The European Commission referred France to the Court of Justice of the European Union (CJEU) on 8 July 2026 for failing to transpose the NIS2 Directive. Member States were required to incorporate the text into national law by 17 October 2024. The National Assembly will resume examination of the Resilience Bill in September 2026, but the final vote remains uncertain. Around 15,000 French entities fall within the scope of the Directive. This delay is not a painless parenthesis for the organisations concerned.
What the referral to the CJEU means
Infringement proceedings follow a well-marked path. The Commission issued France with a formal notice at the end of 2024, shortly after the transposition deadline expired. It issued a reasoned opinion in May 2025. The referral to the Court of Justice, confirmed on 8 July 2026, is the third and final stage of this procedure. France finds itself in this situation alongside Spain, Ireland and the Netherlands, all referred for the same reason on the same day.
The potential financial penalties, should the Court rule against France, include a lump-sum fine and daily penalty payments calculated until compliance is effectively achieved. For a delay of this magnitude on a public security text, the amounts could reach several tens of millions of euros for the French State.
What this referral does not do: it does not create immediate new obligations for private French entities. The Court of Justice finds a State failure and imposes financial penalties on France. It is public finances that bear the cost, not directly the operators within the scope of NIS2.
What applies despite the absence of transposition
NIS2 is a directive. Without transposition into French law, its provisions do not apply directly to private entities. This legal reasoning is accurate, but it masks three dynamics that create de facto obligations.
ANSSI published the ReCyF on 17 March 2026. This cybersecurity framework, structured around 15 objectives and 76 measures, translates the requirements of NIS2 into concrete actions. The Agency uses it as a reference framework in its exchanges with the entities it pre-registers, and this pre-registration is ongoing. An entity registered with ANSSI without a compliance programme aligned to the ReCyF exposes a documented gap, which will be the first checkpoint when the law is enforced.
The DORA Regulation, for its part, has applied directly to the financial sector since January 2025. It is a European regulation, not a directive: it does not require national transposition. Financial entities within the simultaneous scope of DORA and NIS2 have active obligations on ICT risk management, incident reporting and operational resilience. NIS2 will add a further layer, but the core framework is already enforceable.
Finally, public procurement in sensitive sectors is progressively incorporating the ReCyF and NIS2 frameworks into its selection criteria. An industrial systems integrator bidding for a water treatment installation contract had to document its cyber risk management programme against NIS2 criteria to validate its qualification requirements, even though the text had not yet been transposed into French law. The law was waiting; the market was not.
Three risks not to underestimate while waiting
The first risk is slowing down. Teams that launched upgrade programmes in 2025 may be tempted to slow down in the face of legislative uncertainty. This would be a strategic mistake: once the Resilience Bill is adopted, entry-into-force deadlines will be short. Entities that have maintained their momentum will have a real advantage over those that paused.
The second risk concerns incidents occurring during this waiting period. The NIS2 Directive requires an early warning within 24 hours of detecting a significant incident, and a full notification within 72 hours. These deadlines do not yet formally apply in France. But ANSSI encourages voluntary reporting, and the absence of a well-practised notification process will be an aggravating factor at the first post-adoption inspection. The most frequent operational pitfalls in these procedures are documented in the article on the five pitfalls of NIS2 24-hour notification.
The third risk is a misunderstanding about the clock. The adoption date of the Resilience Bill will not be a starting date. ANSSI has published its guidance, the ReCyF is available, and entities have been pre-registered. The regulatory logic will favour rapid compliance for entities that did not anticipate it, not a soft start.
What your security programme should include now
Confirm the scope. Check whether your entity falls into the category of essential or important entities under the NIS2 thresholds: size, turnover, sector of activity. ANSSI has published its classification criteria. This scope will not change with the adoption of the law.
Map critical assets and ICT third parties. The Directive requires documented risk management across the supply chain. This mapping takes several months. Starting it now means gaining directly on the post-adoption compliance timetable.
Exercise the notification procedures. Build and test an incident notification process that meets NIS2 deadlines, even under a voluntary regime. This is the investment with the most immediate return: a tested procedure concretely reduces the impact of a real incident, and its written record demonstrates good faith during an inspection.
The parliamentary session of September 2026 may finally lead to the adoption of the Resilience Bill. Or the timetable may slip again. What will not slip, however, is the exposure of the 15,000 French entities concerned. The referral to the CJEU shows that the Commission intends to enforce NIS2 across the Union, with or without a finalised national law. Organisations that have treated it as a signal are ahead of those that waited for the vote.