Andy Garcia · freelance dev
FRENES
Back to the blog
Cyber & Law

France Pulled Its NIS2 Bill, Almost 2 Years Late. Its Line on Software Publishers Is Contested.

October 19, 2026 9 min read

On Tuesday, October 6, the Conférence des présidents of France's Assemblée nationale, the meeting that sets the chamber's agenda, struck one bill from the sittings of Wednesday, October 7 and Friday, October 9. The official summary of the meeting says it in one line: "retrait du projet de loi, adopté par le Sénat, relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité."

That bill is France's transposition of NIS2, the EU directive (EU) 2022/2555 that sets cybersecurity obligations for "essential" and "important" entities in 18 sectors. Member States had until October 17, 2024 to transpose it. The summary gives no reason for the withdrawal. It files the change under the "semaines du Gouvernement", the weeks reserved for the Government's business.

The Conférence met again on October 13 and did not put the bill back. As I write, on October 19, it has no new date. The next Conférence meets on October 20.

I am CTO of a LegalTech built on Claude, and I built BidForge, an AI that reads French public tender files for small businesses. So I read this bill from two seats: a software publisher, and a builder whose users sell to the regions, departments and larger towns the bill names. Here is what the agenda change does not say.

Two years, in dates

The Government filed the bill in the Senate on October 15, 2024, two days before the transposition deadline, under the fast-track procedure. The Senate adopted it on March 12, 2025 and sent it to the Assemblée the next day. There, a special committee received 505 amendments on the Senate's text and adopted its own version on September 10, 2025.

Then nothing reached the floor for a year. On September 22, 2026, the Conférence des présidents scheduled the bill for October 7, with the rest of the debate on October 9. Two weeks later, it was gone.

Brussels kept its own calendar. The European Commission sent France a letter of formal notice on November 28, 2024 and a reasoned opinion on May 7, 2025. On July 8, 2026, it referred France, Spain, Ireland and the Netherlands to the Court of Justice of the EU for failing to notify full transposition. "While most complied," the release says, these four have not. The Commission asked the Court to impose "a lump sum and daily penalties until notification of complete transposition."

One more detail makes the target move. On January 20, 2026, the Commission proposed targeted amendments to NIS2 itself, to give "greater legal clarity." France is late on a directive that is already being revised.

And the floor is busy. The calendar the Conférence set on September 29 puts the second part of the 2027 budget bill on the floor from October 27 to November 16, with a solemn vote on November 17.

What the text on hold says

The text the Assemblée was due to debate is the special committee's version of September 10, 2025. A few lines matter to anyone who builds or buys software.

Scope by size. A company in a "highly critical" sector is an essential entity if it employs at least 250 people, or if its annual turnover exceeds 50 million euros and its balance sheet exceeds 43 million euros. A company in a highly critical or critical sector becomes an important entity at 50 employees, or with turnover and balance sheet each above 10 million euros. The committee report cites the bill's impact study: 15,000 entities in scope.

Fines. Up to 10 million euros or 2% of the previous year's worldwide turnover for essential entities, and 7 million euros or 1.4% for important ones, whichever is higher, "proportionné à la gravité du manquement". The arithmetic is simple: both percentages meet their fixed amounts at 500 million euros of turnover. Below that, the ceiling is the fixed amount. For a publisher with 2 million euros of revenue, 2% would be 40,000 euros, but the cap is 10 million.

Incident clock. After becoming aware of a significant incident, an entity sends ANSSI, the national cybersecurity agency, an initial notification within 24 hours, an intermediate one within 72 hours, and a final report no later than a month after that. It also notifies the recipients of its services, "sans retard injustifié," when the incident affects them directly.

Suppliers. The risk measures must protect networks and information systems "y compris en cas de recours à la sous-traitance", including when work is subcontracted. ANSSI expects the entities in scope to be mostly mid-size and large companies, local authorities and administrations. That clause is how such a law can reach the small vendors who sell to them.

The line on software publishers

Article 8 lists the essential entities. In the Senate's version, line 6 read: "Les fournisseurs de services de système de noms de domaine," DNS service providers. In the Assemblée committee's version, it reads: "Les fournisseurs de services de système de noms de domaine et les éditeurs de logiciels." Software publishers.

The committee report says where it came from: an amendment by Véronique Riotton, adopted in committee, "incluant les entreprises éditrices de logiciels dans la liste des entités essentielles."

Read it next to line 1. Companies in highly critical sectors become essential at 250 employees or the turnover test. The software publishers' line, like the DNS line it was added to, carries no size threshold of its own.

It was not going to pass unchallenged. Among the amendments filed for the floor debate, six would strike "et les éditeurs de logiciels" outright. They come from Philippe Latombe, who chairs the special committee, from Éric Bothorel, its rapporteur général, from Horizons deputies Vincent Thiébaut and Marie-Agnès Poussier-Winsback, from Rassemblement National deputies led by Alexandre Sabatou, and from the Government. The Government's amendment, filed on Saturday, October 3, calls the line "une surtransposition manifeste de la directive NIS 2". It argues that the directive only covers part of the industry (cloud, managed service and managed security service providers), under the size thresholds of articles 8 and 9, and that the EU Cyber Resilience Act, which it says takes effect in 2027, covers the security of the products publishers sell. The Government has since withdrawn that amendment, but Bothorel's makes the same cut with the same argument and is still pending. The Rassemblement National also filed a fallback that would apply the size thresholds of line 1. And Véronique Riotton, whose amendment created the line, filed one to replace it with case-by-case designation by the Prime Minister.

So I would not conclude that every French software company will be an essential entity. The line has to survive those amendments, an agreement with the Senate, and the decrees that define sub-sectors and types of entities. But it is the text that was about to be debated. If you publish software in France, it is the line to watch.

What the delay changes, and what it does not

It changes the date. Until a law is promulgated and its decrees published, the obligations in this bill are not French law. ANSSI's NIS2 portal says it plainly: "La transposition de la directive NIS 2 en France est en cours."

It does not change the direction. The same portal invites future essential and important entities to start "dès à présent", and offers an online test to check whether an organization is in scope and a pre-registration service. ANSSI has also published a working version of its Référentiel Cyber France (ReCyF), the list of measures it recommends to meet the NIS2 objectives. ANSSI says it is meant to become "le socle de la réglementation cyber française" and may be adjusted to reflect the parliamentary debate.

The first two objectives in ReCyF are not exotic. List every activity and service, name an owner for each, and list the information systems behind them. Make the chief executive responsible for digital security. Nothing in them waits for a vote.

What I would do this month

Run ANSSI's eligibility test twice: once for your own company, once for your three largest customers. If they are in scope, the subcontracting clause will make you part of their compliance, and a customer preparing now does not need the vote to ask.

Write the 24-hour path. Who notices an incident, who decides it is significant, who writes to customers, and from which list. If you supply an entity in scope, its 24 hours start when it becomes aware of the incident, so I would want my own notification promise to a customer measured in hours, not days.

Map what you already do against the ReCyF working version, starting with the inventory and the named owner. Do not polish the wording: ANSSI says the text can still move. If you are a cloud, managed service or DNS provider, the committee text points you to EU Implementing Regulation 2024/2690 instead.

If you publish software, read article 8 of the committee text and the amendments filed on it, and check each Tuesday's Conférence des présidents summary on the Assemblée's site. That is where the bill will reappear.

Brussels has asked the Court to count France's delay in days. The bill, when it passes, will count yours in hours.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk