France: the loi resilience was listed for 7 October 2026, then withdrawn

What changed

The legislative file of the Assemblee nationale for the loi resilience now carries a public sitting. Checked on 24 September 2026, the first-reading block of dossier DLR5L17N50731 reads: Discussion en seance publique, Mercredi 7 octobre 2026, on the committee text no. 1779.

That single line is the news, and it is worth being precise about why. The bill was adopted at first reading by the Senat on 12 March 2025. The special committee of the Assemblee nationale finished its examination on 10 September 2025. Nothing was recorded after that for more than a year. Two windows were floated in the meantime — July 2026, then the September rentree — and both passed without the bill reaching the floor. Neither ever appeared on the dossier. This one does.

Press reporting adds that the discussion is expected to continue on Friday 9 October. The dossier does not carry that, so treat the 7th as the fact and the 9th as reporting.

What did not change

France is still late, and nothing is owed under French law on 7 October. A sitting is not a vote. A vote is not a promulgation. And unless the Assemblee adopts the Senate text without a single amendment — which nobody expects of a text its own special committee has already rewritten — the bill goes back to the Senat under the navette before it can be promulgated at all.

Then there is the layer after that. The bill delegates most of its technical substance to implementing decrees and to ANSSI reference documents. So even on the day the law is promulgated, the obligations an entity has to meet will not all be readable in it. There is still no French article number to plan against, and there is still no date for one.

What the bill actually does

The loi resilience is one vehicle for three European texts, which is part of why it has taken so long. Its title names them: the resilience of activities of vital importance and the protection of critical infrastructure, which is the CER directive; cybersecurity, which is NIS2; and the digital operational resilience of the financial sector, which is DORA. For NIS2 it designates ANSSI as the national competent authority, and it is expected to bring roughly 15,000 entities into scope.

The Commission is not waiting

The transposition deadline in article 41 of NIS2 was 17 October 2024. The Commission opened an infringement procedure against France at the end of November 2024, and in its July 2026 infringement package it referred France to the Court of Justice of the European Union, asking the Court to impose a lump sum and daily penalty payments. Ireland, Spain and the Netherlands were referred in the same package. The Dutch law has since entered into force, on 15 August 2026; the Irish Bill has still not been published; the Spanish text is still not in the BOE.

Penalty payments of that kind fall on the member state, not on entities. They are not a reason for a French company to do anything. What they do tell you is the direction of the pressure on the calendar.

What a French entity should do

The same thing it should have been doing since 2024, with one addition: stop treating the French law as the trigger. Two arguments, and neither depends on the date of promulgation.

The first is that the measures do not change much. Article 21(2) of the directive lists ten measures, and the member states that have transposed have overwhelmingly carried them across in the same order and without adding an eleventh. Austria's section 32(4) is the clearest example: ten lettered points, a) to j), in the directive's order. An entity that plans against the directive is not planning against the wrong thing.

The second is that lateness is national, and scope is not. If you operate in Germany, Italy, Belgium or the Netherlands as well as in France, you owe the obligations there now, under their laws, whatever Paris does in October.

ANSSI has also been running pre-registration since November 2025, ahead of the law and independently of it, now on the NIS2 space of MesServicesCyber. Registering early costs nothing and fixes your entity classification.

What became of the sitting

It was withdrawn the day before it was due. The releve de conclusions of the conference des presidents of 6 October 2026 lists, among its modifications to the order of business, the retrait of the bill for Wednesday 7 October, afternoon and evening, and for Friday 9 October, morning, afternoon and evening.

The dossier followed: read on 7 October 2026, DLR5L17N50731 no longer shows the sitting, and its last recorded step is again the committee text no. 1779-A0 deposited on 10 September 2025. The bill is re-listed for no other date in that releve. The next conference des presidents is set for 13 October 2026, which is the next occasion on which a new listing could appear, not a date on which one will.

The paragraph above headed What did not change is the part of this post that aged well, and it is worth reading twice now. Nothing was owed under French law on 7 October, and nothing is owed today. The listing moved no legal date, so its withdrawal moved none either. What the episode did cost is the thing the listing was worth: a reason to believe the calendar.