Cybersecurity · France
Cybersecurity law & regulation in France (2026)
France shaded by its cybersecurity status
Cybersecurity in France: comprehensive law.
FrameworkLayered regime: NIS1 (transposed via Loi n° 2018-133), Loi de Programmation Militaire (LPM) 2013 for Operators of Vital Importance (OIV), EU DORA (directly applicable since 17 Jan 2025), GDPR breach-notification, and sectoral rules — all supervised by ANSSI (national cybersecurity authority) with CNIL for personal-data breaches and ACPR for the financial sector. A NIS2 transposition bill (Loi relative à la résilience des infrastructures critiques et au renforcement de la cybersécurité) is pending in Parliament.
France operates a comprehensive, multi-layered cybersecurity regime built around ANSSI as the national authority, the 2013 Military Programming Law (LPM) that imposes hardened obligations on ~250 Operators of Vital Importance, the NIS1 transposition covering essential-service operators and digital service providers, and directly-applicable EU regulations (DORA for finance, GDPR for personal data). NIS2 transposition is delayed — the Senate adopted the 'Resilience' bill in March 2025 and the National Assembly special committee in September 2025, but the law has not yet been promulgated and the European Commission has opened an infringement procedure. Pending final adoption, ANSSI has opened the MonEspaceNIS2 pre-registration portal and continues to enforce the in-force NIS1/LPM regime with staged 24h / 72h / 1-month incident-reporting duties expected under NIS2.
NIS2 & cybersecurity law in France
In France, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.
- Framework
- the NIS2 Directive (EU) 2022/2555, transposed into national law
- Approach
- cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities
- Applies to
- medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration
- Incident reporting
- an early warning within 24 hours and a full notification within 72 hours to the national CSIRT
- Maximum fine
- up to €10 million or 2% of global annual turnover for essential entities
- Oversight
- the national competent authority and CSIRT designated under NIS2
NIS2 is a directive, so France implements it through national law; exact scope and deadlines can vary slightly by transposition.
NIS2 in France: FAQ
Yes. As an EU member, France has transposed the NIS2 Directive (EU) 2022/2555 into national law, covering essential and important entities in critical sectors.
Medium and large organisations in sectors such as energy, transport, banking, health, water, digital infrastructure and public administration.
An early warning within 24 hours of becoming aware and a fuller incident notification within 72 hours to the national CSIRT.
Up to €10 million or 2% of global annual turnover for essential entities, with lower ceilings for important entities.
Key points
The Agence nationale de la sécurité des systèmes d'information (ANSSI), operating under the Prime Minister, is France's national competent authority for cybersecurity — issuing rules for OIVs and essential-service operators, receiving incident notifications, running certification schemes and acting as CSIRT.
The 2013 Loi de Programmation Militaire (Law n° 2013-1168) imposes on ~250 Operators of Vital Importance across 12 critical sectors mandatory security rules set by the Prime Minister, use of ANSSI-qualified detection tools and mandatory incident reporting; the LPM 2024-2030 extends and aligns these obligations with EU frameworks.
The 'Résilience des infrastructures critiques et renforcement de la cybersécurité' bill (transposing NIS2, CER/REC and DORA) was adopted by the Senate on 12 March 2025 and by the National Assembly special committee on 10 September 2025, but has not been enacted; France missed the 17 October 2024 EU deadline and the European Commission opened an infringement procedure in November 2024.
Once transposed, NIS2 will move France from ~500 regulated entities under NIS1 to roughly 15,000 essential and important entities across 18 sectors, with pre-registration already open via the ANSSI portal MonEspaceNIS2 (monespacenis2.cyber.gouv.fr).
Under NIS1/LPM, OIVs and OES must report significant incidents to ANSSI without undue delay; the pending NIS2 law codifies a three-stage timeline (early warning within 24h, full notification within 72h, final report within one month). Personal-data breaches must additionally be reported to CNIL within 72h under GDPR Art. 33 and to affected individuals under Art. 34 when high risk.
The EU Digital Operational Resilience Act (Regulation 2022/2554) applies directly in France since 17 January 2025; the Autorité de contrôle prudentiel et de résolution (ACPR, Banque de France) supervises ICT-risk management, third-party contracts and threat-led penetration testing, and has made intensified DORA follow-up one of the five pillars of its 2026 work programme.
The pending NIS2 law provides for administrative fines up to €10M or 2% of global turnover for essential entities and €7M or 1.4% for important entities. GDPR-linked cyber enforcement remains active: on 13 January 2026 the CNIL fined Free Mobile €27M and Free €15M (€42M combined) for security failings tied to a 2024 breach exposing 24.6 million contracts and 5.11 million IBANs.
Timeline - major decisions & events
CERT-FR's annual threat report logged 1,366 confirmed incidents and 128 ransomware attacks in 2025 (down from 141 in 2024) while flagging a sharp rise in data-exfiltration cases, shaping ANSSI's defensive priorities.
ANSSI / CERT-FR ↗Decision SAN-2026-003 penalised the national employment agency for failing to secure job-seeker data, after a 2024 breach exposed personal data of tens of millions of people, among France's largest GDPR security sanctions.
CNIL ↗The committee approved the bill transposing NIS2, the CER (REC) directive and DORA, restructuring France's framework around 'essential'/'important' entities and creating sanctions up to €10M or 2% of turnover, a key step toward enactment.
Assemblée nationale ↗The Commission escalated infringement proceedings after France missed the 17 October 2024 deadline to transpose the NIS2 Directive, pressuring Paris to finalise its Résilience legislation.
European Commission ↗The Senate passed, under accelerated procedure, the omnibus bill jointly transposing NIS2, REC and DORA, the legislative vehicle that will expand ANSSI's supervisory powers and the regulated sector scope.
Sénat ↗Attackers used social engineering against Cap Emploi accounts to access names, social-security numbers and contact data spanning 20 years of registrants, prompting CNIL and ANSSI involvement and France's largest personal-data breach.
CNIL ↗A LockBit-linked attack via a hijacked VPN account paralysed hospital systems; the hospital refused the $10M ransom and ~11GB of data was leaked, intensifying France's focus on healthcare cyber resilience and prompting ANSSI on-site support.
The Record (Recorded Future) ↗The data-protection authority penalised Google for lack of transparency and invalid consent for ad personalisation; upheld by the Conseil d'État in 2020, it set the tone for GDPR-driven security and consent enforcement in France.
CNIL ↗Extended cybersecurity obligations beyond critical operators to 'essential service operators' (OSE) and 'digital service providers' (FSN), requiring risk management and incident notification to ANSSI under decree n°2018-384.
Légifrance ↗Article 22 of Law n°2013-1168 created binding obligations for Operators of Vital Importance (OIV), incident reporting, security audits and detection requirements overseen by ANSSI, the foundation of France's critical-infrastructure cyber regime.
ANSSI ↗Established the Agence nationale de la sécurité des systèmes d'information under the SGDSN, replacing the DCSSI and giving France a dedicated national authority to defend information systems and supervise cybersecurity obligations.
Légifrance ↗France - other topics
Cybersecurity in other countries
Last verified 9/9/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →