NIS2: what France’s upcoming Resilience law may change in your supplier contracts

The bill on the resilience of critical infrastructure and the strengthening of cybersecurity was filed with the French Senate on 15 October 2024. The Senate adopted it on 12 March 2025. The special committee of the National Assembly (Assemblée nationale) adopted its version of the text on 10 September 2025.

The floor debate was then postponed several times. In particular, the text was removed from the agenda of 7 and 9 October 2026. The Assembly’s legislative file now shows a floor debate on Monday, 9 November 2026, with 398 amendments filed on the committee text.

Member States had to transpose NIS2 by 17 October 2024 at the latest. On 8 July 2026, the European Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition. It is seeking financial penalties: a lump sum and daily penalty payments.

This procedure targets the French State, not companies. It adds pressure on the timeline, without creating a direct obligation for a French company. The directive must be transposed to produce its general effects on companies. The exact scope of this principle is a question to put to your counsel.

The directive covers entities in the sectors listed in its Annexes I and II, 18 sectors according to the Commission, from the size of a medium-sized enterprise upward. A company with 100 to 500 employees may therefore fall within scope if its business belongs to one of these sectors. Exceptions to this threshold exist for certain types of entities.

The French National Cybersecurity Agency (ANSSI) distinguishes future essential entities from future important entities, based on criticality, size and turnover. It provides an online test to assess your situation. The result must still be checked against the final French text.

A company outside the scope is not necessarily unaffected. If it supplies an entity in scope, it may receive contractual requests from its customer. In that case, the commitment comes from the contract, not from a legal obligation of its own.

Article 21 requires States to ensure that entities take appropriate and proportionate risk management measures. The minimum list includes, under point (d), supply chain security, including security-related aspects of the relationships between the entity and its direct suppliers or service providers.

Paragraph 3 specifies what to consider for each direct supplier:

• its specific vulnerabilities;
• the overall quality of its products and cybersecurity practices;
• its secure development procedures;
• the results of coordinated risk assessments carried out at Union level, where applicable.

Recital 85 makes the link with the contract: entities should be encouraged to incorporate risk management measures into their agreements with their direct suppliers. This is an encouragement, not mandatory content. Other levels of the chain may be taken into account.

Article 23 also matters for the supplier relationship. The entity must send an early warning within 24 hours of becoming aware of a significant incident, then a notification within 72 hours. It sometimes depends on its service provider to obtain this information.

In the special committee’s text, Article 14 asks entities to protect their networks and information systems, “including where subcontracting is used” (y compris en cas de recours à la sous-traitance). A decree issued after review by the Council of State (décret en Conseil d’État) is to set the objectives and the conditions for drawing up a reference framework. These are provisions of a bill, and they may change.

Since 17 March 2026, ANSSI has made available the Référentiel Cyber France, or ReCyF. It presents it as a working document listing its recommended measures, corresponding to the framework mentioned in Article 14 of the bill. By default it is not mandatory, and it may be adjusted.

Some digital providers, such as cloud computing services or managed services, fall under a specific European implementing regulation, Regulation (EU) 2024/2690. The financial sector, for its part, has the DORA framework. A single contract can therefore raise several regimes.

Without waiting for the final text, a legal team can already know what its contracts say. This is an inventory, not compliance with a law that does not exist yet. The following topics derive from Article 21 and Article 23:

• Criticality: which direct suppliers have access to your systems or support an essential service?
• Security: does the contract describe specific measures, or only a general commitment?
• Incidents: is there a notification obligation, with what deadline and what contact?
• Oversight: can you request evidence or carry out an audit?
• Subcontracting: do you know who works behind your direct supplier?
• Continuity: what does the contract provide in the event of an interruption or exit?
• Timeline: when is the next termination notice period or auto-renewal date?

This last point has practical value. A renegotiation is easier to start before a renewal. The drafting and the level of requirements then depend on each situation and on your counsel.

Caution is needed with wording. A request for a certificate of “NIS2 compliance” can be hard to interpret as long as French law has not set the applicable requirements. A precise contractual commitment is easier to assess than a general reference.

Four elements may change the analysis: the Assembly vote and the rest of the procedure, the implementing decrees, the final version of ReCyF, and the targeted amendments to the directive proposed by the Commission on 20 January 2026.

The directive’s penalties have yet to be transposed. It provides for caps of at least €10 million or 2% of worldwide turnover for essential entities, and at least €7 million or 1.4% for important entities.

Docform does not establish your NIS2 compliance. It helps you build the inventory: supplier contracts are centralized with a counterparty directory, and reminders can be scheduled on end dates and notice dates. A secure questionnaire collects information from a supplier. The assistant compares a contract with your contract playbook and flags deviations, citing the source passage. The lawyer keeps the decision.