Regulatory updates - France

On September 1, 2026, the French Minister of Public Action and Accounts issued a press release confirming that no penalties will be applied for e‑invoicing and e‑reporting non‑compliance during the remainder of 2026.

According to the Ministry, more than 66% of French companies have already joined the reform and selected an approved platform (PA). The government stated that its priority is to support businesses in adopting the new framework and completing their onboarding activities.

The press release also highlights cybersecurity as a key focus area for the French authorities. PA will be required to strengthen and demonstrate their cybersecurity capabilities through several measures, including:

• Submitting a cybersecurity progress report before the end of September 2026.
• Reporting cybersecurity incidents to the relevant authorities.
• Conducting penetration testing as part of enhanced security controls beginning in autumn 2026.

After many years of development and delays, the French e-invoicing mandate is officially launched. From September 1, 2026, large and medium-sized companies must issue electronic invoices via an approved platform (PA), comply with e-reporting obligations, and ensure that all companies can receive electronic invoices. Small and medium enterprises (SME) and micro-enterprises will be required to issue electronic invoices and comply with e-reporting obligations from September 1, 2027.

Additional guidance is available through:

• French General Directorate of Public Finances (DGFiP) website;
• Forum National de la Facture Électronique et des Marchés Publics Électroniques (FNFE-MPE) has published a practical three-part checklist.

On August 14, 2026, the French Ministry of Economy and Finance confirmed in a press release, that certain DGFiP information systems had been accessed without authorisation during June and July 2026 using compromised credentials belonging to a DGFiP employee and an authorised third party. The incident was publicly claimed on August 12 and 13, prompting further investigation. 

Investigations subsequently established that information concerning 678,000 individuals and professionals had been consulted and extracted. The affected data included, for individuals, reference taxable income, family quotient and withholding-tax rates; for businesses, company names and SIREN identifiers. Certain cadastral information, including property addresses and surface areas, was also accessed. 

Scope and security response 

The DGFiP’s official FAQ confirms that individual and professional Finances publiques online accounts were not compromised, and that taxpayer usernames and passwords were not taken. DGFiP also notified CNIL and implemented additional security measures, including preventive restrictions on access to sensitive information systems. 

The incident has not been identified by the French authorities as a compromise of the electronic invoicing platform or approved-platform network. From a compliance and security perspective, however, it highlights the importance of credential protection, access monitoring, privileged-access controls and third-party access governance across digital tax infrastructures. 

The investigation remains ongoing, with affected individuals and professionals being contacted directly by DGFiP.