FRANCE Law and Practice Contributed by: Jérôme Philippe, Laéna Bouafy, Thomas Retière and Annabelle Hamelin, Freshfields
cybersecurity certification (the “Cybersecurity Act”; CSA). • Directive (EU) 2016/1148 of the European Parlia - ment and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (the “NIS Directive”), as repealed by Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (the “NIS2 Directive”; NIS2). • Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological require - ments of cybersecurity risk-management measures and further specification (the “NIS2 Implementing Regulation”). • Regulation (EU) 2022/2554 of the European Parlia - ment and of the Council of 14 December 2022 on digital operational resilience for the financial sector (DORA). • Regulation (EU) 2024/2847 of the European Parlia - ment and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (the “Cyber-Resilience Act”; CRA). • Directive (EU) 2022/2557 of the European Parlia - ment and of the Council of 14 December 2022 on the resilience of critical entities (the “CER Direc - tive”). • Regulation (EU) 2024/1689 of the European Parlia - ment and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (the “AI Act”). French Legislation • Law No 78-17 of 6 January 1978 relating to infor - mation technology, files and civil liberties (the French Data Protection Act, known as the Loi Informatique et Libertés FDPA). • Draft law on the resilience of critical infrastructure and the strengthening of cybersecurity (the “Draft Resilience Bill”); Text No 33 (2024–2025) submitted to the Senate on 15 October 2024; Text No 1112 adopted by the Senate under the fast-track proce - dure, and submitted to the National Assembly on 13 March 2025.
• Law No 2004-575 of 21 June 2004 on confidence in the digital economy (LCEN). • Law No 2022-309 of 3 March 2022 for the imple - mentation of a cybersecurity certification for digital platforms for the general public (the “Cyberscore Law”). • Law No 2023-703 of 1 August 2023, on military programming for the years 2024–2030 (the “Military Programming Law”; LPM). • Law No 2018-133 of 26 February 2018 (the “2018 Security Law”) on various provisions adapting to EU law in the field of security and its implementing acts, including: (a) Decree No 2018-384 of 23 May 2018, on the security of networks and information systems of essential service operators and digital ser - vice providers; (b) Order of 13 June 2018 establishing the pro - cedures for the declarations provided for in Articles 8, 11 and 20 of Decree No 2018-384 of 23 May 2018 on the security of networks and information systems of operators of essential services and digital service providers; and (c) Order of 14 September 2018, establishing the security rules and deadlines referred to in Article 10 of Decree No 2018-384 of 23 May 2018 on the security of networks and informa - tion systems of essential service operators and digital service providers. • Law No 2024-449 of 21 May 2024 on securing and regulating the digital space (the “SREN Law”). • The French Defence Code, Articles L.1332-1 to L.1332-7; Articles L. 2321-1 to L. 2323-6; Articles R. 2321-1 to R. 2323-12, Article R. 1332-1, Article R. 1332-4 and Articles R. 1332-41-1 to R. 1332-41- 23. • The French Postal and Electronic Communications Code, Article L. 32-3, Article L. 33-1, Article L. 33-14; Article D. 98-5 Section III; Articles R. 9-12-1 to R. 9-12-3. • The French Criminal Code, Articles 323-1 to 323-8; Articles 226-16 to 226-24. Non-Binding Standards To guide organisations in GDPR and data security compliance, the National Commission for Informa - tion Technology and Civil Liberties (CNIL), along with the European Data Protection Board (EDPB) regularly
122 CHAMBERS.COM
Powered by FlippingBook