NIS2 obligations in France
France is folding NIS2 into a Critical Infrastructure Resilience Bill; ANSSI developing its own measures framework. Source
Referred to the CJEU on 8 Jul 2026 for failing to notify transposition measures. Source
⚠ Draft status as of ECSO update 10 Sep 2026; check national legislature for progress since.
Competent authority & CSIRT
- ANSSI. To be updated. ecs-org.eu · 28 Oct 2026 · secondary source
Who's in scope (national deviations)
- The sectoral scope corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
- France will update existing OIV (Operators of Vital Importance) requirements under the new Critical Infrastructure Resilience Bill, aligning them with NIS2. Under this approach, the framework will retain the essential and important entity classifications while modernising OIV obligations to reflect evolving security needs. ecs-org.eu · 28 Oct 2026 · secondary source
Registration
- ANSSI will provide an online pre-registration service. ecs-org.eu · 28 Oct 2026 · secondary source
NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex
Incident reporting
Not yet published / needs verification We have not found a published, sourced national rule for this yet.
NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex
Management liability & training
Not yet published / needs verification We have not found a published, sourced national rule for this yet.
NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex
Penalties Legal ref: Art. 37
- Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
- Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
- Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex
Security measures, standards & deadlines
- ANSSI has been tasked with developing a cybersecurity measurement framework to translate the cybersecurity objectives listed in articles 20 and 21 of the NIS2 Directive into technical, operational, and organisational measures. This framework will act as a standard to guarantee conformity with NIS2 requirements. ecs-org.eu · 28 Oct 2026 · secondary source
- ISO 27001 can still be used as a tool or method to support the implementation of measures prescribed by the ANSSI’s framework; however, it will not serve as a presumption of conformity with NIS2 requirements. ecs-org.eu · 28 Oct 2026 · secondary source
Supervisory guidance
Not yet published / needs verification No regulator guidance links recorded yet. Official text: Draft Law
What changed recently
- Referred by the Commission to the Court of Justice for failing to notify transposition digital-strategy.ec.europa.eu source-checked
Sections marked secondary source come from the ECSO NIS2 Transposition Tracker (updated 10 Sep 2026), which simplifies law extracts; source-checked items were read on the regulator's or official gazette's site. Data: data/nis2/. Not legal advice — always check the official text.
Get France NIS2 changes weekly
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.