National Annex — France
Status as of October 2026: Pending, in the legislative process. Community-maintained orientation. This is not legal advice; verify against the official gazette and authority guidance before relying on it. Corrections welcome, see contributing.
| Review | Status |
|---|---|
| Confidence | Pending legislative change |
| Checked line by line against the legal text | No |
| Reviewed by a lawyer | No |
| Last reviewed | October 2026 |
| Reviewed by | Frederik B. Krogsgaard, maintainer |
| Second reviewer | Wanted, see CONTRIBUTING |
| Next review due | April 2027 |
NIS2 implementation
| Field | Value |
|---|---|
| Implementing law | Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité, transposing NIS2, CER and DORA adjustments. Adopted by the Senate on 12 March 2025; it was due in the Assemblée nationale in October 2026 but was withdrawn from the agenda on 6 October 2026, and no new date has been set. The European Commission referred the country to the Court of Justice of the EU on 9 July 2026 for failing to transpose NIS2. |
| Competent authority | ANSSI (Agence nationale de la sécurité des systèmes d'information) |
| National CSIRT / reporting | CERT-FR |
| Official starting point | https://cyber.gouv.fr |
Country notes for your CDC
ANSSI runs the MonEspaceNIS2 service to prepare entities pre-law; SecNumCloud and existing LPM/OIV regimes continue in parallel. Don't wait for the law to start.
Standard checklist for all countries
- GOVERN: applicability determined per legal entity and sector, and recorded in the regulatory applicability register
- Entity registration completed with the national authority where required
- RESPOND: incident-reporting procedure drilled against the national channel and the 24 h early-warning clock
- Contact established with the national CSIRT before the first incident
- Data protection authority contact and GDPR Art. 33 flow prepared. This runs in parallel with NIS2 reporting
- National guidance and frameworks mapped to your control evidence, per the note above
Selector tag
Tick "France" in tools/regulatory-profile.html to include this country's references under the fr-nat tag.
Open CDC Framework, licensed CC BY 4.0.