NIS 2, REC and DORA: France's Grace Period on Cyber Rules Ends

For nearly two years, the transposition of the NIS 2 and REC directives into French law, and the rollout of the DORA regulation, were treated as a technical file: a bill announced, then postponed, with a European deadline slipping month after month. That period is now ending, and organisations are being told they can no longer stall.

Heard by a special committee of the National Assembly, Anne Le Hénanff, the minister in charge of digital affairs, made a blunt point: the threat did not wait for lawmakers. Recent incidents hit strategic bodies including the ANTS and the DGFIP, showing that no structure is out of reach. The risk now extends to any organisation that relies on digital systems, from a rural municipality to an international group.

Governance, not just IT

Many organisations justified waiting by the lack of a final law. That argument has weakened: the European texts are published, the main obligations are identified, and France's cybersecurity agency ANSSI has released much of the reference material needed to prepare.

The central shift is that cybersecurity becomes a matter of governance, sitting alongside financial management, compliance and human resources among executives' direct responsibilities. Compliance will no longer mean showing that tools exist, such as an antivirus or a password policy. Organisations will have to prove they can identify and manage risks, detect and report incidents, and restore activity quickly after a crisis. Resilience becomes the key concept, and it takes time, method, documentation and regular exercises.

Local authorities and the workload

Parliamentary debates have echoed the concerns of local authorities, which often have limited budgets and scarce skills. Yet they hold sensitive data, provide essential services and can be the weak link in a wider ecosystem, which is why the EU widened the scope of covered entities.

With risk mapping, action plans, audits, evidence and incident notifications piling up, manual management quickly hits its limits. As with the GDPR, where the most mature organisations moved from spreadsheets to governance platforms, cybersecurity compliance is heading toward continuous, tooled oversight. Many administrations must also handle security accreditation under decree 2022-513, which adds documentary and methodological work.