NIS2 in 2026: France falls behind

February 2026. NIS2 is supposed to have been fully operational for more than a year across Europe. Yet in France, we are still waiting for the final parliamentary debates, with adoption hoped for in the first quarter and a compliance roadmap spread over three years. Meanwhile, the attackers follow no legislative calendar.

I regularly run workshops with French CISOs and IT directors: the weariness is palpable.
"We are waiting for the final text,"
"We will see when the implementing decrees come out,"
"In any case, ANSSI will add its own layer on top."

Nobody really wants to move forward. It is tedious, bureaucratic, and it blocks everything.

And yet, right next door, in Belgium, Ireland or Romania, things are moving. Fast and well.

Where does the transposition of NIS2 stand in France in 2026?

NIS2 was meant to be transposed before 17 October 2024. In early 2025, only six member states out of twenty-seven had done so, according to the European Commission. Most have since caught up, with more or less pragmatic approaches, and some have already launched their first inspections and registries of essential and important entities.

In France? The Resilience Act, which transposes in a single move NIS2, the REC directive on critical infrastructure and the DORA regulation, is still winding its way through the parliamentary maze. The Senate passed it at first reading on 12 March 2025, but its examination in the National Assembly has been pushed back to the September 2026 parliamentary session at the earliest, as the deputy minister for digital affairs announced in early July. The European trackers (ECSO, Eversheds Sutherland) regularly rank France among the laggards.

On 9 July 2026, the European Commission stepped things up: it referred France to the Court of Justice of the European Union, alongside Ireland, Spain and the Netherlands, for failure to transpose more than twenty months late, requesting financial penalties.

The result: legal uncertainty, fuzzy reporting, and around 15,000 French entities affected, exposed to penalties that can reach 10 million euros or 2% of worldwide turnover, putting off their cyber investments on the pretext of waiting for "the final version."

And this is where the mechanism turns perverse: the longer it drags on, the more inaction is justified.
We are not postponing for lack of budget or lack of resources. We are postponing while we wait for the framework. As if an attacker needed the official gazette to launch a piece of ransomware.

And security is never anything but a second-tier subject, something I already addressed in my open letter to the president.

Meanwhile, our neighbours are adopting simple, operational frameworks. The best example? The Belgian model CyberFundamentals (CyFun).

The Belgian field: when simplicity wins

At Cresco, where I work as Lead GRC, we supported nearly 40 companies through their NIS2 compliance in 2025 alone.

And the conclusion is clear and frankly alarming: THERE IS AN URGENT NEED TO LEGISLATE ON CYBERSECURITY TO FORCE ORGANISATIONS TO HARDEN THEMSELVES.

Because in the field, I have seen it all:

• I have seen companies with nine-figure revenue that were less secure than a windmill with a wooden door and no lock.
• I have seen firms of 200 employees with no formalisation whatsoever, not even an IT policy.
• I have seen IT teams full of goodwill, but a management that could not care less about security, because we keep treating the subject as a budget exercise: we will see next year, it is not a priority, there are other emergencies.

Can you picture them handling this the way they handle fire risk in a building?
No. Management would be out the door.
And yet, a cyber risk is a business risk.

This is exactly why CyFun is interesting. Not because Belgium is better, but because the framework is workable. It forces a simple discussion: target level, expected controls, evidence, trajectory.

Not an essay. A plan.

The CyberFundamentals (CyFun) framework, developed by the Centre for Cybersecurity Belgium (CCB), is no longer only Belgian: Ireland and Romania have formally adopted it and become co-owners, and other countries (Portugal, Croatia, and more) are watching it or adopting it in part. Why? Because it is pragmatic: three maturity levels (Basic, Important, Essential), clear controls, and a recognised certification that presumes NIS2 compliance until proven otherwise.

And above all: it kills organisations' favourite excuse, we do not know what to do.
Because the framework says what to do, in what order, and how to prove it.
Companies hate compliance, but they love being handed a simple framework. If it is clear, they sign.

CyFun is exactly that.

Concrete result: companies move forward. They invest in real resilience rather than endless paperwork.

