Corporate & Commercial 2026 Comparisons

Main Vehicles

French business activity is commonly conducted through a société par actions simplifiée (SAS), société à responsabilité limitée (SARL) or société anonyme (SA). Each has separate legal personality and limited liability, subject to fraud, guarantees and specific director-liability rules. The SAS is the default choice for private M&A, joint ventures and venture or private-equity investments because its articles may allocate governance and economic rights flexibly. It requires at least one shareholder and no statutory minimum capital beyond EUR1.

The SARL is more prescriptive and is often used for closely held or family businesses. Transfers to third parties generally require shareholder approval. The SA is designed for larger businesses and is the usual French form for admission of shares to trading on a regulated market; it has a minimum share capital of EUR37,000 and more formal governance. Other eligible public-company forms include the société en commandite par actions and the European company.

Other structures include the société en nom collectif, whose partners have unlimited joint liability, and civil companies for non-commercial or asset-holding activities. Foreign companies may operate through a branch, which has no separate legal personality, or a subsidiary. Partnerships are generally tax-transparent, whereas companies are normally subject to corporation tax, although elections and special regimes may apply.

Incorporation

Founders choose the form, name, registered office, corporate purpose, duration, share capital, financial year and governance, and adopt articles of association. Cash contributions are deposited with an authorised institution; contributions in kind may require an independent contribution auditor, subject to statutory exemptions. The initial directors and, where applicable, statutory auditor are appointed, and foreign directors should check immigration and regulated-activity requirements.

Incorporation is filed electronically through the national business formalities portal. The filing includes the articles, evidence of the registered office and capital deposit, details of officers and beneficial owners, and the publication certificate for the legal notice. The company acquires legal personality upon registration with the Trade and Companies Register and receives national identification numbers. Timing is commonly one to three weeks once a complete file is available, but regulated activities, foreign documents and beneficial-ownership checks may extend it.

Ongoing Compliance

Companies must maintain corporate registers and accounting records, approve annual accounts, allocate profits and file accounts with the registry, subject to confidentiality options for qualifying small businesses. Corporate decisions must comply with the law and articles, and changes are generally filed through the same portal. A statutory auditor is generally required when two of the following three thresholds are exceeded: EUR5 million in total assets, EUR10 million in net turnover, and 50 employees. Group, controlled-subsidiary, public-interest-entity and minority-request rules can require an appointment in other circumstances. Tax, payroll and sector-specific filings apply separately.

The subscribed share capital is stated in the articles and divided into shares representing fractions of that capital. France does not use an Anglo-American concept of authorised but unissued capital: new shares require a shareholder decision or a valid delegation to the competent corporate body. The issue price may include a premium above nominal value, but shares cannot be issued below nominal value. An SAS may create ordinary or preference shares carrying tailored voting, dividend, liquidation, conversion or redemption rights, provided mandatory rules and the prohibition on excluding a shareholder entirely from profits or losses are respected. In an SA, statutory rules are more detailed, particularly for listed issuers and multiple-vote or non-voting instruments.

Capital increases are decided by the shareholders under the majority and quorum rules applicable to the relevant form, although authority may be delegated within statutory limits. Existing shareholders of an SA or SAS benefit from preferential subscription rights on cash issues. Those rights may be waived individually or disapplied by the competent shareholder decision, generally on the basis of management and auditor reports.

Changes to class rights require the approvals specified by law and the articles; an SA normally requires a special meeting of the affected class. Private financings also use convertible bonds, bonds with warrants, founders’ warrants and other securities giving access to capital. Corporate approvals, valuation protections, securities-law restrictions and employee incentive tax conditions should be checked together before issuance.

Dividends and Reserves

Distributions may be made from distributable profit and available reserves after approval of the annual accounts. At least 5% of annual profit, after carried-forward losses, is allocated to the legal reserve until it reaches 10% of share capital. No distribution may reduce net assets below share capital plus non-distributable reserves. Interim dividends require an interim balance sheet certified by a statutory auditor and are capped by the profit shown on that basis. In February 2025, the Cour de cassation also held that profit carried forward from a prior year can be allocated or distributed only by the annual meeting approving the accounts of the following financial year.

Unlawful dividends may be recovered from shareholders who knew, or could not have been unaware, that the distribution was irregular. Directors may incur civil or criminal liability. In a group, upstream distributions also require review of corporate benefit, financial-assistance, tax and insolvency constraints.

Capital Reductions and Buy-Backs

A capital reduction requires an extraordinary shareholder decision and, when it is not motivated by losses, may trigger a creditor-objection period. Equal treatment must be preserved unless all affected shareholders give consent. Private companies may repurchase shares only within statutory mechanisms – eg, a capital reduction, an employee plan or purposes authorised for an SAS. Shares acquired must be cancelled, transferred or otherwise dealt with within the applicable period. Listed issuers may operate buy-back programmes authorised by shareholders and compliant with the EU Market Abuse Regulation, AMF rules and disclosure requirements.

Beneficial Ownership

Private companies must identify and report their beneficial owners through the business formalities portal and keep the filing current. A beneficial owner is generally an individual who directly or indirectly holds more than 25% of the capital or voting rights, or otherwise exercises control over management or governing bodies. If no individual can be identified, the legal representative is reported under the fallback rule.

