France lags behind on NIS2 directive

France has not yet implemented the NIS2 directive, which was meant to be fully transposed by October 17, 2024. The country has been delaying the process, with the relevant bill being discussed in the National Assembly but later removed from the agenda without a new deadline.

Resilience bill faces repeated delays

The Resilience bill, which aims to strengthen cybersecurity and critical infrastructure, has faced multiple delays. Disagreements over specific provisions, such as those related to encrypted messaging, have contributed to the setbacks. The European Commission has also taken legal action against France, along with Ireland, Spain, and the Netherlands, for failing to comply with the directive.

ANSSI struggles with implementation

The French National Agency for the Security of Information Systems (ANSSI) is tasked with overseeing a large increase in entities, from a few hundred to around 15,000, across 18 sectors. The mandatory registration of these entities has been postponed, with only a pre-registration window expected to open in the autumn of 2025.

France trails its European neighbors

Compared to its European neighbors, France is significantly behind in implementing the NIS2 directive. Germany has already enforced the requirement, with around 17,700 entities registered, while Italy has set a clear deadline for its first group of entities. France, however, continues to delay, despite ongoing cyber threats.

Supply chain remains a key vulnerability

The supply chain is a central focus of the NIS2 directive, requiring entities to manage the security of their supply chains. However, the directive places the responsibility on the client rather than the supplier, leaving vulnerabilities unaddressed. A recent ransomware attack on Harvest SA, which used a compromised virtual machine from a service provider, highlights this risk.

Data breaches fuel future attacks

Data theft from suppliers is not just a one-time incident. Stolen data can be used to plan future cyberattacks. At a recent cybersecurity summit, Vincent Strubel of the ANSSI noted that basic security flaws remain widespread despite a year of major data leaks. General Patrick Touak warned that such data is being used to target high-value individuals, including those in the cryptocurrency sector, with potential physical consequences.

Cyberattacks target logistics and freight

A campaign documented by CERT-EU between September 2025 and February 2026 targeted logistics and freight organizations in Germany, France, Lithuania, and the United States. The attack involved stealing over 1,600 unique identifiers, disrupting operations, and using phishing and impersonation tactics to gain access to sensitive information.

Uneven implementation of training requirements

While NIS2 mandates basic cybersecurity training for employees and management, the implementation of these requirements has been inconsistent across countries. Germany has not explicitly included employee training in its transposition of the directive, while Italy has. France's approach is still incomplete, leaving many responsibilities undefined.