A new bill aimed at strengthening France's critical infrastructure and cybersecurity is set to be debated in the National Assembly starting on Wednesday, October 7, 2026. This legislation is intended to implement three European Union directives—NIS2, DORA, and REC—into French law. These directives require member states to enhance their cybersecurity protections and ensure the resilience of essential services such as energy, water, and digital systems. France had fallen significantly behind the deadline, which was set for October 17, 2024, largely because the National Assembly was dissolved on June 9, 2024, shifting the focus of the legislation to the Senate.
In early 2025, the bill moved to the Senate, where it encountered a major obstacle. A political divide emerged over Article 16 bis, a clause introduced by the Senate. According to the High Commission for Digital and Postal Affairs (CSNP), this article was meant to protect encryption services from being forced to include technologies that could weaken digital security, such as master decryption keys. The text was eventually approved in a special committee in September 2025 but remained stalled afterward.
The CSNP had hoped for a review of the bill in July 2026 if an extraordinary session of the National Assembly was called. However, this did not occur. Now, the bill is finally on track to be considered in a regular legislative session, beginning on October 7, 2026. This comes more than two years after the government launched an accelerated procedure for the bill on October 15, 2024. Although the timeline has been delayed, the bill is now progressing as intended.
Article 16 bis, which prohibits the imposition of security-weakening measures on encryption service providers, is expected to spark renewed debate. The clause has drawn attention due to its implications for digital privacy, cybersecurity, and the balance between national security and individual rights. As the bill moves forward, lawmakers will need to address these complex issues while ensuring compliance with European regulations.
French Bill on Cybersecurity and Critical Infrastructure Resilience Set for October 7, 2026 Debate
AI-rewritten from original reportingHow it works
cybersecuritynisaencryptionfrancelegislationnis2
Original sources:
- 🇫🇷Next



