The European Commission has sharpened its tone. It has just referred to the Court of Justice of the European Union (CJEU) a case against four member states (France, Spain, Ireland, and the Netherlands) for failing to transpose the NIS 2 directive on the security of networks and information systems.
A process that could prove costly for Paris.
Brussels had set the deadline for transposition into national law at October 17, 2024. A deadline that France, like three of its European partners, did not meet.
The procedure is not new. It was launched on November 28, 2024, originally targeting 23 EU countries. Since then, 19 of them have brought their legislation into line, after receiving formal notices and reasoned opinions from the Commission.
There are thus only four underperformers left, including France, who now face Luxembourg’s judges.
A disagreement over backdoors
Scheduled for the extraordinary parliamentary session in July, the bill on “the resilience of critical infrastructure and the strengthening of cybersecurity” which would transpose NIS 2 into French law did not appear on the agenda.
This latest postponement pushes the discussion to September.
The French impasse is not a mere administrative delay. It stems from a substantive disagreement over Article 16 of the bill, which is meant to enshrine in French law a prohibition on encryption service providers embedding backdoors in their products.
A sensitive point for certain lawmakers, both deputies and senators, who fear that such a ban could hinder the ability of French intelligence services to access, in a targeted and judicially supervised manner, the encrypted communications of individuals under surveillance.
Evidence that the issue worries even within the French authorities themselves; Vincent Strubel, director-general of ANSSI, lamented before the Senate the absence of NIS 2 transposition. While noting that this delay does not absolve businesses and local authorities from preparing now for the new requirements.
“Regulatory uncertainty disrupts cyber procurement and slows investment decisions. It affects all organizations, including those already subject to regulatory frameworks, to the extent that NIS2 significantly expands perimeters and levels of obligation,” says Fabrice Bru, President of CESIN, the leading French association of CISOs.
Fixed fines and daily penalties at stake
That is where the issue hits public finances. As part of its referral to the CJEU, the European Commission explicitly asks the Court to impose financial sanctions. That is, a fixed fine paired with daily penalties that would continue to accrue until a full notification of transposition of the text. In other words, the longer the government delays, the heavier the bill becomes.
Now it remains for the executive to decide between upholding its stance on encryption and the risk of France being condemned to pay, day after day, the price of its legislative inaction.
