	NIS2 Implementation in the EU
	France
	(Europe) Firm Gide Loyrette Nouel A.A.R.P.I. Contributors Aurélie Pacaud Altea Agolli Updated 21 Jan 2026
Status of the legislative process	Ongoing
Status of the NIS2 Implementation Act	The French government submitted the draft law transposing the NIS2 Directive to the Senate on 15 October 2024. The draft law was adopted by the Senate on 12 March 2025. It was then transmitted to the National Assembly, where a special committee was seized on 13 March 2025. The special committee issued its report and draft text on 10 September 2025. The draft law has not yet been finally adopted, and no date of entry into force has been announced.
Significant deviations of the National Implementation Act from the NIS2 Directive, if any	The current draft law is closely modeled on the NIS2 Directive. The scope of the application has been extended to other local authorities (i.e., all the departments, municipalities of more than 30,000 inhabitants, and overseas collectivities). The scope has also been extended to educational institutions carrying out research activities. The prime minister may decide to exclude some educational institutes from the scope. According to the draft law, a single authority shall be in charge of steering and coordinating the implementation of the government's cybersecurity policy and monitoring the obligations of the entities. The designated authority is the French Cybersecurity Agency ("ANSSI"). The draft law may be subject to substantial modifications during its examination by the Parliament.
Date of entry into force of the Implementation Act	No date announced yet.

NIS2 Implementation in the EU

Back XLS

Status of the legislative process

Ongoing

Status of the NIS2 Implementation Act

The French government submitted the draft law transposing the NIS2 Directive to the Senate on 15 October 2024. The draft law was adopted by the Senate on 12 March 2025.

It was then transmitted to the National Assembly, where a special committee was seized on 13 March 2025. The special committee issued its report and draft text on 10 September 2025.

The draft law has not yet been finally adopted, and no date of entry into force has been announced.

Significant deviations of the National Implementation Act from the NIS2 Directive, if any

The current draft law is closely modeled on the NIS2 Directive.
The scope of the application has been extended to other local authorities (i.e., all the departments, municipalities of more than 30,000 inhabitants, and overseas collectivities). The scope has also been extended to educational institutions carrying out research activities. The prime minister may decide to exclude some educational institutes from the scope.
According to the draft law, a single authority shall be in charge of steering and coordinating the implementation of the government's cybersecurity policy and monitoring the obligations of the entities. The designated authority is the French Cybersecurity Agency ("ANSSI").
The draft law may be subject to substantial modifications during its examination by the Parliament.

Date of entry into force of the Implementation Act

No date announced yet.

NIS2 Implementation in the EU

France

NIS2 Implementation in the EU

France