Request a demo
Country guide

Rail cyber security regulations in France

France's rail cyber security landscape includes designated operators of vital importance and operators of essential services. NIS2 adds a European framework whose national implementation must be checked carefully. The relevant starting point is the operator's designation and the systems covered, rather than assuming that every rail supplier has identical duties.

Official sources checked

Who needs to consider these requirements?

A French railway project may involve an operator's regulated information systems, a supplier's maintenance platform and shared infrastructure. Identify which systems fall within the customer's regulated perimeter and which requirements are passed through the supply contract. Keep the operator's reporting obligations separate from the supplier's contractual escalation time.

Key regulations and frameworks

OIV and OSE security regimes

Existing national frameworks — designation matters

ANSSI distinguishes the military programming framework for operators of vital importance (OIV) from the NIS framework for operators of essential services (OSE). These regimes establish obligations for their respective regulated entities and systems. The correct route depends on designation and scope; a rail company's role in an important service alone is not sufficient to infer its full legal position.

Official source: OIV and OSE security regimes

NIS2 transposition and the Resilience Bill

National implementation — check enacted texts and application dates

ANSSI explains that French implementation requires a law, decrees and orders, and that entry into force is distinct from the date every requirement applies. The parliamentary materials located for this review describe the Resilience Bill. This guide therefore does not treat the EU transposition deadline as a blanket French compliance date: confirm the latest national texts and ANSSI instructions for the entity concerned.

Official source: NIS2 transposition and the Resilience Bill

Practical steps for rail teams

Use these engineering and project-planning actions to prepare evidence for the requirements that apply to your organisation.

  1. Ask the operator to confirm its OIV/OSE status, regulated system boundaries and the authority responsible for the project. Keep restricted designation information out of public documentation.
  2. Map supplier access and data exchanges across onboard, depot and control-centre systems. Agree which party authorises access and retains the evidence needed by the operator.
  3. Track the French implementation texts alongside the engineering programme. Build an evidence register that can accommodate changed requirements without treating an uncommenced proposal as law.

Using this guide

This is an introduction to selected frameworks, not a complete legal assessment. Applicability depends on your organisation, systems and contracts. Check the linked official texts and obtain advice for your project before relying on a requirement or deadline.