Skip to main content

France — NF525 (Special Case)

There is no tax authority sandbox to onboard for France. NF525 is a software certification, not a per-merchant authority registration.

PropertyValue
AuthorityNone — local-only signing chain
Sandbox URLN/A
Cost~€500-1500 one-time + annual maintenance for production cert
Time to provision4-12 weeks for certification audit (one-time per major software version)
Identity requiredNone at the authority level

What this looks like​

For development and CI, no onboarding is needed. NF525 is a local-only signing chain — you can run the adapter in dev mode without any certification.

For production deployment, the codebase must pass an NF525 audit:

  1. Submit your codebase to LNE (lne.fr) or AFNOR Certification (afnor.org) for the NF525 audit.
  2. They review the cryptographic implementation and JET (Journal d'Événements Tracés / audit log) handling against the NF525 spec.
  3. On success: you receive an NF525 certificate and a unique software identifier.
  4. The certificate is valid for the codebase as audited; major changes require re-audit.

GitHub secrets to set​

FR_NF525_REGISTER_ID         # per-test-register; not authority-issued

(Only one secret because there's no authority round-trip; register_id is just an internal identifier for which signing chain belongs to which test register.)

Sandbox-nightly behaviour​

The sandbox-nightly.yml job for FR is effectively a no-op — there's no authority to round-trip with. Its job for FR collapses into:

  • Verifying the local signing chain produces valid output (already covered by goldens audit fi-93q).
  • Verifying the JET log is consistent.
  • Verifying chain continuity across simulated restarts (covered by chain-persistence work fi-5ev once it lands).

Gotchas​

  • NF525 is a software certification, not a sandbox. Don't expect a URL to hit.
  • LNE and AFNOR have different audit philosophies. LNE is typically faster but pricier; AFNOR is the historical default.
  • Re-certification needed for any cryptographic-relevant code change. Plan certification cadence around release planning.
  • The cost difference between LNE and AFNOR can be 2-3× depending on codebase size; get quotes from both.

Non-resident path​

NF525 is a software certification, not an authority registration. There is no French residency requirement at any stage.

  • LNE and AFNOR Certification both work with international software vendors directly. No fiscal representative needed.
  • Cheapest dev path: request quotes from both LNE and AFNOR; pick the lower one. ~€500-1500 one-time + annual maintenance.
  • Production. Same as dev — the certificate is on the codebase, not on a French entity. No branch or VAT representative required for NF525 compliance itself. (If the platform separately bills French customers on its own books, French VAT obligations apply, but that's orthogonal to NF525.)
  • Adapter crate: rust/adapters/france/
  • NF525 spec: published by LNE; latest version current as of audit date.