On 23 September 2026, Next.ink published a brief confirming that the Resilience Bill had been placed on the National Assembly agenda for Wednesday 7 October 2026 (source: Next.ink, 23 September 2026). The text transposes three European directives: NIS2, the CER Directive on the resilience of critical entities, and the DORA provisions for the financial sector. It spent eighteen months in committee after its adoption by the Senate in March 2025.
What this text transposes
The Resilience Bill does not cover NIS2 alone. It simultaneously incorporates the transposition of the CER Directive and the DORA obligations for financial sector players. This broader scope partly explains the length of the parliamentary work.
For NIS2 alone, around 15,000 French entities fall within the scope of the directive (source: France's national cybersecurity agency (ANSSI), March 2026). These organisations, spread across eighteen sectors of activity, have had active obligations since October 2024. France did not meet the deadline. On 8 July 2026, the European Commission referred France to the Court of Justice of the European Union for failure to fulfil obligations, with the possibility of daily financial penalties until the transposition is fully notified.
What can still change
A second reading may modify the text. Three points concentrate the expectations of stakeholders.
Article 16 bis first. Introduced in the Senate, it prohibits imposing on encryption service providers any mechanism allowing non-consensual access to data. This provision crystallises the debate between data protection and judicial access. Debates at the Assembly will reopen this point.
Classification thresholds next. Certain sectors have asked for adjustments to the criteria defining important and essential entities. Sector-specific amendments are expected.
Entry-into-force deadlines finally. Several federations have argued for a phased compliance timetable depending on the size of organisations. Differentiated scheduling provisions could be introduced.
What cannot change, however, are the fundamental obligations defined by the directive itself: risk management, incident notification, supply chain security, governance. These requirements are fixed at European level. No national amendment can reduce their scope without creating a new infringement of EU law.
The mistake to avoid: waiting for the final text
The adoption of the Resilience Bill creates a temptation: wait for the text published in the Journal officiel before adjusting the programme. This reasoning is a mistake for three specific reasons.
First reason: the directive has applied since October 2024. In France, the absence of a national law does not create immunity. The referral to the CJEU confirms this: the European obligations exist independently of national transposition. An organisation that has not launched a programme in 2026 will not be able to plead the novelty of the legal framework during an inspection in 2027.
Second reason: penalties can reach EUR 10 million or 2% of worldwide turnover for essential entities. These amounts apply to documented and established breaches. The first European decisions show that authorities record the persistence of gaps over time: a failing identified in 2026 and not corrected becomes a heavier item against you in 2027.
Third reason: the real duration of a structured NIS2 programme is six to nine months. Organisations that wait for publication before starting will be structurally behind from the first ANSSI control campaigns.
What these twelve days allow you to finalise
Between 25 September and 7 October, four concrete actions do not need to wait for the final text.
The declaration of subjection to ANSSI is the prerequisite for any inspection. If this form has not been submitted, it is the first item to address. ANSSI's MonEspaceNIS2 portal has been online since March 2026.
A risk analysis aligned with ReCyF v2.5 is the second. The framework published by ANSSI in March 2026 sets out the practical sheets that can be relied on during an inspection. Organisations that have worked with other frameworks should check the correspondence.
The notification plan is the third. The operational pitfalls of 24-hour incident notification are the same whether or not the law has been published. A simulated playbook is worth more than an untested theoretical procedure.
Contracting with critical ICT suppliers is the fourth. NIS2 requires specific clauses in contracts with providers exposed to your essential systems. This work does not depend on the final text.
What adoption will change
Once the text is published, ANSSI will have the legal instruments to open formal procedures of notice and to impose binding measures. The deadlines and conditions will be specified by decree. The REACTIV mechanism, tested on ministries since 2025, is intended to extend to subject entities once the law is in force.
Adoption will also change the position of insurers. Several cyber contracts make their renewal conditional on attested NIS2 compliance. This criterion will become auditable as soon as the legal framework is stabilised. Organisations unable to produce compliance documentation will see their coverage terms deteriorate.
The question that sets the priorities
Could your NIS2 programme pass a documentary inspection today? Not in six months: today. Declaration of subjection submitted, risk analysis documented, notification plan tested, suppliers under contract. If the answer to any of these four points is no, 7 October is not good news. It is a signal that the coming weeks demand clear prioritisation and execution without delay.