NIS2: the state will demand of directors the seriousness it spares itself

On Wednesday 4 November, the French National Assembly rejected the first part of the 2027 finance bill, the part covering revenue. That vote opened the slot the NIS2 transposition text had been waiting for since September 2025. The conference of presidents had agreed in principle to schedule it from Monday 9 November, on almost a single condition: that members reject that first part of the budget and free up chamber time. The ministry for relations with parliament and the rapporteur Éric Bothorel had confirmed it to AFP. The budget fell, the text entered the agenda.

The cybersecurity of fifteen thousand French organisations is therefore being debated as an afterthought, in the time the budget left free, with the end-of-year 2026 finance bill waiting its turn in the same week. The directive talks about leadership and director responsibility. I find it hard to see how a business owner would take seriously a law that those who govern us scheduled by default. At least it will be talked about all week, which remains good news.

A cybersecurity text slipped into a gap in the budget calendar

The NIS2 directive was published in the Official Journal of the European Union on 27 December 2022, and member states had until 17 October 2024 to write it into their law. The government tabled its bill in the Senate on 15 October 2024, two days before the deadline, under the accelerated procedure, the one that shortens the shuttle between the two chambers. The Senate adopted it on 12 March 2025, the Assembly's special committee in September 2025, unanimously. The text then waited for chamber time for more than a year.

Brussels, meanwhile, lost patience. After a letter of formal notice on 28 November 2024 and a reasoned opinion on 7 May 2025, the European Commission referred France to the Court of Justice of the Union on 8 July 2026, demanding a lump sum and daily penalty payments until full transposition. On 6 October, the conference of presidents again pulled the text from the sittings of 7 and 9 October, because the examination of the bill on sexist and sexual violence was overrunning the timetable.

Each delay had its justification: the dissolution of June 2024, a caretaker government, a saturated agenda, a quarrel over encryption. Taken one at a time, those reasons hold up. Put end to end over two years, they describe an order of priority in which the country's digital security comes after everything that can bring down a government.

The quarrel over encryption explains part of the deadlock, and it has just been resolved. Article 16 bis, added in the Senate, prohibits requiring encryption service providers, messaging apps included, to build in backdoors, those hidden accesses that would let a state service read protected communications. The DGSI wanted it removed. On 1 October, before the special committee, Anne Le Hénanff, the minister for artificial intelligence and digital affairs, called it a legislative rider, a provision unrelated to the subject of the text, and the executive announced it would support its removal. The debate on backdoors remains entirely open and will be fought elsewhere. The government, at least, is now backing its own bill.

What is NIS2, and who is actually covered?

NIS2 is a European directive, a text setting objectives each state must translate into national law. It succeeds a first directive from 2016 that covered only a few hundred operators in France. The new version changes scale: eighteen sectors, companies from fifty employees or ten million euros of turnover, part of the public administration. ANSSI, the French national cybersecurity agency, will go from 500 to 700 regulated organisations to more than 15,000. It has 670 full-time equivalents, where its German counterpart fields between 1,800 and 2,000.

For the reader who runs nothing, the list of sectors speaks for itself. It covers the hospital where they are treated, the water from their tap, electricity, trains and airports, post and parcels, food processing, medicine manufacturers, online service providers. It also covers their town hall if the municipality exceeds 30,000 inhabitants, their department, their region and their metropolitan authority, which the committee text classifies among essential entities, the most closely supervised category. According to ANSSI estimates reported by the Senate, around 2,000 private companies and 1,489 local authorities, groupings and bodies under their supervision will fall into that category.

The entities covered will have to apply ten families of measures, listed in Article 21 of the directive: risk analysis and security policy, incident handling, business continuity with backups and crisis management, supplier security, security in the purchase and maintenance of systems, assessment of the effectiveness of measures, cyber hygiene and training, cryptography, access control, and multifactor authentication, which requires a second piece of proof on top of the password. They will have to register with ANSSI and notify it of significant incidents. The agency will be able to inspect and sanction them, up to 10 million euros or 2 % of worldwide turnover for an essential entity, 7 million or 1.4 % for an important entity. The same text transposes the directive on the resilience of critical entities and provisions linked to DORA, the European regulation on digital resilience in the financial sector, hence its name, the Resilience bill.

I consider the figure of 15,000 well below reality. Every entity will have to manage the security of its suppliers, and the requirements will cascade down by contract onto thousands of subcontractors, service providers and software vendors who will appear in no ANSSI register but will receive their clients' questionnaires.

The measures existed before the law, the sanctions will come after it

None of those ten families of measures needed a vote in order to be applied. ANSSI has published its cyber hygiene guide since 2017, the ISO 27001 standard has existed since 2005, and on 17 March 2026 the agency put online its framework for NIS2, the ReCyF, which I have criticised and which at least has the merit of saying what it will come to inspect. On 1 October, its director general, Vincent Strubel, told the special committee that the measures in that framework would have been effective against the majority of data thefts recorded in France in recent months.

He said something else, which the debates on the calendar almost erased. For lack of a settled rule, companies and local authorities pushed their cybersecurity budgets back to the following year, which he described as a crowding-out effect. The head of the agency responsible for the country's digital security therefore told members of parliament that the state's indecision had held back security investment. Two years of prevarication had a price, paid in budgets rolled from one year to the next.

What the vote changes amounts to little: the obligation to register, the obligation to notify, and the possibility of a sanction. Vincent Strubel indicated that ANSSI envisaged full compliance for all entities by the end of 2028, with the first inspections designed as educational rehearsals before the move to sanctions. The security of systems never waited for this vote. The law adds a sanction to it, and above all somebody to carry it.

Article 20, or the duty of care of directors

What is at stake in this law sits in an article most commentary skims over. Article 20 of the directive requires management bodies, board, executive management, managing partner, to approve risk management measures, to oversee their implementation and to follow training, and it provides that they may be held liable for failures. For essential entities, Article 32 goes further. When the measures imposed by the authority have no effect, it can request that a director operating at the level of executive management or legal representation be temporarily banned from holding management office.

Anglo-Saxon lawyers call this a duty of care: the director must be able to demonstrate that they took the reasonable precautions their role requires. NIS2 installs that duty in cybersecurity, with an authority to check it and a personal sanction at the end.

Seen from an executive committee, the arithmetic is quick. By the end of 2028, ANSSI will hold a gun to the heads of the directors of essential entities, with a ready-made argument for using it: the directive has been published since 2022, the framework since 2026, and you approved nothing. How the French text will write that personal responsibility, and on what conditions it will allow a ban from office, is being decided this week. In committee, amendments were already seeking to tighten those conditions.

I argued here last month that Parliament has never been your CISO and that a director's responsibility existed before the law, the law merely attaching a sanction to it. I take none of it back. A responsibility recalled only through threat nonetheless produces what threat always produces: signed policies, registers, committee minutes, a file presentable on inspection day. I call that phenomenon the illusion of compliance, and I have seen it in the organisations that waited for the law before moving. A duty of care becomes a culture when those who demand it practise it themselves.

The state that will demand this seriousness spares itself

On that ground, the example from above points the other way. Article 37 of the committee text excludes state administrations, local authorities, their groupings and their administrative public bodies from administrative fines. The 1,489 local authorities and bodies classified as essential entities will have to apply the same measures as companies, without facing the same sanction. The mid-sized IT provider maintaining a department's systems can be fined, and the department imposing NIS2 requirements on it by contract risks nothing.

The directive allows that choice, its Article 34 leaving each state to decide whether fines apply to its public administration. Data protection law had already opened the way: the French data protection act forbids the CNIL from issuing a fine where the processing is carried out by the state, and since September the CNIL has been inspecting the tax authority after the summer's intrusions without being able to fine it. The bill takes up that logic and extends it to local authorities.

The Conseil d'État had nonetheless given warning. In its opinion of 6 June 2024 on the bill, it wrote that the exemption of local authorities « cannot be allowed », their exclusion from the scope of sanctions disregarding both the principle of equality and the objectives of the directive. The government kept it, the Senate too, the Assembly committee too. On 1 October, the minister summed up the doctrine before members: « The state cannot financially sanction the state ». She added that the government preferred to clarify responsibilities and was considering other forms of sanction, without naming any.

The accounting argument is understandable, since a fine paid by the state to the treasury moves money from one pocket to another. It leaves the question of responsibility entirely open. Several of the most serious data breaches in France in recent years have had a public address, from France Travail in 2024 to the tax authority this summer, and the director general of ANSSI himself acknowledged before the committee that the state's digital estate had become too complex, which complicates securing it. The executive has set itself the goal of devoting 5 % of ministries' digital budgets to cybersecurity in 2027, then 10 % in 2030. Nobody can be sanctioned if the target is missed.

The business owner who will be asked, by the end of 2028, for proof of their duty of care will have before them a state that took two years to schedule the text, that brought it into the chamber through the budget door, and that exempted itself from the sanction. They will draw the simplest conclusion: cybersecurity is a constraint you impose on other people. The law exists precisely to prevent that conclusion.

Would NIS2 have changed anything for Arkéa?

This week's news provides a textbook case. On the evening of 4 November, Crédit Mutuel Arkéa acknowledged a cyberattack: around 100 million euros siphoned from the bank's own account, no customer account affected, by attackers who came through the platform of a provider whose name has not been made public. Part of the funds was frozen. The independent investigator ZachXBT, who had flagged suspicious withdrawals as early as 1 November, puts the theft at 133 million dollars and states that the absence of public communication allowed more than 30 million dollars to be laundered. Both figures come from his investigation, and the bank has not confirmed the exact amount.

