#NIS2 Lawyer in France: Preparing for Your Cybersecurity Obligations

Key points

• Directive (EU) 2022/2555, known as NIS2, is in force at European level; the transposition deadline expired on 17 October 2024.
• As at 5 October 2026, the French transposition law has not been enacted: adopted by the Senate on 12 March 2025, the “critical infrastructure resilience” bill is due to be debated in plenary session at the National Assembly (Assemblée nationale) on 7 October 2026.
• The directive does not create direct obligations for companies as long as the French law has not been enacted; ANSSI (French National Cybersecurity Agency) already offers voluntary pre-registration.
• The bill provides for registration, risk management and incident notification, with penalties envisaged of up to €10 million or 2% of worldwide turnover for essential entities (€7 million or 1.4% for important entities), whichever is higher – amounts that may change.
• DORA, on the other hand, already applies: since 17 January 2025, to financial entities and their ICT service providers.

A NIS2 lawyer helps your company prepare for the French transposition of Directive (EU) 2022/2555: applicability analysis, governance, contractual and documentary preparation, and how it fits with the GDPR and DORA. As at 5 October 2026, the French law has not yet been enacted: the challenge is not to comply with a final text, but to prepare the company for its arrival. Hashtag Avocats, a digital law firm in Paris, assists you in this preparation.

NIS2 in France: where does the law stand as at 5 October 2026?

The NIS2 Directive had to be transposed by each Member State by 17 October 2024 at the latest. France has missed this deadline: ANSSI states that transposition “is in progress”, and no enacted law appears on Légifrance on the date this page was updated.

The legislative vehicle is the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, tabled in the Senate on 15 October 2024 under the accelerated procedure. The Senate adopted it at first reading on 12 March 2025. At the National Assembly, the text adopted by the special committee (No. 1779-A0) was tabled on 10 September 2025; the legislative file schedules its debate in plenary session for Wednesday 7 October 2026. The remaining steps will then be, where applicable, a joint committee (commission mixte paritaire), final adoption and enactment. Enactment dates are circulating in the specialist press: they are not confirmed by any official source. This page will be updated as the procedure progresses.

What already applies, what is still to come

Today: no direct NIS2 obligation, but an existing foundation

As long as the French law has not been enacted, the directive does not create direct obligations for companies. That does not mean there is a legal vacuum: Article 32 of the GDPR already requires any organisation processing personal data to implement security measures “appropriate to the risk”, and your IT contracts contain enforceable security commitments. This foundation is the starting point for any preparation, in connection with our GDPR compliance practice.

Already possible: voluntary pre-registration with ANSSI

ANSSI has opened a NIS2 portal allowing future essential and important entities to pre-register voluntarily and to report incidents. The step is not mandatory at this stage: it allows you to enter the system in a controlled way and to identify your likely category in advance.

Tomorrow: the obligations expected from the law

Based on the bill as it stands – which may change until final adoption – the French regime should include mandatory registration of the entities concerned, risk management measures, an incident notification obligation and a penalty regime of up to €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher. These elements should be read as a direction of travel, not as settled law: only the enacted text will be authoritative.

Who will be covered by NIS2?

The directive distinguishes two categories: essential entities and important entities, designated according to criteria of business sector and size. The scope covers many sectors and, indirectly, their supply chains: a company that is not designated may have security requirements imposed on it by customers subject to the text. The final national scope – thresholds, sectors, designation arrangements – will be set by the transposition law and its implementing texts. Until then, a case-by-case analysis makes it possible to estimate your likely exposure and that of your customers.

Preparing for NIS2 compliance now: four legal workstreams

Governance and internal organisation

The first workstream is to put in place cyber risk governance: who decides, who raises the alert, who documents. This requires written internal procedures and rules that are enforceable against users, first and foremost an IT acceptable use policy incorporated into the internal rules (règlement intérieur). Governance that is already in place will considerably reduce the upgrade effort when the French regime comes into force.

Supplier and processor contracts

Supply chain security is at the heart of NIS2. Reviewing your IT contracts now – security, audit, incident alert and reversibility clauses – prepares the ground, all the more so as Article 28(3)(f) of the GDPR already requires the processor to assist the controller in complying with its security and notification obligations. A consistent contractual framework will serve both compliance regimes at once.

