France software delivery: CNIL, RGAA, the e-invoicing reform and French-language rules

OutsourcingVN is operated by Netbase JSC, so this guide is written by a supplier that would like your project. It draws on France's own regulator and legislative texts for the questions your advisers should answer in full, and on Netbase's published delivery and compliance statements. The guides index lists guides for other markets, and the market index compares the first question each one raises.

Contents

• How does CNIL shape a French data protection programme?
• What can Netbase evidence for a French brief?
• Which requirement sits with which decision owner?
• Which steps come before a French-facing launch?
• Worked scenario: a French partner rejects an invoice
• What has Netbase built for French clients?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

How does CNIL shape a French data protection programme?

GDPR is the regulation; the Commission Nationale de l'Informatique et des Libertés (CNIL) is the French authority that supervises it, investigates complaints and can impose sanctions, including fines that have reached hundreds of millions of euros against large platforms. CNIL also publishes its own compliance toolkit covering records of processing, impact assessments and certification-style guidance, which French data protection officers often use as the working reference rather than the regulation's text alone.

For a buyer, the practical effect is that a data protection programme written only against the regulation's general wording can still miss what a French reviewer expects to see, because CNIL's guidance adds its own structure and vocabulary on top. A buyer's data protection lead should check CNIL's current guidance directly rather than relying on a generic EU summary.

What can Netbase evidence for a French brief?

Procurement, security and data protection reviewers tend to ask for the same set of statements. Here is what Netbase can provide.

• Compliance practices. Netbase's compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. How CNIL's own guidance applies to a specific French product stays with your organisation's advisers.
• Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. A data processing agreement for a France-facing system sits on top of this baseline.
• Markets. Netbase clients are in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam.
• Language. Netbase delivery communication is in English. French-language requirements for the product itself, such as Toubon-law copy on invoices or product pages, are scoped as a project task with a named French-speaking reviewer.

Which requirement sits with which decision owner?

A French brief usually spans four separate owners inside the buying organisation, and treating them as one generic "compliance" line is the quickest way to miss one of them.

Ask a shortlisted supplier to complete this table for your specific product rather than accept one general compliance paragraph.

Worked scenario: a French partner rejects an invoice

A business customer's platform rejects an invoice because it is missing a field the e-invoicing reform now requires and because its line items are in English only.

A proposal that treats e-invoicing and the language rule as two unrelated checklist items, rather than one invoice template to get right once, tends to repeat this failure on the next invoice run.

What has Netbase built for French clients?

The nearest published evidence for a French brief is commerce work: Netbase has built a web-to-print store with an online design tool for a canvas-prints business in France, including a live product preview that shows the finished canvas before the customer orders it, for a client that is not named. The web-to-print stores record covers that design-tool scope, and the product personalisation and online design solution covers the customer-facing configurator pattern a live preview like this sits inside.

Which questions should you ask a supplier?

• Does your data protection programme reference CNIL's own guidance, or only the regulation's text? A precise answer names which CNIL documents it follows.
• Can you show an invoice that already carries the reform's required fields? Ask for a sample, not a description.
• Who owns the French copy on invoices, product pages and advertising? Expect a named reviewer, not "the developer will translate it."
• How do you test against RGAA's criteria, and who signs off the result? Look for a defect log tied to specific criteria, not a general accessibility claim.
• What happens if a French partner rejects an invoice? A good answer describes a short correction loop, not a one-off fix.
• What exactly does your security and compliance statement cover? A precise answer says what it leaves out as well as what it includes.

What usually goes wrong?

• A data protection programme is written to the regulation and never checked against CNIL's own guidance. Signal: a French reviewer asks for a document the programme does not have. Owner: the data protection lead.
• Accessibility testing starts from a generic WCAG checklist instead of RGAA's own criteria. Signal: a defect list that does not map to anything a French auditor would recognise. Owner: the product owner.
• The e-invoicing reform and the French-language rule are scoped as two separate, unrelated tasks. Signal: the same invoice template fails twice, once for each reason. Owner: the finance systems owner, scoping both in the same template change.
• French copy is translated once at launch and never reviewed again. Signal: invoices and product pages drift back toward English after the first few releases. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide uses CNIL's own description of its supervisory role, the French digital accessibility service's description of RGAA, Légifrance's text of the Toubon language law, and the French government's own description of the e-invoicing reform, all checked on 2026-10-03, together with company statements and a delivery record approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads preparing a French-facing brief. It does not decide which RGAA criteria or language scope fits your product; your own advisers confirm that.

Plan the first release

Bring your CNIL-referenced data protection programme, your RGAA accessibility decision, your e-invoicing connection and your French-language scope. The data security and compliance guide lists the contract questions behind the data protection row. For neighbouring markets, the UK guide covers UK accessibility duties, the Netherlands guide covers Peppol e-invoicing and the Dutch supervisory authority, and the Germany guide covers works-council consultation and German e-invoicing formats.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your French-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions