The Resilience Bill, which transposes into French law the NIS2 Directive, the DORA Regulation and the CER Directive, has not yet been enacted. Its examination in plenary session at the National Assembly is expected in autumn 2026. But its Article 16bis, adopted by the Senate as early as March 2025, already concentrates most of the debate between cyber experts and intelligence services. For your organisation, understanding what this text says, and what it does not say, is an architectural decision, not only a legal question.
What the Resilience Bill requires
Around 15,000 French entities will be subject to its obligations: cyber risk management, registration with ANSSI, incident notification within strict deadlines, and periodic audits. Penalties can reach EUR 10 million or 2% of worldwide turnover, whichever is higher.
ANSSI, the national competent authority for NIS2, has a heavy workload. In 2026, the agency processes more than 2,500 notifications of significant incidents each month, a 67% increase compared with 2024. This context of intensifying threats gives full weight to the technical provisions of the bill.
Article 16bis: what it says exactly
Article 16bis, introduced by a Senate amendment at the initiative of Senator Olivier Cadic, sets a simple rule: no public authority may compel a provider of encryption services to build a backdoor into its product. This safeguard applies to providers established in France or whose services are used by entities subject to NIS2.
The provision rests on a belief shared by most cyber experts: weakened encryption weakens it for everyone. A backdoor accessible to French intelligence services is, sooner or later, also accessible to a foreign state or a malicious actor. The logic is all or nothing. Either an encrypted channel is sound, or it is not.
The rift with the intelligence services
The General Directorate for Internal Security (DGSI) and some parliamentarians see things differently. They argue that Article 16bis, if maintained, will durably reduce the capacity for lawful interception on national territory.
The debate joins the global controversy over end-to-end encryption. Several countries have tried, with limited success, to impose access reserved for the authorities: the United Kingdom with the Online Safety Act, Australia with the Assistance and Access Act. In France, ANSSI's position has historically been in favour of strong encryption, without regulatory weakening. This consistency of doctrine is reflected in Article 16bis.
What this text does not do
Article 16bis does not cover your US suppliers. If your data transits through cloud services subject to the US CLOUD Act, adopted in 2018 and still in force, US law prevails over French law. A US provider can be compelled, through an order from a federal court, to hand over data or facilitate access, regardless of what the Resilience Bill says.
This point is essential. Believing that Article 16bis protects you because your team uses an end-to-end encrypted US service is a legal illusion. The protection stops at the borders of French jurisdiction. It applies to providers established in France or the European Union, not to those headquartered in the United States, China or outside the EU.
What this concretely changes for your CISO
First implication: your encryption architecture choices now have explicit legislative grounding. If an encryption provider wishes to serve the French market of NIS2 entities, it cannot legally be compelled to weaken its product. This is a solid argument in your discussions with providers, in particular for negotiating contractual clauses on the cryptographic integrity of the service.
Second implication: the distinction between French and foreign jurisdiction must enter your processing risk mapping. For each encryption service you use, identify the law applicable to the provider. A European SaaS service hosted in Ireland is not subject to the same constraints as a US service hosted in Virginia, even if both display "end-to-end encryption" in their commercial documentation.
Third implication: Article 16bis strengthens the case for a zero-knowledge architecture in your critical environments. If your most sensitive data can be decrypted only by you, the provider cannot hand anything over, even under legal compulsion. Solutions that separate key management from data hosting reduce this dependence on the provider's jurisdiction.
A concrete example
A local authority subject to NIS2 uses a secure messaging service operated by a French publisher. Under Article 16bis, this publisher cannot be compelled to build in an exceptional access mechanism. The authority has a legal guarantee on the integrity of the encrypted channel.
The same authority also uses a US collaborative suite, even if it is end-to-end encrypted. This solution remains potentially reachable under the CLOUD Act, whatever the declared architecture. The level of protection is not equivalent, even though both products advertise the same features in their product sheets.
This distinction, French or European provider versus US provider, same promise, different guarantees, must appear in your risk analysis and in your data classification policy.
What remains to be built
Article 16bis does not resolve the question of digital sovereignty on its own. It sets a legal prohibition, but its implementation depends on your architectural choices. A legal prohibition does not replace a well-managed encryption key or a robust issuance and rotation policy.
Post-quantum cryptography, which ANSSI recommends anticipating now in your multi-year projects, adds a further layer: an algorithm resistant to quantum computers protects your data against future attacks, whether or not a regulatory backdoor exists. These two topics are linked, and your security roadmap should address them together. To understand the concrete migrations to plan, the article Post-quantum cryptography: what organisations must do now sets out the timelines and priorities by type of cryptosystem.
What to take away
If Article 16bis is retained when the Resilience Bill is enacted, your CISOs will have a legal lever to resist demands to weaken encryption addressed to your French suppliers. The text does not resolve the question of non-European suppliers. It does not exempt you from a precise mapping of your encrypted data flows. And it does not protect against threats that need no backdoor to compromise a system.
What to start before enactment: audit which encryption providers fall within the scope of Article 16bis, identify those that do not, and document the real level of guarantee for each critical service. This is a mapping exercise. It can start now, without waiting for the final text.