NIS2by country

NIS2 in France

Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité

Bill, not law yet This page follows the Résilience bill. The rules can change before it passes.

Bill
Résilience bill
Authority
National Cybersecurity Agency of France (ANSSI)
Classes
entité essentielle (essential), entité importante (important)
Register
MonEspaceNIS2 (pre-registration)
ISO 27001
Helps, not enough alone
Self-check
ANSSI online test: is your entity regulated by NIS 2?

Check your company for France

Know when France changes its NIS2 rules

  • One email when the law, the deadlines or the portal change.

This site stores your email and emails you when the NIS2 rules in France change. Unsubscribe at any time.

Where the bill stands

France has no NIS2 law in force. The Government filed the bill in the Senate on 2024-10-15. The Senate passed it on 2025-03-12. The National Assembly special committee produced text n° 1779 on 2025-09-10. The data below follows that committee text and can change. Title II of the bill covers NIS2 and takes effect the day after promulgation.

Name
Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécuritéBill on the resilience of critical infrastructure and the strengthening of cybersecurity
Status
Bill, not law yet
Text
Read the Résilience bill

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where France differs

  • Art. 8(3) of the bill Electronic communications operators with 50 or more staff, or turnover and balance sheet above EUR 10 million each, are essential. Under the Directive medium-sized ones would be important. Smaller operators are important at any size.
  • Art. 8(3) of the bill Electronic communications operators with 50 or more staff, or turnover and balance sheet above EUR 10 million each, are essential. Under the Directive medium-sized ones would be important. Smaller operators are important at any size.
  • Art. 8(4) and 8(6) of the bill Qualified trust service providers, DNS providers, TLD registries and software publishers are essential at any size. Software publishers are a French addition to the Directive.
  • Art. 10 of the bill The Prime Minister can name an entity essential or important at any size, for example a sole provider of a key service. The entity must be in a highly critical or critical sector.
  • Art. 8(7) of the bill Regions, departments and communes with more than 30,000 inhabitants are essential. Public rules are national, so the checker does not decide them.
  • Art. 13 and 62 A of the bill Entities under DORA or another EU sector act with equal effect are out of the risk and reporting duties.
  • Art. 8(8) and 8(9) of the bill Operators of vital importance and operators of essential services named under the earlier NIS law are essential.

Also note

  • The bill has not passed. ANSSI says the transposition is in progress. Dates, fines and duties can still change.
  • Size tests: large entities in highly critical sectors (250 or more staff) are essential. Other entities with 50 or more staff, or EUR 10 million turnover and balance sheet, are important.
  • ANSSI offers an online test that shows whether your entity is in scope and in which class.

Registration

No legal deadline exists yet. ANSSI offers an online pre-registration service now. After the law passes, ANSSI keeps the list of essential and important entities and updates it every 2 years. A decree sets what you send and the deadline for changes.

Portal
MonEspaceNIS2 (pre-registration)
Rule
Voluntary pre-registration
You need
Your entity details. The bill leaves the data to send and the change deadlines to a decree.

Incident reporting

  1. 24 hEarly warning
  2. 72 hIncident notification
  3. 1 monthFinal reportafter the intermediate notification

Send the reports to ANSSI.

Trust service providers have 24 hours for the intermediate notification. The 24 and 72 hours run from the moment you know of the incident. A decree sets the procedure.

Measures and proof

Essential
No certificate is mandatory by default. ANSSI controls through on-site inspections, remote checks and audits. An independent body that ANSSI names can run an audit at the entity's cost. You can show compliance with the ReCyF framework or an equivalent framework ANSSI recognises.
Important
The same rules apply to important entities. The bill does not set a different audit cycle for them.

Duties of management

Management bodies must approve and oversee the security measures. Members of these bodies must receive cybersecurity training that matches their exposure to risk.

Fines

Under the bill, the ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

Fine ceilings, Art. 37 of the bill (committee text n° 1779). The higher amount applies. Each "At EUR" figure is the ceiling at that worldwide turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

The sanctions committee sets the fine. It cannot fine an entity when the same breach already led to a GDPR fine from the data protection authority.