NIS 2 status in France
What the directive requires, how France transposes it, and where ANSSI sits inside the picture.
Overview
The NIS 2 directive is the EU layer. It binds every member state, including France, with one cybersecurity floor for essential and important entities. France must put that floor into French law and run a supervision regime under it.
France has not yet transposed NIS 2. The transposition is a government bill, the projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité, which covers NIS 2, the critical entities directive and DORA. The Senate adopted it on 12 March 2025 and an Assemblée nationale special committee on 10 September 2025. The Assemblée's floor debate is scheduled for 7 October 2026. The Commission referred France to the Court of Justice of the EU on 8 July 2026 for failing to transpose NIS 2, and asked for financial sanctions. The bill layers on top of the existing OIV regime (Opérateurs d'Importance Vitale) and the NIS 1 OSE regime (Opérateurs de Services Essentiels) rather than replacing them outright.
ANSSI (Agence nationale de la sécurité des systèmes d'information) runs the national CSIRT and is the national authority under the bill. It offers voluntary pre-registration at messervices.cyber.gouv.fr/nis2 (formerly MonEspaceNIS2); registration becomes a duty only once the law is adopted. Sector regulators stay in the loop for sectors that already had one, finance in particular, where DORA acts as lex specialis.
EU directive
Directive (EU) 2022/2555 (NIS 2)
The EU-wide cybersecurity directive. Sets the obligations every member state must transpose, including the size and sector tests for essential and important entities.
EU implementation
Commission Implementing Regulation (EU) 2024/2690
Technical and methodological measures for digital infrastructure providers. Directly applicable in France without national transposition.
French transposition (bill)
Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité
The government bill that will transpose NIS 2, together with the critical entities directive and DORA. The Senate adopted it on 12 March 2025; the Assemblée nationale's floor debate is scheduled for 7 October 2026. The bill's Title I rewrites the critical-operator rules in the Code de la défense; Title II carries NIS 2 as articles of the new law, with ANSSI as the national authority. Implementing decrees and ANSSI guidance will fill in the operational detail.
The resilience and cybersecurity bill
Will carry the NIS 2 obligations into French law once adopted; it is not law yet. The bill defines two categories, entités essentielles (EE) and entités importantes (EI), the supervision powers of ANSSI, incident reporting duties, and sanctions. Most operational detail is delegated to décrets d'application.
ANSSI as supervisor and CSIRT
Under the bill, ANSSI runs supervision and audits and refers breaches to a sanctions committee (commission des sanctions), which imposes the fines. It also operates the national CSIRT and the voluntary pre-registration at messervices.cyber.gouv.fr/nis2 (formerly MonEspaceNIS2). Sector regulators such as ACPR for finance keep their own competence where lex specialis applies.
Registration and reporting
The directive required entities to be identifiable by Member States from 17 April 2025. France has no registration duty yet: ANSSI offers voluntary pre-registration at messervices.cyber.gouv.fr/nis2 (formerly MonEspaceNIS2), and registration becomes a duty only once the law is adopted. Once it applies, significant incidents follow the directive's 24h early warning, 72h notification and one-month final report cadence.
Local law applies inside France
Entities established in France will follow the French transposition once it is adopted. A German Geschäftsführer running a French subsidiary will read the French law for that subsidiary, not the German BSIG. The directive obligations are the same; the procedure, the portal and the sanctions will live in French law.
France cannot go below the EU floor
The directive is a minimum harmonisation instrument. France can go stricter, and historically has via the OIV regime. It cannot drop below the directive on essential and important entity duties, incident reporting deadlines or management body accountability.
ANSSI
National CSIRT, and the national authority under the bill. Runs the voluntary NIS 2 pre-registration at messervices.cyber.gouv.fr/nis2 (formerly MonEspaceNIS2), issues guidance and conducts audits. Under the bill, ANSSI supervises and refers breaches to a sanctions committee (commission des sanctions), which imposes fines of up to EUR 10 million or 2 % of worldwide turnover for essential entities and EUR 7 million or 1.4 % for important entities. Holds the historical OIV doctrine that will feed NIS 2 supervision.
CNIL
The French data protection authority. Not the NIS 2 regulator. Stays competent for personal data breach reporting under GDPR. A NIS 2 incident touching personal data is often a dual notification: ANSSI and CNIL.
ENISA
The EU cybersecurity agency. Publishes guidance, manages the European vulnerability database, and supports cross-border coordination. Not a supervisor for French entities; ANSSI is.
We are already OIV, so NIS 2 is handled.
OIV and OSE classifications under the existing Code de la défense and NIS 1 framework do not automatically carry over as essential or important entities (EE or EI) under NIS 2. The perimeter is different, sectoral thresholds are different, and entities must verify their status against the new criteria. Many OIV are also NIS 2 essential entities, but the obligation set and reporting channel change.
NIS 2 in France only applies to large operators.
The size test caps at medium and large enterprises by default, but the directive captures small entities where they are the sole provider, where disruption has cross-border impact, or where French law adds them. Public administrations and certain digital providers are in regardless of size. The applicability check has to be done case by case, not by company size alone.
MonEspaceNIS2 and ANSSI only accept French.
The portal and official guidance are French-first. Foreign parent companies should not assume they need a full French translation of every internal policy to register or to file an incident report.
Most French Mittelstand-equivalent operators we see still treat NIS 2 as an extension of the old OIV / OSE regime. That is half right. Under the bill, the supervision and incident channel sit inside ANSSI like before, but the scope is wider and the management body sign-off is heavier. Once the law applies, the Geschäftsführer-equivalent (président, directeur général, gérant) is personally on the hook for risk-management approval and training.
The practical move is the same as everywhere else in the EU: confirm scope under the directive, pre-register voluntarily with ANSSI (messervices.cyber.gouv.fr/nis2, formerly MonEspaceNIS2) and register once the law is adopted, set up the four continuous obligations (registration upkeep, incident reporting, supply chain risk, management body oversight), and document the minimum. The OIV apparatus helps, but it does not substitute for the NIS 2 duties.
- Directive (EU) 2022/2555 (NIS 2): EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690
- Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité: Assemblée nationale, legislative dossier
- Code de la défense, Articles L.1332-1 et suivants (OIV): Légifrance
- ANSSI: Agence nationale de la sécurité des systèmes d'information, official site
- ANSSI NIS 2 pre-registration: messervices.cyber.gouv.fr/nis2 (formerly MonEspaceNIS2)
- ACPR / Banque de France: competent authority for DORA in the financial sector
In practice
What the national law changes, and what it doesn't
The national law decides, among other things, where you register and whom you report incidents to. The measures themselves start from the same minimum list in every member state (Art. 21 NIS 2). The walkthrough takes you through them one step at a time:
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
