Regulatory updates - France

On August 14, 2026, the French Ministry of Economy and Finance confirmed in a press release, that certain DGFiP information systems had been accessed without authorisation during June and July 2026 using compromised credentials belonging to a DGFiP employee and an authorised third party. The incident was publicly claimed on August 12 and 13, prompting further investigation. 

Investigations subsequently established that information concerning 678,000 individuals and professionals had been consulted and extracted. The affected data included, for individuals, reference taxable income, family quotient and withholding-tax rates; for businesses, company names and SIREN identifiers. Certain cadastral information, including property addresses and surface areas, was also accessed. 

Scope and security response 

The DGFiP’s official FAQ confirms that individual and professional Finances publiques online accounts were not compromised, and that taxpayer usernames and passwords were not taken. DGFiP also notified CNIL and implemented additional security measures, including preventive restrictions on access to sensitive information systems. 

The incident has not been identified by the French authorities as a compromise of the electronic invoicing platform or approved-platform network. From a compliance and security perspective, however, it highlights the importance of credential protection, access monitoring, privileged-access controls and third-party access governance across digital tax infrastructures. 

The investigation remains ongoing, with affected individuals and professionals being contacted directly by DGFiP. 

Decree No. 2026-677 and Order of July 27, 2026, largely pertain to governance, accreditation, interoperability, and platform mobility details. The texts formally retire the Portail Public de Facturation (PPF) as an invoice exchange route, transitioning to a fully PA-centric system built around a central directory, the annuaire central, for invoice routing, data collection, directory maintenance, and mediating disputes.  

The formal agreement is now statutory, creating a regulated process for taxpayers to be claimed by their respective PA, as well as creating a process for portability – which is switching from one PA to another. The agreement can cover multiple entities within a group and must identify the taxpayer, company registration details, the departing and incoming platforms, the effective date, affected addresses, and the legal representative's signature.  

Plateformes Agréées (PAs) face a heavier compliance load, with ongoing obligations rather than a one-time accreditation event. Platforms must obtain and maintain ISO/IEC 27001 certification from a body accredited under EC Regulation 765/2008 and recognized by the IAF or GAC. Annual audits covering at least one month of recent operational activity and mandatory disclosure of substantial changes between audits reinforce this ongoing-monitoring model.  

Furthermore, the AFNOR XP Z12-012/013/014 standards move from technical reference to legal requirements that platforms must meet and be able to demonstrate. 

France has set new VAT exemption and simplified regime thresholds for 2026. For goods, on-site sales and accommodation, the limits are 85,000 and 93,500 euros. For other services, they are 37,500 and 41,250 euros.

The rule works in two steps. Crossing the standard threshold makes VAT due from the following January 1, as long as the business stays below the increased threshold. Crossing the increased threshold makes VAT due immediately.

Beyond the thresholds, a bigger legal shift is underway; VAT rules are being recodified. From September 1, 2026, VAT rules move from the CGI to a new code, the CIBS. Old CGI references can still be used, with a grace period until December 31, 2027.

The same date brings a separate change: France's e-invoicing mandate begins. From then on, all businesses must be able to receive electronic invoices, and larger companies must issue them too.