France has not yet finished transposing NIS2, yet thousands of French organisations will become essential or important entities supervised by ANSSI the day the law is promulgated. The vehicle is the projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité (the "projet de loi Résilience"), which also transposes the CER Directive and the DORA amending directive. This guide explains what the bill, as adopted by the Sénat, says about scope, obligations, incident notification and sanctions, how ANSSI is preparing through MonEspaceNIS2 and the Référentiel Cyber France (ReCyF), and what security and compliance teams should do before the final vote. It is written for CISOs, compliance leads and identity teams in organisations with French operations. For the directive itself, read the NIS2 Directive Guide first: this page covers the French layer only.
Status checked 27 October 2026: the bill was adopted by the Sénat on 12 March 2025 and by the Assemblée nationale's special committee on 10 September 2025 (texte n° 1779). Public debate in the Assemblée, scheduled from 7 October 2026, was postponed by the Conférence des présidents on 6 October 2026 with no new date. The law is not yet promulgated, so the article numbers and figures below come from the Sénat text and can still change.
Key takeaways
- The law is not in force yet: as of 27 October 2026 France has missed the 17 October 2024 transposition deadline and the bill awaits its Assemblée nationale vote, then a likely commission mixte paritaire or second reading.
- ANSSI is the single authority: it builds the list of essential and important entities, receives incident notifications, supervises and refers breaches to a dedicated commission des sanctions.
- Thresholds follow the directive: 250 staff or more than EUR 50 million turnover and EUR 43 million balance sheet for essential entities in highly critical sectors, 50 staff or EUR 10 million for important entities.
- The ReCyF is the practical target: ANSSI published it on 17 March 2026 as a working document, and following it (or an equivalent ANSSI recognises) lets an entity rely on it during an audit.
- Machine identities are inside the perimeter: the four security objectives cover protection, defence and continuity of systems, so service accounts, API keys and AI agent credentials need the same inventory, ownership and logging as human accounts.
Scope: who and what is covered
The Sénat text (Title II, Articles 7 to 13) mirrors Annexes I and II of the directive and the size-cap rule, then adds French designation powers. Article 7 lists the highly critical sectors (energy, transport, banking, health, drinking water, waste water, digital infrastructure, ICT service management, space and others) and the critical sectors (postal services, waste management, chemicals, food, manufacturing, research and others).
| Category | Who falls in it (Sénat text) | Article |
|---|---|---|
| Essential entity (entité essentielle, EE) | Highly critical sector entities with at least 250 employees, or annual turnover above EUR 50 million and balance sheet above EUR 43 million | Art. 8, 1° |
| Essential entity (telecoms) | Electronic communications operators with at least 50 employees, or turnover and balance sheet above EUR 10 million | Art. 8, 3° |
| Essential entity (any size) | Qualified trust service providers, top-level domain registries, DNS service providers, certain public administrations, operators of vital importance (OIV) providing an essential service | Art. 8, 4° to 8° |
| Important entity (entité importante, EI) | Highly critical or critical sector entities that are not essential, with at least 50 employees, or turnover and balance sheet above EUR 10 million | Art. 9, 1° |
| Important entity (other) | Non-essential telecoms operators and trust service providers, certain public bodies and research establishments | Art. 9, 2° to 8° |
| Designated entity | Any entity in a listed sector, whatever its size, that the Prime Minister designates, for example as sole provider of a service or because of systemic risk | Art. 10 |
| Excluded by lex specialis | Entities already subject to equivalent sector-specific EU rules (for example DORA for financial entities) on the overlapping obligations | Art. 13 |
- Public sector reach: France brings a wide set of administrations into scope, with exemptions for security, defence and criminal justice bodies. Local authorities and public bodies should not assume they are outside NIS2.
- OIV overlap: operators of vital importance already regulated under the Code de la défense keep their specific requirements for vital information systems (Art. 16) on top of the NIS2 obligations.
- Group structures: size is assessed at the entity level using the EU SME definition rules, including partner and linked enterprises. Check each French legal entity, not just the group.
- Self-check now: MonEspaceNIS2 (monespacenis2.cyber.gouv.fr) offers a simulator to test whether an entity is likely to be concerned, and an FAQ that covers national transposition and incident declaration.
Key obligations
The obligations sit in Chapter II of Title II of the Sénat text. Most detail is delegated to decrees of the Conseil d'État, which will only be published after promulgation, so treat the article text as the frame and the ReCyF as the best current indication of the measures ANSSI expects.
Registration and the ANSSI list
- Article 12: ANSSI establishes, and updates at least every two years, the list of essential entities, important entities and domain name registrars, based on information the entities provide.
- Decree to follow: the information to submit, the submission method and the deadlines for reporting changes will be set by decree. Directive Article 27 points to name, address, contact details including email addresses, IP ranges and telephone numbers, sector and Member States served, so collect these now.
Security measures (Article 14) and the referential (Article 15)
- Appropriate and proportionate measures: entities must take "appropriées et proportionnées" technical, operational and organisational measures to manage risks to their networks and information systems, at their own expense.
