France’s NIS 2 Delay Is Not a Compliance Reprieve

A postponement is not a reprieve, and French organizations that read this week’s news as permission to wait are misreading their own exposure. The bill transposing the NIS 2 Directive into French law was scheduled for the National Assembly floor on October 7, 2026. The Assembly’s agenda-setting body pulled it the day before, with no new date attached.

It sounds like good news if you run security or compliance at a hospital group, a chemicals producer, a research institute, or a contract manufacturer that has never answered to a European cybersecurity regulator. It is not. Silicon.fr’s reporting on the bill describes a text that widens the regulated perimeter from 6 sectors to 18 and from roughly 500 entities to nearly 15,000. Whenever the vote happens, those organizations will be asked a question they cannot answer from memory.

The question is simple. Can you prove, on demand, that sensitive data moving in and out of your organization was controlled, logged, and reportable on the regulator’s clock? NIS 2 compliance is an evidence exercise as much as a security one, and evidence takes longer to assemble than any legislative calendar will give you. Kiteworks secure data exchange sits exactly in that gap, which is why this delay matters to the CISO and the Chief Compliance Officer more than the headline suggests.

Key Takeaways

1. The delay is not a reprieve.

The Assembly pulled the bill on October 6, 2026, but the EU transposition deadline passed in October 2024 and the European Commission is already asking a court to impose financial penalties on France.

2. The regulated perimeter is about to grow roughly thirtyfold.

The bill projects a move from about 500 regulated entities to nearly 15,000, across 18 sectors instead of 6.

3. The obligations are already knowable.

The directive itself sets a 24-hour early warning, a 72-hour incident notification, supply chain security duties, and fine ceilings of at least 10 million euros or 2 percent of worldwide turnover for essential entities.

4. Evidence, not tooling, is the bottleneck.

Fragmented logs across email, file sharing, and managed file transfer turn a 72-hour reporting clock into a manual forensics project.

5. Scope first, evidence second, waiting never.

CISOs and Chief Compliance Officers should confirm entity status, map sensitive data exchange with suppliers, and build an exportable evidence package before the French decrees are written.

What Happened to the French NIS 2 Bill This Week

The text is projet de loi number 1112, on the resilience of critical infrastructure and the strengthening of cybersecurity. It also carries the transposition of the critical entities resilience directive and the directive that accompanies DORA, so NIS 2 is one of three things riding on the same vehicle. The government filed it in the Senate on October 15, 2024, under the accelerated procedure. The Senate adopted it on March 12, 2025, by 181 votes to 134. A special committee of the Assembly then adopted its own version on September 10, 2025.

Then it waited. Leto’s legal briefing on the postponement records that on October 6 the Assembly’s conference of presidents removed the bill from the agenda for the sessions of October 7 and October 9. Officially, the calendar is crowded; the examination of a separate bill on sexual and sexist violence is running long. The rapporteur, Éric Bothorel, has said he hopes the text returns within two to three weeks. The next conference of presidents meets on October 13, and a withdrawn text does not regain its slot automatically.

Read that sequence again. A bill that cleared the Senate in March 2025 has now slipped twice at the Assembly stage, the first time to September 2026. Nobody serious expects the French government to abandon transposition. Everyone should expect the schedule to remain unpredictable.

One political detail deserves attention because it shows where the friction sits. The Senate added an article, numbered 16 bis, that would bar the state from requiring encryption providers to build in backdoors or hand over master keys. NOVRISK’s analysis of the withdrawal reports that a government amendment to delete it was filed on October 3, three days before the withdrawal, and notes that no public document links the two events. That is a debate about encryption policy, not about NIS 2 obligations. It tells you the delay has a political explanation, and political explanations expire.

The Scope Jump From 500 to Nearly 15,000 Entities

Here is the number that should reorder your priorities. Today, roughly 500 French entities fall under the earlier NIS regime. After it, the bill’s own explanatory memorandum projects nearly 15,000. That is roughly a thirtyfold expansion of the population that must demonstrate cybersecurity governance to a national authority.

The authority is ANSSI, France’s national cybersecurity agency. According to Silicon.fr, the commission report anticipates that ANSSI will supervise about 14,500 entities. The same coverage notes that the perimeter includes roughly 1,500 local authorities, among them communes of more than 30,000 inhabitants, along with central administrations, medium and large companies, and supply chain actors.

Two features of the design matter to private-sector readers. First, entities are sorted into essential and important categories, with obligations scaled to criticality. Second, the State, local authorities, and their administrative public bodies are exempt from the fines but not from the security and notification duties. If you work for a public body, the fine is not your risk; the audit finding is.

