What if this time, it’s the real thing?
Scheduled for the agenda of the extraordinary parliamentary session last July, the bill on “the resilience of critical infrastructures and the strengthening of cybersecurity,” which carries the transposition of NIS 2, was ultimately deferred to October 7—before being withdrawn from the agenda “due to the jam-packed parliamentary calendar.”
As France endures a wave of cyberattacks targeting both public services and the private sector, the transposition of the NIS 2 directive by French lawmakers has now overshot the Brussels deadline by two years, with a due date of October 17, 2024.
A new date for a public discussion of the text has been set for Monday, November 9. Parliamentary debates are planned through Friday, November 13 (excluding November 11).
The bill is not limited to NIS2. It also transposes three European directives adopted in 2022: the REC directive on the resilience of critical entities, NIS2 on cybersecurity, and the directive associated with the DORA regulation for the digital operational resilience of the financial sector.
Its Title I modernizes France’s framework for the security of activities of vital importance (SAIV), created in 2006 and applicable to more than 300 operators. It broadens this framework to new sub-sectors, including heating and cooling networks, hydrogen, and wastewater treatment, and imposes resilience plans on operators and on about 1,500 critical points.
A Text Long-Awaited by France’s Cyber Community
Title II, devoted to cybersecurity, is the portion directly tied to NIS2. It expands the regulated perimeter from six to eighteen sectors, notably including health, manufacturing industries, chemical production, research, postal services, and digital infrastructures.
Asked in early October by the rapporteurs of the special committee tasked with examining the bill that must transpose this directive, the director-general of the ANSSI urged not to “over-transpose” or overload NIS 2. The deputy Philippe Latombe had just asked him whether, after months had passed (the Senate adopted the text in March 2025), it was necessary to update the bill.
No-go for Vincent Strubel, who sees a “response tailored to the state of the threat and its anticipated evolutions.” A “technologically neutral” text, and whose measures “would have been effective against the majority of data thefts observed in France in recent months.”
The delays in transposition, he adds, have a chilling effect on the preparation of the entities involved. Including at the level of budget allocations. This is what France’s cybersecurity companies have reported…