- Four objectives: governance (management oversight and training), protection (including the supply chain), defence (detection tools and incident handling) and resilience (business continuity). They map onto the ten measure areas of directive Article 21(2).
- Management bodies: must approve and oversee the measures, and their members must follow cybersecurity training.
- Referential by decree: a Conseil d'État decree sets the objectives and a technical and organisational referential, which may require certified products or services.
- Presumption of conformity: under Article 15, an entity that applies the referential, or an equivalent ANSSI recognises, can invoke it during an audit. Otherwise it must demonstrate that its own measures meet the objectives.
- Encryption: Article 16 bis of the Sénat text bars any requirement for encryption providers to build in deliberate weaknesses such as master decryption keys.
Incident notification (Article 17)
| Stage | Deadline | Content |
|---|---|---|
| Initial notification | At the latest 24 hours after becoming aware of a significant incident (incident important) | That a significant incident has occurred, with first indications |
| Intermediate notification | 72 hours | Initial assessment of severity and impact |
| Progress report | On ANSSI request | Updates on handling |
| Final report | One month after the intermediate notification | Final report if resolved; otherwise a progress report, with the final report one month after resolution |
| Trust service providers | 24 hours | Incidents affecting their trust services |
Personal data breaches still go to the CNIL under GDPR Article 33 within 72 hours, so one incident can trigger two clocks. See the Cyber Incident Reporting Requirements Map.
Timeline and current status
| Date | Step | Source |
|---|---|---|
| 16 January 2023 | Directive (EU) 2022/2555 enters into force | EUR-Lex |
| 17 October 2024 | EU transposition deadline, missed by France | Directive Art. 41 |
| 15 October 2024 | Bill tabled in the Sénat (texte n° 33), accelerated procedure engaged | Sénat dossier |
| 4 March 2025 | Sénat special committee report n° 393 and text n° 394 | Sénat dossier |
| 12 March 2025 | Adopted by the Sénat at first reading (texte n° 78) | Sénat dossier |
| 13 March 2025 | Transmitted to the Assemblée nationale (n° 1112) | Sénat dossier |
| 10 September 2025 | Assemblée special committee report and text n° 1779 | Sénat dossier |
| 17 March 2026 | ANSSI publishes the ReCyF as a working document | cyber.gouv.fr |
| 6 October 2026 | Assemblée public debate, planned from 7 October, postponed with no new date | Press report |
| To come | Assemblée vote, reconciliation of the two texts, promulgation, implementing decrees, ANSSI registration campaign | Not yet scheduled |
Two practical consequences follow. First, the obligations will only bind entities once the law and its decrees are in force, and transitional periods will be defined then. Second, the Assemblée committee text (n° 1779) amended the Sénat version, so check the final promulgated text on Légifrance before relying on any article number. Track progress in the NIS2 Transposition Tracker.
Enforcement and penalties
ANSSI supervises and can carry out audits and controls. It does not impose fines itself: Article 35 creates a commission des sanctions that rules on breaches referred by ANSSI. Article 36 composes it from members of the Conseil d'État (presiding), the Cour de cassation and the Cour des comptes, plus three qualified persons appointed by the Prime Minister and the presidents of both chambers, who must not have worked for a regulated entity or ANSSI in the previous three years.
| Measure | Essential entities | Important entities | Article |
|---|---|---|---|
| Maximum administrative fine | EUR 10 million or 2% of worldwide annual turnover, whichever is higher | EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher | Art. 37, I |
| Registries and registrars | EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher | Art. 37, I, 3° | |
| Compliance order with penalty payment | Up to EUR 5,000 per day of delay | Art. 31 | |
| Suspension of certification or authorisation | Yes, for persistent non-compliance | No | Art. 33 |
| Temporary ban on managers | Yes, last resort if the breach continues after a fine | No | Art. 37, V |
| Publication of the decision at the entity's expense | Yes | Art. 37, VI | |
Article 37, VII requires the commission to weigh severity, the entity's conduct including good faith, and its resources. There is no separate personal fine for managers in the Sénat text, but the ban on exercising management functions in an essential entity is a real lever.
What it means for AI agents and non-human identities
The French text does not mention service accounts or AI agents, and it does not need to. An entity's networks and information systems include every workload, pipeline and agent that can act on them, and attackers increasingly reach production through machine credentials rather than staff passwords. The Salesloft Drift incident is a clear supply chain example: stolen OAuth tokens from one chatbot integration were used to pull data from hundreds of Salesforce tenants (see the Salesloft Drift breach).
| Article 14 objective | What it means for NHIs and agents | Evidence ANSSI could ask for |
|---|---|---|
| Governance | Every service account, API key, certificate and AI agent has a named human owner and a documented purpose | NHI inventory with owner field; management body minutes approving the access policy |
| Protection (including supply chain) | Least privilege, short-lived credentials, vaulted secrets, review of third-party OAuth grants and SaaS integrations | Vault coverage report; OAuth grant review records; supplier security clauses |
| Defence | Logging of machine authentication and agent actions, alerts on anomalous token use, ability to revoke quickly | Log retention settings; detection rules; revocation runbook and test record |
| Resilience | Credential rotation and break-glass procedures that work during an incident, rebuild of pipelines with fresh secrets | Rotation and recovery test results |
- Inventory first: registration asks for IP ranges and contact points; supervision will ask what runs on them. Use the Service Account Inventory Template.
