France. Cybersecurity. Bill
Projet de loi RésilienceBill on the resilience of critical infrastructure and strengthening of cybersecurity (Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité)
Bill/proposed
Partly verified
Medium confidence.Legifrance dossier URL not verified. Meets inclusion rule (passed one chamber).
§1Summary
- Synopsis
France's omnibus bill transposes NIS2, the Critical Entities Resilience Directive and DORA elements. It would bring thousands of essential and important entities under ANSSI supervision with security and incident-reporting duties.
- Key themes
- Unique features
Passed the Sénat but still pending in the Assemblée nationale as of October 2026, so NIS2 is not yet transposed in France.
- SaaS relevance
Cloud, managed and digital service providers will be in scope as essential or important entities once enacted.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Proposed NIS2 staged reporting (24h early warning, 72h notification, 1-month report)
- Cross-border transfers
- None
- Maximum penalty
- Proposed: €10m or 2% (essential); €7m or 1.4% (important)
§3Dates
- Key dates
- Tabled Oct 2024; adopted by Sénat 2025-03-12; Assemblée nationale committee text 2025-09-10; plenary not concluded by Oct 2026; Commission referred France to CJEU 2026-07-08
§4Text and authority
- Text
- Authoritative text legifrance.gouv.fr
- Authority
- Agence nationale de la sécurité des systèmes d'information (ANSSI)
§5Where it applies
- Domestic law of
- France
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Legifrance dossier URL not verified. Meets inclusion rule (passed one chamber).