By October 17, 2026, France will be two years behind on transposing the NIS2 Directive, whose deadline was set for October 17, 2024.
The timetable had finally seemed to tighten at last: scheduled for debate on October 7 and 9 in the National Assembly, the bill on the resilience of critical infrastructure and the strengthening of cybersecurity was to be discussed in a public session. It will not happen. On October 6, the Conference of Presidents removed it from the agenda, without setting a new date.
Should one be alarmed? For cybercriminals, the answer is clear: the absence of a law has never stopped an attacker. For businesses, it should not serve as an excuse either. Because what NIS2 demands—securing the supply chain and training its teams—belongs less to compliance than to practical operational sense.
Three findings drawn from recent events illustrate this.
A Text That Keeps Delaying
The path of the Resilience Bill resembles a long sequence of missed appointments. Filed in the Senate on October 15, 2024 with a commitment to an accelerated procedure, it was adopted by the senators on March 12, 2025, then amended by the National Assembly’s special committee, which approved its version on September 10, 2025.
A plenary examination was later hoped for in July 2026, before being postponed, notably, according to specialized press, due to a disagreement over an article devoted to encrypted messaging services.
On July 8, the European Commission brought France before the Court of Justice of the European Union for failure to transpose, alongside Ireland, Spain, and the Netherlands. And now a new delay has been formalized.
This delay is not just about the calendar. It slows the rise of ANSSI, which must move from supervising a few hundred entities to roughly 15,000, spread across 18 sectors instead of six today. It also postpones the opening of the mandatory registration for entities, of which ANSSI could only open a pre-registration desk in the autumn of 2025.
Its director-general, Vincent Strubel, has consistently argued for a gradual rollout: according to him, at least three years will be needed before full compliance is required. In other words, every month lost in the Assembly pushes back the moment when businesses will actually be compelled to upgrade.
This grace period is a trap. The sanctions contemplated—up to 10 million euros or 2% of global turnover for essential entities, 7 million euros or 1.4% for important entities—will not be immediate.
But the initial investment ANSSI estimates as necessary, around 100,000 to 200,000 euros for a large company, is not a decision made overnight.
Among neighbors, the comparison is harsh: Germany has already made the obligation effective, with about 17,700 entities registered out of an estimated 29,500 in scope, and Italy has set the deadline for its first cohort of entities to October 2026, with no extension.
France, meanwhile, waits, even as attacks continue.
When the Supplier’s Supplier Becomes the Weak Link
The supply chain is the beating heart of NIS2, and its Achilles’ heel. Article 21 of the directive requires every concerned entity to manage the security of its supply chain, including in its relationships with its direct suppliers, and to account for vulnerabilities unique to each. But none of these texts imposes anything on the supplier itself. The customer is responsible for the security of a company it does not control.
The Harvest SA case illustrates this better than any diagram. In February 2025, the Paris-based fintech discovered a ransomware attack that crippled its wealth management software, used by more than 4,600 clients. Its services were offline for about four weeks.
The origin? A virtual machine hosted by one of its own providers. Three months later, a banking supervisor explained to lawmakers that the banks’ software provider had been compromised via the intermediary of Harvest’s own supplier.
The tally appears in the notifications: MAIF alerted 55,000 clients and prospects, BPCE informed clients across all of its subsidiaries, AXA France notified twenty clients.
The exact cause of the breach has not been confirmed. What is known, however, is that Harvest SA was not a poor student: the company had deployed multi-factor authentication on at least part of its accounts, as well as EDR, XDR, SIEM, and patch management. Controls existed. What may have been lacking was their real scope or effectiveness, precisely what a supplier questionnaire cannot measure. It notes the existence of a control, not its reach, and it snapshots a moment where the threat is a moving target.
That is the paradox of compliance by questionnaire: it reassures the client without protecting the chain. And the small suppliers, who fall outside the directive’s scope, will have only what their clients are willing to write into contracts. For France’s 15,000 companies, this means mapping dependencies now, including second-tier ones, and obtaining evidence rather than statements.
A Stolen Database Is a Phishing Infrastructure
A data breach at a supplier does not stop at detecting the incident or restoring systems. The stolen data becomes the fuel for tomorrow’s attacks, all the more credible for being precise.
Opening the Cybersecurity Assizes in Monaco, Vincent Strubel acknowledged that we have not managed to eliminate the basic flaws that ANSSI keeps uncovering across the board, after a year marked by a string of data leaks of unprecedented scale: ANTS, Ficoba, Bloctel, DGFiP. The incident report published by the agency on the DGFiP breach, which affected 678,000 individuals and professionals in August, describes, in his view, what every professional observes on a daily basis.
Also, General Patrick Touak, who heads the Interior Ministry’s cyber command, warned about using leaked data to target high-value individuals, notably in the cryptocurrency sphere, up to physical violence.
The campaign documented by CERT-EU between September 2025 and February 2026 against freight and logistics organizations in Germany, France, Lithuania, and the United States, is the demonstration.
More than 1,600 unique credentials stolen, significant disruptions to operations, and, on the criminal side, 52 phishing domains and 75,840 targeted email addresses, according to researchers who recovered the operation’s database in an exposed Git repository.
Spear-phishing, voice phishing to intercept real-time multi-factor authentication codes, impersonation of platforms that targets use daily: the platforms themselves were not compromised. It is the people who log in who were ensnared.
This is where the compliance blind spot lies. NIS2 indeed foresees basic IT hygiene and training under Article 21, as well as training for management bodies, with the obligation to offer similar training to employees under Article 20.
But states have transposed these provisions very unevenly.
Germany did not expressly transpose the provision for employee training. Italy transposed both components. The French draft trains executives and “persons exposed to risks,” and leaves the rest to a repository still marked as a “working document.” The requirement that touches every link in the chain is the one most trimmed by national lawmakers, and the only binding European text obliging an entity to set training requirements for its suppliers’ staff, Implementing Regulation (EU) 2024/2690, covers only the digital sector.
Yet a collaborator who recognizes a message that is too well informed, who refuses to disclose a code to a “support” calling again, is worth more than another line in a questionnaire. Awareness must be continuous, contextualized by profession, and measurable, including at providers who access our systems.
Don’t Wait for the Green Light from the Legislature
The October 6 postponement is a bad signal, but it does not change the substance. Incidents occur through the supply chain, and attacks with no apparent link can be facilitated by a single prior data theft.
When the law arrives, it will formalize obligations that prudent organizations should already have begun: map their suppliers and subcontractors, replace the questionnaire with regularly verified evidence, embed security and training requirements in contracts, and prepare their teams to recognize highly personalized phishing.
The project will also broaden. With the rise of AI in supply chains, we will no longer only be protecting human identities, but also asking what happens when an agent integrated into a subscribed SaaS service goes off the rails. No exemption will exist for AI tools or agents.
Better to master the fundamentals now, before securing this new agentic landscape. The best moment to act is now, and certainly not the day the National Assembly finally finds space on its agenda.
*Florian Malecki is the Head of Southern Europe at KnowBe4
