FranceProjet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2)
Article 14, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (mesures de gestion des risques)
Before the second chamber, dated , as of .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
Where it has got to
The text described here is Texte adopté n° 78 (2024-2025), adopted by the Sénat in first reading, , published .
Locally, this stage is special committee review (commission spéciale) at the Assemblée nationale, concluded , before debate in public session (séance publique).
The stage above is recorded at www.assemblee-nationale.fr.
The Assemblée nationale's special committee (commission spéciale) deposited its text, n° 1779-A0, on ; where that text differs from the Sénat's first-reading text for the provisions described here, the summary and the requirements say so.
On the Assemblée nationale's conference of presidents withdrew the bill from the sittings of 7 and , and as of the Assemblée nationale's dossier lists no sitting in séance publique (floor session), no second reading and no promulgation.
What it requires
- As drafted, it would reach you where you are an essential or important entity under the bill's own designation articles (Articles 8 to 10), and Article 11 names a provider of an online marketplace, an online search engine or a social-networking-services platform among the digital providers it reaches by establishment, transposing NIS2 Article 21; the wider sector, critical-infrastructure and public-administration classes it also reaches are reached too, by declaring that you are an essential or important entity.
- In the text the Sénat adopted, take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or services: have your management body approve and oversee the security measures and receive cybersecurity training, protect your networks and systems including where you use a subcontractor, put in place tools and procedures to defend your networks and handle incidents, and ensure the resilience of your activities.NIST CSF 2.0ID.RA-06NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- In the text the Assemblée nationale's special committee deposited (n° 1779-A0), the choice of those measures must also take account of their capacity to be audited, the transparency of their operation, their interoperability, their resilience and the control they give over your information systems, so as to minimize technological dependence on third-party providers that give insufficient guarantees of compliance with the cybersecurity and digital sovereignty requirements set by the national strategy, and the fourth objective covers the resilience of your activities, networks and information systems.NIST CSF 2.0GV.SC-06
- In that committee text, where you are an essential or important entity that provides DNS, domain-name registry, cloud computing, data-centre, content-delivery, managed or managed security services, an online marketplace, an online search engine, a social-networking platform or a trust service, implement the technical and methodological requirements set by Commission Implementing Regulation (EU) 2024/2690 of , and you may rely on qualified service providers during an inspection to show your compliance with some or all of the objectives.NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text. Also read by: Agence nationale de la sécurité des systèmes d'information (ANSSI) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.SC-06Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 37 of the text the Sénat adopted frames the penalty as an amende administrative (administrative fine) imposed by the sanctions commission; no provision of that text makes the infringement itself a criminal offence.
Penalty structure
Article 37.I.1° of the text the Sénat adopted in first reading sets the maximum administrative fine for an essential entity's infringement at the greater of EUR 10,000,000 or 2 percent of worldwide annual turnover, and 37.I.2° sets an important entity's maximum at the greater of EUR 7,000,000 or 1.4 percent, mirroring NIS2 Article 34(4) and (5). Article 37.I also excludes the State's administrations and administrative public bodies, local authorities, their groupings and their administrative public bodies from the fine.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Agence nationale de la sécurité des systèmes d'information (ANSSI), as the national network and information system security authority, which would notify a controlled entity of the grievances found against it and refer the matter to the commission des sanctions (sanctions commission) that Code de la défense Article L. 1332-15 establishes.
Settledness
- As of
- Guidance link
- https://cyber.gouv.fr/
- Guidance body
- Agence nationale de la sécurité des systèmes d'information (ANSSI)
- Open questions
- Will the Assemblée nationale put the bill back on the agenda of its public sittings after its conference of presidents withdrew it on from the sittings of 7 and , and will the floor text, and any second Sénat reading, preserve the Article 14, Article 17 and Article 37 provisions of the special committee's text (n° 1779-A0)?
What this law does
Article 14 of the text the Sénat adopted in first reading would require an essential entity, an important entity, and a list of named public bodies to take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems they use for their activities or services, covering management-body approval and cybersecurity training, protection of networks and systems (including where a subcontractor is used), incident-handling tools and procedures, and the resilience of activities, transposing NIS2 Article 21.
Articles 8 to 10 designate the essential and important entities this reaches by sector and size, and Article 11 names a provider of an online marketplace, an online search engine or a social-networking-services platform beside DNS, cloud-computing and data-centre providers among the digital providers it reaches by establishment.
The instrument the corpus previously carried as France's NIS2 transposition, loi n° 2025-391 du 30 avril 2025, is a different, unrelated European Union law adaptation act that does not mention cybersecurity or the NIS directives; this bill, not that loi, is the actual transposition vehicle. It passed the Sénat in first reading on and had its special committee (commission spéciale) review at the Assemblée nationale conclude on .
On the Assemblée nationale's conference of presidents withdrew the bill from the sittings of 7 and . As of the Assemblée nationale's dossier ends with the special committee's text and lists no sitting in séance publique (floor session).
In the text that special committee deposited on (n° 1779-A0), Article 14 would keep the four objectives but would add that the choice of measures must take account of their capacity to be audited, the transparency of their operation, their interoperability, their resilience and the control they give over information systems, so as to minimize technological dependence on third-party providers that give insufficient guarantees of compliance with the cybersecurity and digital sovereignty requirements set by the national strategy.
In that committee text the fourth objective would be to ensure the resilience of activities, networks and information systems, not of activities alone. That committee text would also bring within Article 14 legal persons that carry on activities requiring authorization under Code de la défense Article L. 1333-2 and are for that reason excluded in whole or in part from the status of essential or important entity, for those activities alone.
It would also require essential or important entities that are DNS, domain-name registry, cloud computing, data-centre, content-delivery, managed-service or managed-security-service providers, online marketplaces, online search engines, social-networking platforms or trust-service providers to implement the technical and methodological requirements set by Commission Implementing Regulation (EU) 2024/2690.
Under that committee text the persons covered could rely on qualified service providers during an inspection to show their compliance with some or all of the objectives, on conditions a decree of the Conseil d'État would set. Article 37 of that committee text would keep the same ceilings for the administrative fine, up to EUR 10,000,000 or 2 percent of worldwide annual turnover for an essential entity and up to EUR 7,000,000 or 1.4 percent for an important entity, whichever is higher.
It would extend each of those two tiers to legal persons that carry on activities requiring authorization under Code de la défense Article L. 1333-2 and are excluded in whole or in part from that entity status for those activities alone.
When LexLint raises it
When your app profile says your app operates a social platform or runs an essential service.
Back to the example · Lint your app
Page updated .