The sector list comes from the NIS 2 Directive itself, whose annexes reach well beyond the energy, transport, and banking operators that earlier rules covered. They name health care, digital infrastructure, chemicals, postal and courier services, research, and the manufacture of certain products, among others. A mid-sized medical device manufacturer, a regional laboratory network, a contract chemicals producer, and a managed hosting provider can all end up in scope without ever having filed a single cybersecurity report with a regulator.

Consider a hypothetical, labeled as such. A 600-person precision manufacturer in the Auvergne-Rhône-Alpes region supplies components to an aerospace prime and exchanges engineering files, supplier quality records, and employee data with eleven partners by email, SFTP, and a file-sharing service someone in operations adopted four years ago. Nobody at the company has ever been asked to show an auditor who sent what, to whom, under which policy. Under the new regime that question becomes routine. The manufacturer does not need new products on Monday. It needs to know what it would hand over on Tuesday.

Brussels Has Already Moved Past the Debate

The transposition deadline for NIS 2 was October 17, 2024. By the time the French Assembly returns to the text, France will be two years past it.

The EU does not treat that as a rounding error. On July 8, 2026, the European Commission announced it was referring Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify national transposition measures, and the submissions include a request for financial penalties. The Commission is seeking penalties that would run until full transposition is notified, so the postponement does not stop the meter. It keeps it running.

The comparison matters too, because the story that France is one of many laggards is wrong. The ECSO’s NIS 2 transposition tracker counts 23 of the 27 member states as having adopted a national law, though its count reflects primary legislation, not the stricter test the Commission applies. That puts France among the four countries the Commission took to court, not in a Europe that is half transposed. Companies with operations in Italy or Belgium are already living under national rules, and a French subsidiary that reports to a group CISO is already being asked about NIS 2 readiness by its own parent.

The practical consequence is a two-speed compliance posture. Your group is probably already measured against NIS 2 expectations. Your French entity is waiting for a statute. Those two positions cannot both survive the first customer questionnaire or the first cross-border audit.

Obligations Do Not Wait for the Statute to Be Final

French implementing decrees are not yet written, and, according to ANSSI as quoted by Silicon.fr, NIS 2 takes effect in France only once the law, decrees, and orders are all promulgated. No compliance date is public. That is the strongest argument for waiting, and it is weaker than it looks, because the directive tells you most of what the decrees will operationalize.

Start with accountability. Under the directive, the management body of an entity must approve cybersecurity risk-management measures and oversee their implementation, and its members can be held liable for infringements, a point the directive’s own text makes explicit. That sentence moves NIS 2 from an IT problem to a board problem, and it is why the Chief Compliance Officer and the General Counsel need to be in the room alongside the CISO.

Then the clock. The same directive requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. An organization that needs a week to work out which files left through which channel cannot meet that sequence. The incident response plan is not the weak point in most organizations. The data that feeds it is.

Next, supply chain security. The directive requires risk-management measures that address the security of relationships with direct suppliers and service providers. If your supply chain risk management program is a spreadsheet of vendors and a questionnaire, you have an inventory, not evidence of control. An assessor will ask how sensitive data moves between you and a supplier, who approved it, and where the record lives.

Finally, the penalties. Silicon.fr reports that the French text caps administrative fines at 10 million euros or 2 percent of worldwide annual turnover, which mirrors the directive’s minimum ceiling for essential entities. Important entities face a lower ceiling, at least 7 million euros or 1.4 percent. For a mid-market company, the fine is a ceiling you hope never to approach. The liability that arrives sooner is a failed audit, a corrective order, and a contract your largest customer will not renew until you fix it. The background on NIS 2 audit and enforcement shows how that sequence tends to unfold.

The Evidence Gap Behind Every Deadline

Most organizations do not fail compliance because they lack a control. They fail because they cannot prove the control operated.

That is the pattern in the survey data Kiteworks gathered from 225 security, IT, compliance, and risk leaders, fielded in the fourth quarter of 2025. In the Kiteworks 2026 Data Security and Compliance Risk: Annual Forecast Report, only 39 percent of respondents ran a unified approach to data exchange with enforcement. The other 61 percent operated partial, channel-specific, or minimal approaches, and the report ties that fragmentation directly to logs scattered across platforms, each with its own format and retention policy.

Think about what that means on a 72-hour clock. An incident occurs. The security team must determine what data was involved, who accessed it, and through which channel. The email logs are in one system, the managed file transfer logs in another, the file-sharing audit trail in a third, and the web form submissions nowhere obvious. Nobody failed at security. They failed at assembly. The same report found that one-third of respondents lack evidence-quality audit trails altogether.

