Ongoing

The French government submitted the draft law transposing the NIS2 Directive to the Senate on 15 October 2024.

After the examination of the text by the Senate, the latter shall be examined by the National Assembly.
The agenda for the adoption of the draft law has not been published, therefore there is no clear view of how long the process will take in France.

• The current draft law is closely modeled on the NIS2 Directive.
• The scope of the application has been extended to other local authorities (i.e. all the departments, municipalities of more than 30,000 inhabitants, overseas collectivities). The scope has also been extended to educational institutions carrying out research activities. The prime minister may decide to exclude some educational institutes from the scope.
• According to the draft law, a single authority shall be in charge of steering and coordinating the implementation of the government's cybersecurity policy and monitoring the obligations of the entities. The designated authority is the French Cybersecurity Agency ("ANSSI").
• In deviation of Article 32 of the NIS2 Directive, the current draft law provides that the costs of controls (security audit carried out by independent third parties, security scans, inspections of the local authority, audits carried out in case of incidents) shall be borne by the controlled/audited entity unless the local authority decides otherwise.
• The draft law may be subject to substantial modifications during its examination by the Senate and the Parliament.

No date announced yet.