Register and documentation

Mapping your critical systems, your service providers and your existing obligations forms the documentary basis for future registration. This mapping relies on tools that are already mandatory: the record of processing activities, internal documentation of data breaches (Article 33(5) GDPR), insurance policies. What you document today, you can prove tomorrow.

Incident management process

NIS2 will add an incident notification to those that already exist. A single incident management process, linking CNIL notification of data breaches, information to the individuals concerned and notification to the insurer, avoids duplication and contradictions. Our personal data breach lawyer page details the data side of this process.

DORA: the financial sector is not waiting for NIS2

Unlike NIS2, Regulation (EU) 2022/2554, known as DORA, already applies: since 17 January 2025, with no transposition required. Its scope is strictly financial: credit institutions, investment firms, insurance, asset management, crypto-asset service providers, and their critical ICT service providers. Its pillars: ICT governance and risk management, notification of major incidents, digital operational resilience testing, and contractual oversight of third-party providers – with a register of information on contracts, whose submission to the ACPR (French Prudential Supervision and Resolution Authority) is governed by Instruction No. 2025-I-12. A financial entity must therefore treat DORA as law in force, and NIS2 as a direction of travel: we analyse how the two regimes fit together according to your business. The operational detail of DORA – contractual clauses, register of information, resilience testing – is set out in our article DORA Regulation: obligations, ICT contracts and register of information.

How we help: applicability analysis and contractual preparation

We assist you with analysing whether NIS2 and DORA apply to your situation, contractual and documentary preparation, and monitoring the French legislative procedure. This work is part of our overall approach to cyber risk, presented on our cybersecurity lawyer page. Every situation is different: the extent of the preparation depends on your sector, your size and your contractual chains.

Preparing for NIS2: the lawyer’s role, the technical teams’ role

Preparing for NIS2 involves two distinct fields. The lawyer handles the legal side; technical security measures are a matter for independent specialist experts, with whom we coordinate our work:

What the lawyer does	What the technical experts do
Applicability analysis of NIS2, DORA and sector-specific texts	Technical security audit of systems
Contractual preparation: suppliers, processors, security clauses	Implementation of security and detection measures
Governance, internal procedures, enforceable documentation	Resilience testing and infrastructure hardening
Legislative monitoring and alignment with the GDPR	Operational monitoring and technical incident response

FAQ: NIS2 lawyer

Is NIS2 already mandatory in France?

No. As at 5 October 2026, the French transposition law has not been enacted: the directive does not create direct obligations for companies until it is. Adopted by the Senate, the bill is due to be debated in plenary session at the National Assembly on 7 October 2026. Existing security obligations – GDPR, contracts, sector-specific texts – do, however, continue to apply.

Which companies will be covered by NIS2?

The directive targets essential and important entities, designated according to sector and size criteria, in many business sectors. The final French scope will be set by the transposition law. Companies that are not designated may be affected indirectly, through the contractual requirements of their customers subject to the text.

What penalties does NIS2 provide for?

The French bill envisages penalties of up to €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher. These amounts may still change until the text is finally adopted: no NIS2 penalty applies in France until the law has been enacted.

What is the difference between NIS2 and DORA?

NIS2 is a general cybersecurity directive, awaiting French transposition. DORA is a directly applicable European regulation, in force since 17 January 2025, limited to financial entities and their ICT service providers. A financial entity applies DORA today; other companies prepare for NIS2.

What can a company prepare before the law is enacted?

Four workstreams do not need to wait for the final text: internal cyber risk governance, review of supplier and processor contracts, mapping and documentation of critical systems, and a unified incident management process. Voluntary pre-registration with ANSSI completes this preparation.

Official sources

• Directive (EU) 2022/2555 (NIS2), status of transposition in France: ANSSI NIS2 portal
• Bill on the resilience of critical infrastructure and the strengthening of cybersecurity, legislative file: Senate
• Legislative file at the National Assembly (committee text No. 1779-A0): National Assembly
• Regulation (EU) 2022/2554 (DORA): text on EUR-Lex
• DORA, overview and implementation: ACPR
• Regulation (EU) 2016/679 (GDPR), Articles 28, 32 and 33: consolidated text on EUR-Lex

Legal position and legislative procedure checked as at 5 October 2026: as the French transposition of NIS2 is in progress, the information above may change. This content provides general information and does not constitute legal advice. Every situation is different: contact our team to explain your situation.