Introduction
On October 6, 2026, France's National Assembly conference of presidents once again pulled the critical infrastructure resilience bill from its legislative agenda. The bill was designed to transpose three EU directives into French law: NIS2, DORA, and the Critical Entities Resilience (CER) Directive. No new date has been set. Rapporteur Éric Bothorel floated a return to the floor "within 15 days or three weeks" — a phrase that has become almost ritualistic with each successive delay.
Behind this latest slip lies an uncomfortable set of facts. France was required to transpose NIS2 by October 17, 2024. That deadline is now two years in the rearview mirror, the European Court of Justice opened infringement proceedings on July 8, 2026, and roughly 15,000 French organizations are left navigating in the dark.
A Legislative Timeline in Pieces
This is not the bill's first stumble. The dissolution of the National Assembly in June 2024 derailed an initial attempt. The legislation then cleared the Senate in early 2025 and was adopted in special committee in September 2025 — only to stall again on the floor of the full chamber, where it has sat ever since.
The parliamentary calendar is not the only culprit. A deeper political fault line has paralyzed debate: Article 16 bis of the bill explicitly prohibits the integration of technical mechanisms that deliberately weaken the security of systems — in plain terms, backdoors in encryption tools. This provision runs directly into resistance from intelligence services seeking to preserve access to encrypted communications. France's Commission supérieure du numérique et des postes had already flagged this as a structurally divisive political issue, and so it remains.
The Real Cost
The European Commission did not sit on its hands. After issuing a formal notice in November 2024 and a reasoned opinion in May 2025, it referred France to the Court of Justice of the European Union on July 8, 2026 — along with Spain, Ireland, and the Netherlands. The sanctions sought combine a lump-sum penalty with daily fines running until France notifies full transposition.
For French organizations, the consequences are more immediate and far less publicized. NIS2 covers more than 15,000 entities: any organization with more than 50 employees or €10 million in annual turnover operating in one of the 18 targeted critical sectors. These entities are classified into two tiers — essential and important — each carrying graduated obligations around cyber governance, risk management, incident reporting, and supply chain security.
Without a national law in place, these organizations find themselves in an uncomfortable legal grey zone. The directive's guiding principles have been publicly available for months, but the precise national implementation rules, exact thresholds, compliance timelines, and the conditions under which ANSSI will exercise supervisory authority all remain suspended in uncertainty.
Waiting Is Not a Strategy
Legislative delay does not pause the cyber risks that NIS2 was designed to address. Organizations that chose to wait for the national text before launching their compliance assessment have already lost two years of lead time. Those that moved early — mapping their critical systems, strengthening incident governance, auditing key suppliers — will be positioned to adapt quickly the moment the law is enacted.
For CIOs and CISOs, the message is straightforward: the European framework exists, and the directive's obligations are publicly accessible. Structuring a compliance programme around the directive's text — with room to adjust once national transposition introduces its specifics — is a far more defensible position than suspending all effort while waiting for the National Assembly to act.
The CJEU proceedings are bad news for France as a state. It would be a further mistake to treat them as a convenient excuse to keep waiting.