ITER/FRFrance
What the record establishes for France: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Commission Nationale de l'Informatique et des Libertés reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The competent national authority, which is the Agence nationale de la sécurité des systèmes d'information reported | https://messervices.cyber.gouv.fr/nis2checked 2026-09-11 MonEspaceNIS2, the Agency's own space for regulated entities. The address its help site links to, monespacenis2.cyber.gouv.fr, forwarded on 11 September 2026 to the Agency's services portal, and the portal is what is recorded. | anssi nis2 declaration |
| Financial supervisorDORA, article 19 | Autorité de contrôle prudentiel et de résolution reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Autorité des Marchés Financiers (AMF) reported | — | esma mar nca |
Transposition of NIS2 reported
| Act | Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité. A bill, not a law |
|---|---|
| In force | Not in force. The Agency's own note, updated 19 September 2025, records the Senate's adoption on 12 March 2025 and the vote of the Assemblée nationale's special committee on 10 September 2025, and states that the bill has not been promulgated |
| Recipient | The competent national authority, which is the Agence nationale de la sécurité des systèmes d'information |
| Moves a term | No. None found on the first stage. The declaration is due «sans retard injustifié ou dans les 24 heures après avoir eu connaissance de l'incident important», which is the Directive's own anchor. The later stages are not stated on the page read, so nothing is recorded about them |
| Standing | The terms are read in the Agency's operational guidance for regulated entities, not in a transposing act, because there is none: the Agency states that «NIS 2 rentrera donc en vigueur en France dès lors que l'ensemble des textes de transposition (loi, décrets, arrêtés) auront été promulgués». Whether the recipient is the Agency as competent authority or a separately designated CSIRT is not settled here |
| Source | anssi nis2 declaration · anssi nis2 avancement |
An event in France
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.