NIS2 would have changed nothing. Banks do appear among the directive's sectors, but its Article 4 gives way to equivalent sector-specific European texts, and for finance that text is called DORA, applicable since 17 January 2025. DORA is in fact far more demanding than NIS2 towards suppliers: a register of all IT contracts, mandatory contractual clauses on audit, incident notification and reversibility, exit strategies, and direct supervision by European authorities of technology providers deemed critical. NIS2 devotes one line among its ten families of measures to the supply chain.

For the provider, the answer depends on what it is. If it is a mid-sized or large IT service provider, NIS2 would have subjected it to obligations of its own under ANSSI's supervision, on top of the clauses the bank must impose on it under DORA. As long as its identity remains unknown, the hypothesis goes no further.

Arkéa is above all a reminder that no law prevents a robbery. Laws designate who answers for it. DORA already provides, in its Article 5, that the management body of a financial entity bears ultimate responsibility for managing ICT risk. The duty of care that NIS2 wants to install in 15,000 organisations has therefore existed in banks for nearly two years, and the way supervisors handle this case will tell us soon enough whether it has teeth.

What to watch between now and Friday

The debates are due to run until 13 November, excluding the public holiday on the 11th, and several points can still move before the vote.

The removal of Article 16 bis comes first. If the Assembly votes it as the executive wishes, the main political obstacle falls, and nothing will justify another delay to the text.

Article 37 deserves the same attention. Members tried in committee to create a sanction mechanism for local authorities, relying on the Conseil d'État opinion. If the exemption survives the chamber, it will have been owned by a vote, and everyone will know who wanted it.

The drafting of director responsibility will say how far the law goes: on what conditions a temporary ban from office can be requested, against whom, and after what steps. It is the provision executive committees will read first, and they will be right to.

That leaves the calendar. The Conseil d'État noted in 2024 that the bill provided neither transitional provisions nor deferred entry into force. The end-of-2028 horizon was announced by the director general of ANSSI before members. Whether it appears in the law or remains at the regulator's discretion makes a great deal of difference to a director, who gains from being able to point to a date rather than an intention.

After the vote, the text will go to a joint committee, seven members and seven senators tasked with reconciling the two versions, then wait for its implementing decrees.

On 17 October 2024, France was due to have transposed NIS2. On 9 November 2026, the text enters the chamber because the budget left it. By the end of 2028, ANSSI will ask directors for proof of their seriousness, and the state will remain exempt from fines.

Further reading

• Parliament has never been your CISO
• ReCyF, backdoors and USB sticks: France in cybersecurity, between clarity and anachronism
• France's tax authority knew in late June. You found out on 13 August
• Cybersecurity must not become an election issue
• Free: the fine is being argued at the Conseil d'État, the phishing carries on
• The practical steps, without the jargon, on etrecyber.fr

Sources

• French National Assembly, Rejet, en première lecture, du projet de loi de finances pour 2027, 4 November 2026; legislative file of the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, special committee text no. 1779 of 10 September 2025, Articles 8, 9 and 37, and amendments tabled in committee on Article 37.
• Projet Arcadie, NIS 2 en hémicycle en cas de rejet du budget, November 2026, for the conditional scheduling confirmed to AFP by the ministry for relations with parliament and Éric Bothorel; Leto, NIS 2 : le projet de loi Résilience revient à l'Assemblée nationale le 9 novembre, after Silicon.fr of 5 November 2026; La Gazette des communes, Les rendez-vous parlementaires de la semaine du 9 novembre 2026.
• Alliancy, Fiona Slous, « Numérique pourri, cyber impossible », derrière NIS2, le procès de la dette IT française, 7 October 2026, report on the hearings of 1 October 2026 of Vincent Strubel and Anne Le Hénanff before the special committee.
• Conseil d'État, opinion on the bill on the resilience of activities of vital importance, the protection of critical infrastructure, cybersecurity and digital operational resilience in the financial sector, general assembly of 6 June 2024, no. 408329.
• French Senate, special committee report no. 393 (2024-2025) on the bill, for the ANSSI estimates on essential entities.
• European Commission, referral of Ireland, Spain, France and the Netherlands to the Court of Justice of the Union for failure to transpose, statement of 8 July 2026 (letter of formal notice 28 November 2024, reasoned opinion 7 May 2025).
• Directive (EU) 2022/2555 of 14 December 2022, known as NIS2, OJEU L 333 of 27 December 2022, Articles 4, 20, 21, 32 and 34; Regulation (EU) 2022/2554, known as DORA, Articles 5 and 28 to 44, applicable since 17 January 2025.
• French Act no. 78-17 of 6 January 1978 on information technology, data files and civil liberties, Article 20; Leto, Piratage du fisc : la CNIL va contrôler la DGFiP, sans pouvoir lui infliger d'amende, September 2026.
• Crédit Mutuel Arkéa, statement and FAQ of 4 November 2026, reported by JeChange, Crédit Mutuel Arkéa piraté, 5 November 2026, and Presse-citron; posts by ZachXBT from 1 to 4 November 2026, reported by The Block and Cointribune.