NIS2 transposition in France (Network and Information Security 2) is still pending, even though the European directive should have entered into force under French law as early as 17 October 2024. For medical device manufacturers, this delay is not just a matter of legislative timing: it is holding back a cybersecurity framework that will directly affect them, as soon as they employ more than 50 people or generate more than €10 million in revenue. Taking stock of NIS2 transposition in France has therefore become a useful exercise for planning ahead, even before the text is finally adopted.
Why NIS2 Transposition in France Is Taking So Long
The French bill, which transposes the NIS2, CER (Critical Entities Resilience) and DORA (Digital Operational Resilience Act) directives into a single text, cleared a first hurdle in the Senate back in March 2025. But its examination by the National Assembly, originally planned for July 2026, still hasn’t taken place: it is now expected at the earliest during the parliamentary term, which has been pushed back to October 2026. The sticking point concerns a sensitive issue, the protection of end-to-end encryption, debated under Article 16 bis of the bill. A parliamentary mission led by MP Florent Boudié, extended beyond 18 July, is trying to find a compromise between safeguarding encryption and domestic security requirements. This political tension alone explains a large part of the delay affecting NIS2 transposition in France.
NIS2 Transposition in France Now Under Pressure From Brussels
This delay carries a diplomatic and potentially financial cost. On 8 July 2026, the European Commission referred France to the Court of Justice of the European Union, seeking daily penalty payments and a lump sum for failing to transpose the directive on time. France is not alone in this situation: Ireland, Spain and the Netherlands are also among the Member States targeted by this procedure. This formal notice from Brussels adds further pressure to the timeline for NIS2 transposition in France, without, however, guaranteeing a faster vote in Parliament.
What NIS2 Transposition in France Means for Medical Device Manufacturers
Once in force, the NIS2 directive will bring around 15,000 French entities within the scope of cyber regulation, compared with only a few hundred under the previous regime. Manufacturers of non-critical medical devices fall under the “Manufacturing” sector, while the most critical devices may fall under the “Health” sector, classed among the highly critical sectors. Depending on their size, they will be classified as an essential entity or an important entity, with risk management, incident notification and cyber governance obligations proportionate to that status. The penalties involved are far from symbolic: up to €10 million or 2% of worldwide turnover for an essential entity, €7 million or 1.4% for an important entity, with directors potentially held personally liable.
Preparing for NIS2 Transposition in France Ahead of Final Adoption
The political uncertainty surrounding NIS2 transposition in France should not be used as an excuse to wait and see. ANSSI (the Agence nationale de la sécurité des systèmes d’information, France’s national cybersecurity agency), designated as the sole competent authority for almost all sectors concerned, already published its ReCyF cybersecurity framework in March 2026 and offers, through the MonEspace NIS2 portal, a self-assessment test allowing each organisation to determine whether it will be affected, and in what capacity. For medical device manufacturers, starting now on a risk mapping exercise, formalising an incident notification procedure, and raising staff awareness of the expected requirements makes it possible to approach the text’s entry into force without last-minute rush, once the implementing decrees are published.
NIS2 Transposition in France: A Timeline Still Uncertain, a Deadline Not to Be Missed
At present, NIS2 transposition in France remains suspended on a parliamentary vote whose exact date is still not fixed, caught between the encryption debate and legal pressure from Brussels. But for medical device manufacturers, waiting for the final text before acting would be a strategic mistake: the compliance period, estimated at around three years from the publication of the technical frameworks, gets shorter with every month that passes without the text being adopted.
BluePharm closely follows regulatory developments in medical device cybersecurity and supports manufacturers in producing up-to-date scientific and regulatory content, helping them turn these deadlines into an advantage rather than a last-minute constraint.
