On 6 October 2026, the National Assembly's conference of presidents withdrew the Loi Résilience from its 7 and 9 October plenary agenda, setting no new date (source: minutes of the National Assembly's conference of presidents, 6 October 2026). The bill, which transposes France's NIS2 Directive, the CER Directive and DORA provisions for financial institutions into national law, has been awaited by thousands of entities for more than two years. This third postponement does not merely shift a calendar. It prolongs a legal vacuum whose practical consequences for your compliance programmes are immediate.
What is blocking the bill: Article 16 bis and encryption
The sticking point is Article 16 bis, introduced by the Senate when it adopted the text on 12 March 2025. The article prohibits any public authority from compelling encryption solution providers to deliberately weaken their products, whether by inserting a master key or by any other mechanism enabling circumvented access. The Conseil supérieur du numérique et des postes supports this wording. Part of the intelligence services, including the DGSI, sees it as an obstacle to targeted lawful interception.
This debate is not specific to France. It reproduces at national level a tension documented across Europe between the protection of communications and law enforcement prerogatives. What is specific to the French situation is that this disagreement is blocking the transposition of a cybersecurity directive whose deadline was set for 17 October 2024. Rapporteur Éric Bothorel stated he hoped to reschedule the text within fifteen to twenty days (source: press statement, 6 October 2026). No date has been confirmed to date.
The current legal status
NIS2 (EU Regulation 2022/2555) is in force across the European Union. It is not yet in force in French law. The obligations it imposes — information systems security governance, incident notification within prescribed timeframes, digital supply chain security — are not yet enforceable in France. No entity can today be sanctioned on the basis of NIS2 law by a French authority, in the absence of an adopted transposition text.
This situation does not excuse inaction. Certain NIS2 obligations overlap with requirements already applicable under French law: the GDPR for incidents involving personal data, sectoral frameworks in healthcare or energy, and contractual obligations vis-à-vis public administrations. France's national cybersecurity agency (ANSSI) also published the practical implementation sheets of the Référentiel Cyber France (ReCyF) v2.5 on MesServicesCyber on 7 September 2026. These documents translate the 20 reference framework objectives into concrete actions and expected evidence. This is not yet a legal obligation: it is the framework the supervisory authority will apply as soon as the law is adopted. An analysis of what these practical sheets change for your programmes is available in our article on ReCyF v2.5 and NIS2 implementation.
What the ECJ is requiring of France
On 8 July 2026, the European Commission referred France to the Court of Justice of the European Union for failure to transpose NIS2, with a request for financial sanctions (source: European Commission press release, 8 July 2026). This procedure follows a letter of formal notice on 28 November 2024 and a reasoned opinion on 7 May 2025. France was one of four member states referred on that date, alongside Ireland, Spain and the Netherlands.
The Court may impose a lump sum and daily penalty payments until complete transposition is notified. Specialists in European public law cite daily penalties of several tens of thousands of euros. Each further parliamentary delay prolongs the period of exposure to these potential sanctions. For a fuller account of the obligations that will apply to concerned entities from promulgation onwards, our analysis of the ECJ referral and its consequences for NIS2 entities sets out the expected scope.
What your NIS2 programme must do in this void
Consider a concrete example. A local authority with a population above 30,000 knows it will fall within the NIS2 scope once the bill is adopted. For a year, its IT director has been waiting for the definitive text before submitting the compliance budget. The result: no additional measures, no team training, no contractual review with IT service providers. This deferral becomes operational in six months, when the law is adopted with a short compliance deadline and the preparatory work has not been done.
This scenario is common. Legal uncertainty serves as an argument for deferring security investment. The rational response is precisely the opposite.
Register your organisation on MesServicesCyber. ANSSI opened this portal to allow potentially in-scope entities to register voluntarily and access the ReCyF practical sheets. Registration is not yet an obligation. It gives you access to preparation resources and establishes a relationship with the competent authority before the legal constraint takes effect.
Carry out a gap assessment against the ReCyF scope. Version 2.5 is structured around 20 objectives across five domains: governance, identification, protection, defence, and resilience. For each objective, the practical sheets describe the expected evidence. A maturity assessment against these 20 objectives gives you a measure of the remaining effort and a work plan that is independent of the legislative calendar. If the law is adopted soon, you know where you stand. If it is postponed again, you have made progress.
Integrate supply chain security clauses into your contracts. Article 21 of the NIS2 Directive will require in-scope entities to include security requirements in their relationships with critical suppliers. Anticipating contractual revision with your most exposed IT service providers — in particular those with direct access to your systems — is a step you can take now, before the compliance deadline begins to run. To go further, explore our NIS2 compliance support services.
What this third postponement reveals
The withdrawal of the Loi Résilience on 6 October is not an isolated incident. It reveals a structural tension between two legitimate concerns: the protection of encrypted communications, supported by ANSSI and the digital sector, and lawful interception prerogatives, defended by the intelligence services. This disagreement did not emerge in October 2026. It has delayed the text since the National Assembly's special committee stage, and has already caused two prior postponements.
The question for your organisation is not when the law will be adopted. It is whether, whenever that date arrives, you will be in a position to demonstrate compliance within the timeframes that will be set. A preparation programme launched now on the basis of ReCyF places you in a very different position from one that waits for the definitive text. In the first case, you are managing a calendar. In the second, you are managing an emergency.