France: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Reg. 2023/1114) as nationally implemented by Ordinance 2024-936 (15 Oct 2024) and Decree 2025-169 (21 Feb 2025), integrated into the French Monetary and Financial Code; supervised by the AMF (Autorité des marchés financiers) and the ACPR (Autorité de contrôle prudentiel et de résolution). The legacy PSAN/DASP regime created by the 2019 PACTE law remains transitional.

Crypto-assets are legal in France and regulated under the EU MiCA framework, which has applied in full since 30 December 2024 (with stablecoin Titles III/IV in force since 30 June 2024). The AMF authorises Crypto-Asset Service Providers (CASPs), while the ACPR supervises issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs). A national transitional period allowing pre-existing PSAN/DASP-registered providers to continue operating without a MiCA authorisation ends on 1 July 2026.

Framework: EU AI Act (Regulation (EU) 2024/1689), directly applicable in France; national implementation via the pending DDADUE bill (Feb 2026) designating CNIL, DGCCRF, ANSSI and sectoral regulators. Complemented by France's national AI strategy and INESIA (National Institute for AI Evaluation and Security).

As an EU Member State, France is governed by the EU AI Act, whose prohibited-practices provisions have applied since 2 February 2025 and whose high-risk obligations phase in through 2026–2027. France has not yet formally designated its national competent authorities in domestic law; a February 2026 DDADUE bill before Parliament will assign CNIL as lead supervisor with DGCCRF acting as the single point of contact under Article 70, alongside ANSSI, Arcom, ACPR and PEReN. France also runs an active national AI strategy and created INESIA in January 2025 to centralise AI evaluation and safety expertise.

Framework: EU General Data Protection Regulation (Regulation (EU) 2016/679) as implemented nationally by the French Data Protection Act (Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés, as amended by Law No. 2018-493 of 20 June 2018 and Ordinance No. 2018-1125 of 12 December 2018). The Commission Nationale de l'Informatique et des Libertés (CNIL) is the national supervisory authority.

France has a comprehensive personal-data protection regime based on the directly-applicable EU GDPR, complemented at national level by the historic Loi Informatique et Libertés (dating to 1978), which was substantially rewritten in 2018–2019 to align with GDPR and the Law-Enforcement Directive. The independent authority CNIL supervises, issues guidance, investigates breaches and imposes sanctions — €486.8 million in fines across 83 sanctions in 2025 alone, with cookies, employee surveillance and data security dominating enforcement. For 2026 the CNIL has designated cybersecurity and AI regulation (including its new role as market surveillance authority under the EU AI Act for AI systems processing personal data) as its two enforcement priorities.

Framework: French Monetary and Financial Code (Code monétaire et financier), transposing EU PSD2 (Directive 2015/2366) via Ordonnance n° 2017-1252 and the E-Money Directive 2 (2009/110/EC). The Autorité de contrôle prudentiel et de résolution (ACPR), attached to the Banque de France, is the sole competent authority for licensing and prudential supervision of credit institutions, payment institutions (PIs), electronic money institutions (EMIs) and account information service providers (AISPs).

France operates a full, mature licensing regime for digital payments and fintech. Payment institutions, e-money institutions and account information/payment initiation service providers are authorised and supervised by the ACPR under the Code monétaire et financier, which implements the EU PSD2/EMD2 framework, with the Banque de France advising on payment-system security. The country is actively applying the EU Instant Payments Regulation (2024/886) and, from 20 November 2026, will extend consumer-credit rules to BNPL/paiement fractionné products under a September 2025 ordinance transposing EU Directive 2023/2225.

Framework: France has no dedicated digital-nomad visa. Remote workers and relocators use existing long-stay routes issued by consulates via France-Visas (Ministry for Europe and Foreign Affairs) and prefectures (Ministry of the Interior): VLS-TS 'Visiteur', 'Passeport Talent' multi-year residence (CESEDA Art. L421-9 et seq.), and VLS-TS 'Entrepreneur / Profession libérale'.

France offers no dedicated digital-nomad visa and has not announced one, but multiple existing pathways cover remote workers and relocators. A June 2026 Interior Ministry clarification (JO written question 11730, 23 June 2026) confirmed that teleworking exclusively for a foreign employer with no French-market ties is compatible with the long-stay 'Visiteur' (VLS-TS) permit, effectively making it France's de facto remote-work route. Skilled hires, entrepreneurs and investors typically use the four-year 'Passeport Talent'.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065) as implemented by France's SREN Law (Loi n° 2024-449 of 21 May 2024 on securing and regulating the digital space), layered over the 2004 LCEN (Law for Trust in the Digital Economy, transposing Directive 2000/31/EC). ARCOM is the Digital Services Coordinator; CNIL and DGCCRF are co-competent authorities.

France has one of the EU's most developed online-safety regimes, combining the directly-applicable EU DSA with a national SREN law that adds French-specific rules on age verification for pornography, a cybersecurity anti-scam filter, online harassment (SARIN ban), and enforcement powers. Baseline platform liability follows the LCEN safe-harbour (notice-and-takedown), while ARCOM now supervises very-large platforms alongside CNIL (advertising/profiling) and DGCCRF (traders, transparency). In July 2026 Parliament also adopted a blanket ban on social-media use by under-15s, going beyond the DSA.

Framework: Layered regime: NIS1 (transposed via Loi n° 2018-133), Loi de Programmation Militaire (LPM) 2013 for Operators of Vital Importance (OIV), EU DORA (directly applicable since 17 Jan 2025), GDPR breach-notification, and sectoral rules — all supervised by ANSSI (national cybersecurity authority) with CNIL for personal-data breaches and ACPR for the financial sector. A NIS2 transposition bill (Loi relative à la résilience des infrastructures critiques et au renforcement de la cybersécurité) is pending in Parliament.

France operates a comprehensive, multi-layered cybersecurity regime built around ANSSI as the national authority, the 2013 Military Programming Law (LPM) that imposes hardened obligations on ~250 Operators of Vital Importance, the NIS1 transposition covering essential-service operators and digital service providers, and directly-applicable EU regulations (DORA for finance, GDPR for personal data). NIS2 transposition is delayed — the Senate adopted the 'Resilience' bill in March 2025 and the National Assembly special committee in September 2025, but the law has not yet been promulgated and the European Commission has opened an infringement procedure. Pending final adoption, ANSSI has opened the MonEspaceNIS2 pre-registration portal and continues to enforce the in-force NIS1/LPM regime with staged 24h / 72h / 1-month incident-reporting duties expected under NIS2.

Framework: Company formation is governed by the French Commercial Code (Code de commerce, notably Art. L. 223-1 et seq. for SARL and L. 227-1 et seq. for SAS); since 1 January 2023 all formalities are filed exclusively through the INPI 'guichet unique' (single online window) under Ordonnance 2020-115 and Décret 2021-300. Foreign-investment screening (IEF) is set out in Art. L. 151-3 of the Monetary and Financial Code; entry/stay for non-EU business creators is governed by the CESEDA 'Talent – porteur de projet' (former 'Passeport talent – création d'entreprise') regime.

France offers a fast, unified digital process for company formation with no minimum capital for SARL/SAS/SASU/EURL (as little as €1) and no restriction on 100% foreign ownership. A SIREN number is typically issued within 24–48 hours and a Kbis within 3–7 business days via the INPI guichet unique. Ease is tempered for non-EU nationals who want to actively manage the company (they must obtain an appropriate residence permit such as the 'Talent – porteur de projet', which requires ≥€30,000 investment and a Master's-equivalent diploma or 5 years' experience), by slow bank-account opening, and by mandatory FDI screening in strategic sectors.