Vendor surveys deserve skepticism, including ours. This one is a Kiteworks study with a modest sample, so treat it as directional. But the pattern it describes is the same one every Chief Compliance Officer recognizes, and the CCO frame is the useful one here. The logs exist. They are not evidence. An auditor does not want twelve exports and a verbal explanation. An auditor wants a coherent chain of custody that the organization can produce in days, because the regulator’s clock runs in days, and the evidence package usually takes weeks.

Call it the assembly gap. It is the distance between having logs and being able to prove what they show, and it is where a NIS 2 inquiry will be won or lost.

Where Sensitive Data Exchange Meets NIS 2

Narrow the lens to the workload the directive implicates most directly for the newly regulated, which is sensitive data leaving and entering the organization. Patient and research data in health care. Engineering drawings, formulations, and supplier records in manufacturing and chemicals. Personnel files in everything. Each of those flows crosses a boundary where the directive’s duties on access control, encryption, incident handling, and supply chain security converge.

The architectural premise worth considering is a single control plane for that exchange rather than a separate set of tools per channel. In the Kiteworks Control Plane, secure MFT, secure email, and secure file sharing share one policy engine and one consolidated audit log, so a question about a particular file produces one answer from one place. Audit logs are designed to be immutable, and log feeds can flow to a SIEM in real time, which matters when the 24-hour early warning clock is already ticking. The platform also carries ISO 27001, ISO 27017, and ISO 27018 certifications and SOC 2 Type II, which speak to the supplier-assurance questions your own customers will start asking.

Be precise about what that does and does not do. No software makes an organization NIS 2 compliant. Compliance is a determination about your governance, your risk management, and your reporting, made by a regulator. What a unified data exchange layer provides is the evidence side of the ledger, the part that is hardest to retrofit after an incident. That is also why regulators regulate data, not tools. ANSSI will not care which product you bought. It will care whether you can show who accessed what, when, and under whose authority.

For healthcare organizations, the overlap with GDPR and national health data rules makes that record even more valuable, because the same log serves the Data Protection Officer’s records and the CISO’s incident file. For manufacturing and chemicals, it addresses the supplier-facing half of the directive, where intellectual property and operational data travel to partners you do not control.

What to Do Before the Decrees Land

Waiting for the decrees is a reasonable decision about legal interpretation and a poor decision about preparation. Here is what a CISO and a Chief Compliance Officer can do now, in an order that fits an ordinary planning cycle.

Settle the scope question. Establish whether your entity, and each subsidiary, is likely to be essential, important, or out of scope, using the directive’s annexes and ANSSI’s published guidance as they appear. Do not assume that being small or unregulated before protects you. The perimeter is expanding roughly thirtyfold.

Assign a named owner. The directive makes the management body accountable, which leaves most organizations with an ambiguity they should resolve deliberately. In many organizations that ownership is split across the CIO, the CISO, and legal, and nobody has written down who holds which step. Write down who owns incident notification, who owns supplier assurance, and who signs off on the evidence.

Map sensitive data exchange. List every channel through which regulated or confidential data moves to suppliers, customers, and partners, including the shadow ones. For each channel, ask the assembly gap question. If an incident occurred in this channel tonight, how long would it take to produce a complete record of what moved, who touched it, and what policy applied?

Run the 24 and 72 hour drill. Do not test the written plan. Test the evidence. Pick a plausible incident, start a stopwatch, and see how long it takes to assemble the notification content. The first attempt will be humbling. Good. Better to learn that in October than mid-incident.

Plan the evidence package. Decide now what you would hand an assessor and in what form. Policies, access reviews, encryption posture, supplier assurance records, and a retrievable audit trail form the core. Use an internal NIS 2 gap analysis to find what is missing, and size the effort against realistic NIS 2 compliance costs, so the budget conversation happens before the deadline does.

None of this requires the Assembly. All of it will be required by whoever answers to ANSSI first.

To learn more about building audit-ready evidence for NIS 2 across email, file sharing, and managed file transfer, schedule a custom demo today.

Additional Resources

• Blog Post The Tug-of-War Over Your Data: How the CLOUD and SHIELD Acts Pit Security vs. Privacy
• Blog Post Secure Sensitive Data by Mapping DSPM to Your Compliance Goals
• Brief Top 3 FERPA Violations and How to Avoid Them
• Blog Post Executive Order 14117: Protecting Americans’ Bulk Sensitive Personal Data
• Blog Post Need NIS2 Compliance? Start With ISO 27001