Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification
Loi n° 2018-133 du 26 février 2018, Titre Ier, art. 7 et 13
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 10 May 2018.
A vulnerability and incident reporting rule binding public and private bodies.
As of 12 September 2026.
What it requires
- This binds a fournisseur de service numérique (digital service provider) operating an online marketplace, an online search engine or a cloud computing service above the fifty-employee, EUR 10 million turnover threshold, and an opérateur de services essentiels the Premier ministre designates by sector; the operator-of-essential-services sector and designation class is not separately flagged here, for the reason given on this jurisdiction's companion security-requirements row.
- Declare to ANSSI, without delay after becoming aware of it, an incident affecting the networks and information systems necessary to provide your service, where the incident has or is likely to have a significant impact on the continuity of the service (an operator of essential services) or on the provision of the service in the European Union (a digital service provider).
- Expect the administrative authority, after consulting you, to be able to inform the public of the incident, or, for a digital service provider, to require you to do so yourself, where that information is necessary to prevent or address an incident or is justified by a public-interest reason.
- Where the incident has a significant impact on essential services you provide in another EU Member State, expect the authority to inform that State's own competent authorities or bodies.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 9 (operator of essential services) and Article 15 (digital service provider) each punish a director's own failure to satisfy the incident-declaration duty as a criminal fine («est puni de ... d'amende») rather than an administrative penalty on the entity; unlike the security-measures offence, no prior formal notice (mise en demeure) is a precondition for this one.
Penalty structure
Article 9 punishes a director of a designated operator of essential services who fails to satisfy the Article 7(I) incident-declaration duty by a fine of EUR 75,000. Article 15 punishes the equivalent failure by a director of a digital service provider, under Article 13, by a fine of EUR 50,000. These are personal criminal fines on a director, not a turnover-based penalty on the entity.
- Rule
- Fixed only
- As of
- 12 September 2026
- Currency
- EUR
- Fixed cap
- 75,000
Who enforces it
Enforcement body
The Premier ministre (Prime Minister), acting through the Agence nationale de la sécurité des systèmes d'information (ANSSI), the national network and information system security authority under Code de la défense Article L. 2321-1, which the implementing décret names as the authority conducting or commissioning the compliance controls.
Settledness
- As of
- 12 September 2026
- Guidance link
- https://cyber.gouv.fr/
- Guidance body
- Agence nationale de la sécurité des systèmes d'information (ANSSI)
What it reaches
Obligation class
Reporting, Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 7 requires an opérateur de services essentiels to declare, without delay after becoming aware of it, to ANSSI (the national network and information system security authority under Code de la défense Article L. 2321-1) an incident affecting the networks and information systems necessary to provide its essential services, where the incident has or is likely to have a significant impact on the continuity of those services; the administrative authority may inform the public of the incident after consulting the operator.
Article 13 imposes the equivalent duty on a digital service provider for an incident with a significant impact on the provision of its services in the European Union, and lets the authority require the provider to inform the public itself. Neither article states a fixed reporting clock in hours; the duty runs «sans délai» (without delay) from the operator's or provider's own knowledge of the incident.
When LexLint raises it
operates_social_platform
Read the law
Journal officiel de la République française n°0048 du 27 février 2018, Loi n° 2018-133