NIS2 transposition: the French "resilience" bill delayed again — what an SME can do without waiting

The bill transposing NIS2 into French law was due to be debated in the National Assembly on 7 and 9 October 2026. On 6 October, the conference of presidents pulled it from the agenda; the rapporteur hoped at the time for it to be rescheduled "within two to three weeks" (Next, Leto). As this article is published, the text still has not been voted on.

For an SME director, the natural conclusion would be to wait. That is precisely the wrong reading, and this article explains why.

What the French bill actually contains

The legislative vehicle is the "bill on the resilience of critical infrastructure and the strengthening of cybersecurity". It does not transpose NIS2 alone: it also carries the CER directive on the resilience of critical entities and the part of the DORA regulation that applies to the financial sector. The Senate adopted it on 12 March 2025, and it has been waiting for its Assembly reading ever since.

The EU transposition deadline was 17 October 2024. France is therefore more than two years late, and the European Commission opened infringement proceedings against it during the summer of 2026. That calendar concerns the State, not companies: no penalty can hit a French entity until the law is enacted and its implementing texts published.

What is already known, and does not depend on the vote

The NIS2 directive has been published since 2022. The parliamentary debate is about French implementation choices — competent authority, penalties, entry into force — not about the substance of the obligations. Two categories of entities are provided for:

• Essential entities: the larger organizations in the most critical sectors, from roughly 250 employees or equivalent financial thresholds.
• Important entities: from roughly 50 employees, or 10 million euros in turnover or balance sheet, in the covered sectors.

The exact thresholds and the list of sectors depend on the final text; they are still quoted with variations from one source to another. ANSSI refers to "several thousand" entities concerned in France. Three obligations structure the regime: registering with the authority, implementing risk-management measures, and reporting significant incidents.

The reference framework already exists: ReCyF

This is the point that waiting makes you miss. Since 17 March 2026, ANSSI has published the Référentiel Cyber France (ReCyF), which lists the measures it recommends for meeting NIS2’s security objectives. It corresponds to the framework mentioned in Article 14 of the bill and is organized into four pillars — Governance, Protection, Defense, Resilience — broken down into twenty-two domains.

It is issued as a working document and is not mandatory by default. But an entity that chooses to apply it will be able to rely on it during an inspection. In other words: the expected content has been public for seven months, even if the obligation is not yet.

The five workstreams that will not be renegotiated

Whatever text is finally voted, these five points will be part of the expectations. They are also, near enough, the fundamentals of a secure SME infrastructure:

• An asset map: servers, workstations, online services, privileged accounts, providers with access to the system.
• Multi-factor authentication, at minimum on email, administration and remote access.
• Logging of security events, with enough retention to reconstruct an incident.
• Tested backups, meaning actually restored at least once (see the 3-2-1 rule).
• An incident procedure able to produce a notification within 24 hours: who decides, who writes it, with what information.

And if you are not in scope

Most SMEs will not be in scope directly. They will be indirectly, through their customers: an entity in scope must control its supply-chain risk, and passes it on as contract clauses and questionnaires. That is the cascade effect, and it depends on no vote: it is already at work in tenders.

Waiting is the only real risk

A parliamentary delay postpones neither attacks, nor client requirements, nor the time it takes to deploy strong authentication or test a restore. The entities that will comply painfully are those that read the delay as extra time. The ones that will come through will have handled these five workstreams because they are worth doing in themselves, regardless of which article of law eventually makes them mandatory.

Sources

• ANSSI — The NIS 2 directive
• Next — ANSSI publishes its ReCyF
• Leto — Resilience bill postponed, October 2026
• LCP — The "resilience" bill and the scaling-up of the threat