Government & Regulatory Affairs in France

Full guide · Source-checked research97% of statements checked against a source143 checked against an official source4 checked against a secondary sourceChecked 2026-10-19Not yet professionally reviewed

• Before choosing a legal form and registering, a business must complete any preliminary steps its activity requires, such as obtaining an authorisation for a regulated activity.

  Which activities are regulated depends on the sector; the official guide lists this as step 3 of company creation.Service Public Entreprendre (DILA, Prime Minister's Office) · checked 2026-10-18

• For a regulated activity, the company registration file must include the relevant authorisation, diploma or licence.

  Service Public Entreprendre (DILA, Prime Minister's Office) · checked 2026-10-18

• A company convicted of failing to file beneficial ownership information can face additional penalties including dissolution or exclusion from public contracts.

  In addition to the fine of up to 1,000,000 euros applicable since 28 May 2026.Service Public Entreprendre (DILA, Prime Minister's Office) · checked 2026-10-18

• France has not yet enacted its NIS 2 transposition law: ANSSI refers to the national implementing text as the draft 'projet de loi Résilience' and asks future essential and important entities to begin securing their systems now.

  The EU transposition deadline was 17 October 2024. Status as at 18 October 2026.Agence nationale de la sécurité des systèmes d'information (ANSSI) · checked 2026-10-18

• The NIS 2 transposition bill (projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité) has passed the Senate at first reading and been adopted by the National Assembly committee at first reading; no later stage is shown.

  The same bill also transposes the DORA directive and the critical entities resilience (CER) directive.Sénat · checked 2026-10-18

• Every host of personal health data must hold a certificate of conformity (HDS certification) under articles L.1111-8 and R.1111-10 of the Public Health Code, and the revised HDS certification referential notified to the EU in 2023 adds a requirement to store health data within the EEA.

  Applies to providers hosting personal health data on behalf of others (for example cloud and SaaS providers to healthcare actors).European Commission, Technical Regulation Information System (TRIS) · checked 2026-10-18

• Foreign investments in sensitive sectors require prior authorisation from the Minister for the Economy under article L.151-3 of the Monetary and Financial Code, and authorisation is needed only if the investor, the type of transaction and the target's activity all meet the criteria.

  Sensitive activities cover national defence, public order and security, and activities essential to the country's interests, as listed in article R.151-3. Handled by the Direction générale du Trésor.Direction générale du Trésor · checked 2026-10-18

• Screened transactions are acquiring control of a French entity, acquiring all or part of a branch of activity of a French entity, and, for investors from outside the EU and EEA only, crossing 25% of voting rights in a French entity or 10% of voting rights in a French company listed on a regulated market.

  Every person and entity in the investor's chain of control counts as an investor, including French nationals not tax-resident in France and French entities controlled by foreign persons (article R.151-1).Direction générale du Trésor · checked 2026-10-18

Read the full guide: Licensing, procurement and incentives · Data protection, cybersecurity and digital filing · Deals, merger control, investment screening and restructuring