Loi Résilience (French Resilience Act)
French bill transposing, in a single text, the NIS2 Directive, the CER Directive on critical entity resilience and Directive (EU) 2022/2556, which accompanies DORA in the financial sector. Still before Parliament in September 2026.
The bill on the resilience of critical infrastructure and the strengthening of cybersecurity, known as the Loi Résilience, transposes into French law the NIS2 Directive (EU) 2022/2555, the CER Directive on the resilience of critical entities (EU) 2022/2557, and Directive (EU) 2022/2556, which accompanies the DORA Regulation for the financial sector. Presented to the Council of Ministers on October 15, 2024, passed by the Senate on March 11 and 12, 2025, and approved by the National Assembly's special committee on September 10, 2025, the text had still not been enacted in September 2026. Its floor debate in the National Assembly was announced for October 2026. The law gives ANSSI the supervisory, audit and enforcement powers provided for by NIS2, sets up the regime for essential and important entities, and spells out how incidents must be reported. For the insurance market, enactment marks the point at which NIS2 obligations become fully enforceable in France. Compliance moves from a recommendation to a legal requirement, a breach can be sanctioned and documented, and underwriting and policy terms follow from that.
Textbook case: before the Loi Résilience was enacted, a French retail group included a voluntary self-declaration clause in its NIS2 questionnaires. Once the law took effect, ANSSI notified the group that it was an important entity and set it a compliance deadline. Its cyber insurer acted right away. It required the compliance plan before renewal and stipulated that any breach documented by ANSSI would cut the indemnity by 30 percent for losses linked to the non-compliance.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.