France's e-invoicing mandate is live - And so are our clients

Kelly Muniz, Senior Regulatory Counsel, Medius:

France's choice of the 5-corner model was made to fit more smoothly into existing business practices, in contrast with centralized models where businesses must connect directly to the tax authority - and where, in many cases, the tax authority itself is responsible for delivering the invoice. That choice came out of consultations running since 2020, starting with pilot workshops and involving hundreds of stakeholders: businesses, professional federations, and software providers.

During that process, the large majority of businesses said the same thing - they wanted to keep working with the platform of their choice, rather than connecting into a single centralized system. The relevance of this model is that it lets a business connect to a platform that is then connected into a large network, where everyone is interconnected, and at the top of that network sits the tax authority. No matter which platform a business chooses, the invoice reaches its destination, and the data reaches the administration, reducing the burden on businesses.

That routing and reporting role is the base layer every accredited platform must deliver. But since businesses are free to pick the platform that works best for them, that is where they start to see real value: catching anomalies before an invoice ever reaches approval, giving finance teams real-time visibility into spend and cash position, and carrying that invoice all the way through to payment - rather than stopping at receipt.

Kelly Muniz, Senior Regulatory Counsel, Medius:

There has been real concern following the cyberattacks on the DGFiP, France's tax administration, over the summer. On this point, the administration itself has been direct: DGFiP director, Amélie Verdier, stated there is no link between the flaw that was exploited and the e-invoicing system. She also noted that every accredited platform underwent a security audit before being registered, and remains subject to regular controls - while acknowledging that zero risk doesn't exist.

The ministry has since gone further, restating cybersecurity requirements already described as the highest in Europe, and asking platforms to further demonstrate how they secure their systems. Platforms are expected to show their governance around security, their technical setup, and a proper risk analysis. If a platform cannot prove it meets the highest security standard, its operations will be suspended.

Accreditation is meant to guarantee a consistent, high security bar that every platform must meet and that means the checks don't stop once accreditation is granted. It stays under continuous review.

Kelly Muniz, Senior Regulatory Counsel, Medius:

In July, the DGFiP published its start-up guide, stating that sanctions would not be automatically applied for non-compliant companies, as long as they are making active, documented efforts to comply - but without specifying how long that period would last.

On September 1, the government confirmed that no sanctions will be applied to companies facing difficulties implementing the reform, and that this phase of tolerance will run through the end of 2026.

Our reading of this is as follows:

• We now have a date - the tolerance runs through the end of 2026, which the July guide did not specify.
• However, the authorities still link back to that July guide, which requires documented and active efforts from taxpayers to benefit from the tolerance.
• Therefore, companies experiencing difficulties should be cautious not to completely drop the practice of documenting their efforts.

In short: no penalties will apply through the end of 2026. But as a precaution, companies that are still working toward compliance should continue documenting their efforts as set out in the start-up guide. Clients who are already live and whose compliance aspects are fully aligned with requirements do not need to take any additional steps.

E-invoicing: a mandate, not a fix

Nicolas Gudin, VP Medius France:

France's e-invoicing reform is a significant step forward for tax transparency and invoice traceability. But it would be a mistake to treat it as a solution to the deeper challenges facing AP teams today.

What the reform does is create a structured, traceable entry point for every invoice. What happens next - how quickly it is coded, matched, approved, and paid - depends entirely on the processes and technology that sit behind it. A compliant invoice arriving into a broken process is still a problem.

Fraud exposure makes this even more pressing. According to SSON's research, 44% of organizations have been targeted by invoice fraud - and yet most of the controls designed to catch it sit inside the AP process itself, not at the point of receipt. E-invoicing creates traceability at entry. It does not create controls downstream. That is precisely where the conversation with your platform provider should start.

The real danger, then, is that the mandate becomes a distraction. Organizations that focus all their energy on compliance readiness may find themselves live on e-invoicing but no closer to resolving the inefficiencies that cost them $168,204 per year in invoice fraud losses, and 7.7 hours per week chasing approvals.