- Agents as identities: give each AI agent its own identity, scoped permissions and an audit trail, rather than letting it borrow a human's session. See the Agent Identity and Access Guide.
- Incident clocks: the 24-hour initial notification starts on awareness. If you cannot tell within hours which tokens an attacker held, the clock runs while you look.
Compliance steps
- Classify every French entity: run each legal entity through the MonEspaceNIS2 simulator and the Article 8 and 9 thresholds, including linked and partner enterprises. Record the reasoning, because ANSSI may challenge it.
- Prepare registration data: legal names, addresses, sectors, Member States served, security contacts, email addresses and public IP ranges. Assign an owner to keep it current once the decree sets change deadlines.
- Brief the management body: explain approval and oversight duties, schedule training, and minute the decisions. This is evidence for the governance objective.
- Run a gap analysis against the ReCyF: use ANSSI's comparison tool if you already follow ISO/IEC 27001 or another framework, and prioritise gaps in identity, logging and supply chain. The ISO 27001 to NIS2 and DORA Mapping Guide helps.
- Build the notification path: define "incident important" criteria, who decides, and who files with ANSSI and the CNIL. Rehearse the 24-hour and 72-hour steps in a tabletop.
- Close the machine identity gaps: inventory NHIs, assign owners, remove unused credentials, vault secrets and set rotation. Start with credentials that reach production and third parties.
- Review suppliers: map critical ICT suppliers and the access they hold, including OAuth grants and API keys issued to them.
- Re-check after promulgation: compare the final law and decrees with this plan, note transitional periods and adjust. Financial entities should confirm the DORA split in the DORA and NIS2 Overlap Mapping Guide.
Framework mapping
| French obligation | NIST CSF 2.0 | NIST SP 800-53 r5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Management approval and training (Art. 14) | GV.RR-01, GV.OV-01 | PM-2, AT-2 | A.5.1, A.6.3 |
| Identity and access for people and machines (Art. 14 protection) | PR.AA-01, PR.AA-05 | AC-2, AC-6, IA-4, IA-5 | A.5.15 to A.5.18, A.8.2 |
| Supply chain security (Art. 14 protection) | GV.SC-01 | SR-3 | A.5.19 to A.5.21 |
| Detection and logging (Art. 14 defence) | DE.CM-01, PR.PS-04 | AU-2, AU-6 | A.8.15, A.8.16 |
| Incident notification (Art. 17) | RS.CO-02 | IR-6 | A.5.24, A.5.26 |
Detection and measurement
- Classification coverage: percentage of French legal entities with a documented NIS2 classification decision (target 100% before the registration campaign).
- ReCyF gap closure: share of ReCyF measures assessed as implemented, tracked monthly.
- NHI ownership: percentage of service accounts, API keys and agents with a named owner and last-review date under 12 months.
- Time to initial notification: measured in exercises from detection to a draft ANSSI notification, against the 24-hour limit.
- Revocation time: median time to revoke a compromised machine credential across systems.
Common failure patterns
- Waiting for the vote: the decrees will follow quickly once the law passes, and the ReCyF already shows the direction. Months of preparation are lost by waiting.
- Group-level classification: assessing the group instead of each French legal entity, and missing a subsidiary that crosses the threshold on its own.
- Treating the ReCyF as optional: it is not mandatory, but without it the entity must prove equivalence on its own terms during an audit.
- Human-only access reviews: certifying staff accounts while service accounts and integration tokens with broader rights go unreviewed.
- One incident clock: planning only for the CNIL 72-hour deadline and missing the 24-hour ANSSI step.
Practitioner checklist
- Record the current bill status and date, and set a reminder to re-check Légifrance and the Assemblée dossier monthly.
- Classify each French legal entity as essential, important or out of scope, with evidence.
- Compile registration data, including public IP ranges and security contacts.
- Minute management body approval of the security measures and book training.
- Complete a ReCyF gap analysis and fund the top identity, logging and supply chain gaps.
- Write and rehearse a 24-hour, 72-hour and one-month notification runbook covering ANSSI and the CNIL.
- Inventory all non-human identities and AI agents with owners, scopes and rotation dates.
- Map critical suppliers and the credentials they hold into your systems.
Standards and references
- Sénat: Résilience des infrastructures critiques et renforcement de la cybersécurité, dossier législatif
- Sénat: Projet de loi, texte adopté n° 78 (2024-2025)
- ANSSI: La directive NIS 2 et le Référentiel Cyber France
- ANSSI: MonEspaceNIS2 FAQ
- EUR-Lex: Directive (EU) 2022/2555 (NIS 2)
- Next: NIS2 transposition scheduled, then postponed, at the Assemblée nationale
Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Readiness Checklist · NIS2 Transposition Tracker · Non-Human Identity (NHI) Guide. This guide summarises the French NIS2 transposition bill as it stood on 27 October 2026 and is not legal advice.