Meanwhile, the threats are exploding

We are wasting an enormous amount of time on political and administrative childishness, while the personal data of French citizens is exposed as never before.

• Supply chain attacks rising steadily?
• Offensive AI industrialising phishing, self-evolving malware and automated reconnaissance.
• Data breaches one after another: every month brings its share of massive breaches, often at entities that should have been better protected under NIS2.

And what worries me most is not the intensity of the attacks. It is the habit.
The breach becomes background noise.
Ransomware becomes a business risk.
Phishing becomes an HR problem.

We are normalising the abnormal.

The WEF Global Cybersecurity Outlook 2026 once again puts geopolitical fragmentation at the top of the risk list: nearly two-thirds of organisations now factor the threat of geopolitically motivated attacks into their strategy, and 94% of leaders see artificial intelligence as the top disruptor of cybersecurity for the year. But in France, we prefer to debate the exact wording of a decree rather than strengthen operational resilience.

And this is the key point: administrative time is slow. Threat time is instant.
The gap between the two is where incidents take up residence.

CyberBat, PASSI: do these labels really protect you?

At the same time, we keep producing initiatives that create the illusion of action without creating any real value.

A perfect example: the CyberBat label, recently launched for the construction sector (electrical engineering, energy, and the like). Nice on paper, but what does it actually bring to the table against NIS2 or real threats? One more layer for project owners who want to tick a box?

Because that is the problem: we love labels when they let us dodge the hard work: inventory, segmentation, access management, patching, supplier requirements, crisis exercises, restore evidence, and so on.
A comfort label is never a substitute for a capacity to respond.

And what about the PASSI qualification? Indispensable for certain regulated audits, it has become a closed club that mainly serves the inner circle of incumbent providers. The market is locked up, costs are soaring, innovation struggles to get in, and tender documents call for PASSI auditors for no reason other than having been talked into it by Tom, Dick or Harry.

We congratulate ourselves on French certifications, but we forget the essential: effective cybersecurity is the kind that actually protects, not the kind that fills in files.

Should you wait for the law to get compliant?

Whatever the exact timeline of the Resilience Act, French companies can (and must) move forward right now:

1. Adopt a pragmatic framework such as ISO 27001, CyFun or NIST CSF: they are NIS2-compatible and already in use elsewhere in Europe.
2. Launch the inventory of your critical assets, suppliers and supply chain risks, without waiting for the official registry.
3. Train your teams and simulate incidents: resilience is built in the field, not in legal texts.
4. Demand transparency from providers: beyond the labels, ask for concrete evidence of effectiveness.
5. Push your peers and federations to call for a fast, lightweight transposition, not another bureaucratic monster.

And I will add one field point that everyone avoids:
6. Clarify decision-making in a crisis (who cuts what, who talks to whom, who signs off on shutting down production, who owns the notification).
Because on the day it hits, security does not always collapse for lack of a tool. It collapses for lack of a decision.

2026 must be the year we wake up

NIS2 is not one more constraint: it is an opportunity to finally strengthen European resilience. But in France, we still choose to drag our feet, to add complexity, to create gimmick labels while the attackers go on the offensive.

The data of French citizens, and of our companies, deserves better than political childishness. It is time to move forward like our neighbours: pragmatically, quickly.

Compliance does not protect. Execution does.
And execution is something we can start today.

---

Sources

• Referral to the Court of Justice of the European Union against France, Ireland, Spain and the Netherlands for failure to transpose NIS2, 9 July 2026: The Record.
• Postponement of the examination of the Resilience Act to the September 2026 parliamentary session: IT Social.
• Progress of the transposition of NIS2 in France, scope of around 15,000 entities and penalties: ANSSI, MonEspaceNIS2 and Legiscope.
• CyberFundamentals (CyFun) framework, three levels and adoption by Belgium, Ireland and Romania: Centre for Cybersecurity Belgium (CCB) and NCSC Ireland.
• Global Cybersecurity Outlook 2026, weight of geopolitics and AI: World Economic Forum.
• Cresco, support with NIS2 compliance: cresco.be.
• "Open letter to Emmanuel Macron on cybersecurity": christophemazzola.fr.