The short version. France's NIS2 transposition bill, the Loi Résilience, is on the Assemblée nationale agenda from 9 November 2026. It is not law yet, so NIS2 obligations do not yet apply in France. ANSSI's ReCyF already describes the security objectives, and most of the OT work takes several quarters, so sites can start on that basis now.
Where the bill stands
The Senate adopted the bill on 12 March 2025. A special committee of the Assemblée adopted its version on 10 September 2025. The floor debate set for 7 October 2026 was withdrawn from the agenda because the parliamentary calendar was full. Silicon.fr reports that the bill is back on the agenda from 9 November, with discussions planned until 13 November.
A vote would not put NIS2 in force on its own. ANSSI says NIS2 applies in France once the law, its decrees and its orders are all published. No date is set for that.
What you can already work from
ANSSI published the Référentiel Cyber France (ReCyF) on 17 March 2026. It sets 15 security objectives for important entities and 20 for essential entities. It is a working version, and it gives a site a concrete base to plan against.
Four things an OT site can start now
1. Inventory the machines. List the PLCs, HMIs, RTUs and SCADA servers. A passive inventory built from network traffic does not disturb the controllers.
2. List every access path. Include the VPN, the jump server, the vendor's cellular router and any forgotten modem. Article 21 covers supply chain security, so vendor access counts.
3. Add MFA in front of old equipment. A PLC has no user accounts, so the check has to sit on the path to it. Our guide compares five ways to add MFA to legacy OT equipment.
4. Separate OT from IT. Recital 89 of the directive names network segmentation among cyber hygiene practices. IEC 62443 zones and conduits are the usual way to structure it.
Where Access Gate fits
Access Gate is one appliance per site, connected beside the network, with nothing installed on the machines. It covers the network part of these measures. Your team still writes the risk analysis and policies, and still handles incident notification and vendor contracts. See how it maps to Article 21 for OT and SCADA networks.