France: Despite the Absence of a Government, the NIS2 Bill Moves Forward

France is already a year behind in implementing the European Union’s requirements.

A Commission at Work Amid Political Uncertainty

The special commission tasked with examining the “Resilience” bill—designed to transpose the European Union’s NIS2 directive into French law—began its work as scheduled on September 9, 2025, for a three-day session. The government of François Bayrou, which had resigned that same morning, had in fact introduced the bill.

Commission president Philippe Latombe (MoDem) cited a note from the General Secretariat of the Government (SGG) outlining the conditions under which a caretaker government may continue handling current affairs. The note specifies that “the deadline for transposing a directive” can “justify legislative activity.”

“The commission will therefore be able to carry out useful work even in the absence of a government, while ensuring that the executive may, when the time comes, amend the text as a whole,” the deputy added.

A Directive Long Overdue

Adopted in 2022, the NIS2 directive establishes minimum cybersecurity requirements for around 15,000 organizations deemed sensitive in France. Member states had until October 18, 2024, to transpose it into national law.