania to pay a 3 million euro lump sum and Ireland 2 million for failing to transpose the fourth anti-money-laundering directive. The exposure is real for whichever state finishes last, and France, by its own calendar, has no firm date to finish. Our NIS2 transposition status for all 27 member states shows where every country sits.

Classification Is the Work You Can Do Before the Décrets Land

The most useful preparation does not depend on the final French text. Building an inventory of your systems and mapping them against the NIS2 sectors is work that can be finished before any décret d’application is published, and the décrets cannot appear until the law is promulgated. Start by confirming scope, whether you are an essential or important entity against the sector and size thresholds, which the NIS2 Applicability Checker narrows against the directive’s criteria. Then watch two dates. The first is the Assemblée nationale plenary, expected no earlier than the autumn 2026 rentrée. The second is promulgation, which starts both the three-year sanctions moratorium and the clock for the implementing décrets.

The French delay is not a delay for everyone under a French flag. A group headquartered in France with subsidiaries established in member states that have already transposed is regulated in those states, and certain digital-infrastructure providers, including cloud, data centre and managed service providers, fall under the jurisdiction of their main establishment under Article 26 of the directive rather than their parent’s. The registry obligation in Article 27, which required those providers to file with the national single point of contact by 17 January 2025, has already bitten in the states that transposed. The French delay does not buy your Belgian subsidiary a single day.

For the technical target, ANSSI published ReCyF v2.5 on 17 March 2026 as a document de travail. It sets 20 security objectives for essential entities and 15 for important ones, and it is the closest thing to the eventual French baseline, so it is worth mapping against even without legal force. An ISO 27001:2022 certificate helps but does not cover the referential. ANSSI names it as admissible evidence for the governance and risk-analysis objectives, publishes a comparison tool on MesServicesCyber that maps ReCyF against ISO 2700x and the annexe to implementing regulation 2024/2690, and still expects a documented gap analysis. The Commission proposed targeted amendments to NIS2 itself on 20 January 2026, so France is late transposing a text that is already being rewritten. Pre-registration through MonEspaceNIS2 has been open since 24 November 2025, though it carries no mandatory declarative value yet. If you would rather bring in help than build this in-house, the NIS2 providers in France in our directory are a starting point.