Until this Monday, the resilience bill had not been treated as a priority on the calendar, even as cyberattacks multiply year after year. Its inclusion on the National Assembly's agenda finally opens floor debate on a text adopted by the Senate several months ago and whose European deadline has already passed.
The bill on the resilience of critical infrastructure and the strengthening of cybersecurity returned to the National Assembly's agenda this week. The text, finally scheduled this Monday, is to be examined there in the coming days.
The bill notably transposes three directives adopted in 2022 within the European Union. One of them, the new version of the directive on the security of networks and information systems (NIS 2), aims to harmonize cybersecurity standards between public administrations and private companies across the 27 member states.
The text examined this week is not limited to the transposition of European standards. An Article 16 bis, intended to guarantee the inviolability of encrypted messaging services, was inserted in the Senate to respond to another parliamentary initiative from early 2025.
This return comes as cyberattacks multiply and the European transposition timetable has already been exceeded. France had obtained an additional two-year deadline to approve the text; that deadline expired on October 17. Recent events have given the debate a concrete dimension. On the night of October 11 to 12, several major retail chains, including Carrefour, Magasins U and Monoprix, were victims of a cyberattack targeting their refrigerators.
Adopted on first reading in the Senate on March 12, 2025, it was then supposed to return before the deputies. Its examination was postponed several times for lack of available parliamentary time.
The attack involved refrigeration controllers from the brands Danfoss and Dixemm. This equipment is installed at nearly 700 major retail sites.