Everything you need to know about the NIS2 directive in France: transposition law, competent authority, fines, deadlines, and how Reglyze helps SMEs become compliant.
Projet de loi relatif a la resilience des activites d'importance vitale (in parliamentary review)
Adopted / in force: 2026-Q2
Agence nationale de la securite des systemes d'information (ANSSI)
https://cyber.gouv.frUp to EUR 10 million or 2% of global annual turnover
Up to EUR 7 million or 1.4% of global annual turnover
2024-10-17
EU transposition deadline — missed by France (infringement procedure opened).
2026-Q2
Expected adoption of the transposition law. ANSSI has published draft guidance.
Continuous
ANSSI MonEspaceNIS2 portal is already live — entities can self-identify and prepare.
France missed the EU transposition deadline and is subject to an infringement procedure by the European Commission.
Despite the delay, ANSSI has launched MonEspaceNIS2 — an early self-registration and information portal.
The French law is expected to impose stricter thresholds than the directive minimum for certain sectors.
ANSSI's CERT-FR will handle all incident notifications, replacing OIV-specific reporting under the old LPM framework.
Organizations that were previously Operateurs d'Importance Vitale (OIV) will automatically be classified as Essential Entities.