In July 2026, Brussels referred the matter to the European courts over the failure to apply EU cybersecurity obligations.
The text comes as cyberattacks multiply in France and the country is falling behind in this area.
Delayed for two years after its examination in the Senate, the bill was put back on the parliamentary agenda as a result of this intensification of attacks.
Its cross-party nature should make its adoption easier.
The law is intended to transpose into French law the NIS 2 regulation, designed to ensure a high level of cybersecurity in all European countries.
It also incorporates the REC directive, which protects the continuity of essential services against physical and cyber threats, and the DORA regulation, applicable to the financial sector.
The number of regulated entities is set to rise from 1,500 to 15,000, a tenfold increase.
The entities concerned are administrations, local authorities and companies already subject to cybersecurity obligations.
These entities will be divided among 18 critical or highly critical sectors of activity, including energy, transport, banking, health and digital infrastructure.
They will have to put in place risk-management measures, including staff training, two-factor authentication and the encryption of sensitive data.
They will also be required to notify the National Cybersecurity Agency of France (Anssi) of all significant incidents.
In the event of non-compliance, fines could reach ten million euros or 2% of annual worldwide turnover. The text does not provide for additional funding.
The law is not presented as a means of putting an end to cyberattacks. It aims to encourage prevention and anticipation, with the idea of investing 1 euro today to avoid paying 100 euros in damages or penalties tomorrow.
Michel Séjean, a law professor specializing in cybersecurity, welcomes a break with the logic of avoiding being attacked at all costs.
The text now emphasizes organizations' ability to cope with attacks that cannot be ruled out by technical measures alone.
"Before 2022, when things went wrong, the IT staff were fired and executives absolved themselves by saying: It's technical, it's not my job. With this resilience approach, the challenge becomes continuing critical activity despite the attack,"Michel Séjean said.