French law jointly transposing the NIS2 Directive, the CER Directive on critical entity resilience and certain components of DORA, expected in 2026.
The bill on the resilience of critical infrastructure and the strengthening of cybersecurity, commonly referred to as the Loi Résilience, constitutes France's domestic transposition of the NIS2 Directive (EU) 2022/2555, the CER Directive on the resilience of critical entities (EU) 2022/2557, and certain provisions of the DORA Regulation concerning non-financial entities. Presented to the Council of Ministers on 15 October 2024, adopted by the Senate on 11 and 12 March 2025 and examined by the National Assembly in autumn 2025, the text was expected to be promulgated in the summer of 2026, with effective sanctions entering into force from 2027. The law confers on ANSSI the supervisory, audit and sanctioning powers provided for by NIS2, establishes the regime of essential and important entities, and specifies the procedures for incident notification. For the insurance market, the promulgation of the Loi Résilience marks the point from which NIS2 obligations become fully enforceable in France, transforming compliance from a recommendation into a legal requirement whose breach can be sanctioned and documented, with the consequent insurance implications for underwriting and policy terms.
Before the promulgation of the Loi Résilience, a French distribution group included a voluntary NIS2 declaratory clause in its questionnaires. Once the legislation entered into force, ANSSI notified the group of its status as an important entity and set it a compliance deadline. Its cyber insurer immediately drew consequences, requiring production of the compliance plan before policy renewal and stipulating that any breach documented by ANSSI would result in a 30 per cent reduction of indemnity for losses linked to non-compliance.
Loi relative à la résilience des infrastructures critiques, projet de loi résilience, Resilience Act France