Changes in ownership, control or personal details must be filed promptly. Access to beneficial-ownership information is restricted in accordance with EU case law and French rules, but competent authorities, regulated professionals conducting customer due diligence and persons demonstrating a legitimate interest may obtain information within the applicable framework. Incomplete or inaccurate reporting may expose the company and its representatives to fines, management disqualification and registry measures.

Share ownership itself is recorded in the company’s securities accounts for companies limited by shares, or in the articles and registry filings for an SARL. Separate disclosure regimes apply to listed companies, regulated sectors, foreign-investment review and anti-money laundering checks.

Sources and Allocation of Powers

French corporate governance is principally governed by the Civil Code, Commercial Code, Monetary and Financial Code, articles of association and, where relevant, the EU Market Abuse Regulation and listing rules. Certain companies with exclusively public or mixed capital structures are also governed in part by the General Code of Territorial Authorities (notably local public companies and mixed-economy companies). The company’s legal form determines which matters are reserved to shareholders and which belong to management. The articles of an SAS provide broad freedom to design boards, committees, reserved matters and decision procedures, but the president retains statutory authority to represent the company towards third parties.

An SA may use a one-tier board of directors with a chair and chief executive, or a two-tier supervisory board and management board. Public-interest entities and listed issuers face enhanced audit, internal-control, remuneration, gender-balance, sustainability and related-party requirements. The AFEP-MEDEF and Middlenext codes operate on a comply-or-explain basis for issuers that adopt them and strongly influence market practice.

Private companies typically supplement the articles, which are public, with shareholders’ agreements covering board composition, information, vetoes, funding and transfers. Internal limits on management powers are generally ineffective against third parties acting within the corporate purpose, so delegations, signing policies and post-closing governance should be documented operationally as well as contractually.

Directors and corporate officers must act within their powers, comply with law and the articles and act in the corporate interest, taking into consideration the social and environmental implications of the company’s activities. They owe duties of loyalty, care and confidentiality developed through case law. A parent-appointed director must exercise independent judgement for the company on whose board they sit, even when group interests are relevant.

Civil liability may arise towards the company, shareholders or third parties for breach of law, the articles or mismanagement. A third party generally needs to show a fault separable from the officer’s functions. Shareholders may bring a derivative action on the company’s behalf. Criminal exposure can arise from misuse of corporate assets or powers, inaccurate accounts, unlawful distributions, market abuse, corruption and other offences.

Liability is assessed by reference to each officer’s conduct, although collegiate decisions can expose all participating directors unless dissent is properly recorded. Delegations of authority can transfer operational criminal responsibility when granted to a person with appropriate competence, authority and resources. D&O insurance and indemnities are common, but cannot cover criminal fines or eliminate mandatory liability.

Private Companies

An SAS must have a president, who may be an individual or legal entity; all other bodies are optional and defined by the articles. There is no nationality or residence requirement as a matter of general company law, although immigration, tax-residence and regulated-sector rules may matter. A SARL is managed by one or more individual managers. Private companies are not generally required to appoint independent directors.

Public Companies

An SA board ordinarily has three to 18 members, subject to temporary exceptions following a merger. Its articles may require directors to hold shares. Listed companies are expected to include independent directors under the governance code they apply and to establish specialised committees, particularly an audit committee. French law also imposes gender-balance rules for boards of larger companies and employee representation on boards when workforce thresholds are met.

The board determines strategy and monitors implementation; it cannot displace powers reserved to shareholders. Good practice includes a skills matrix, annual conflict declarations, board evaluations, documented information flows, succession planning and executive sessions. Diversity requirements increasingly extend beyond the board to senior-management populations in large companies.

Sustainability Framework

French companies may be subject to sustainability reporting under the EU Corporate Sustainability Reporting Directive (CSRD), as transposed and subsequently amended. The 2026 EU reform reduces the future scope principally to companies exceeding both 1,000 employees and EUR450 million in net turnover, subject to national transposition and transitional rules for financial years beginning before 2027. In-scope companies report under European Sustainability Reporting Standards and obtain limited assurance. Groups should confirm the rules applicable to the relevant financial year, whether a French subsidiary is exempt through consolidated reporting and whether non-EU parent reporting will apply.

Large companies may also be subject to a vigilance plan covering serious human-rights, health and safety and environmental risks arising from their own operations and certain subsidiaries, subcontractors and suppliers. Climate, taxonomy, sustainable-finance and gender-pay disclosures may apply depending on size, activity and listing status. Listed issuers must ensure that sustainability information is consistent with regulated financial and inside-information disclosures.

Boards should map applicable obligations, approve materiality and risk assessments, allocate oversight and maintain auditable data and controls. The corporate interest expressly requires management to consider social and environmental issues, but does not create a general right for stakeholders to direct the company. A société à mission may incorporate a purpose and social or environmental objectives in its articles, with specific monitoring and verification.

Directors should disclose personal interests, abstain where appropriate and ensure that deliberations and minutes demonstrate an informed decision in the company’s interest. The statutory framework is supplemented by articles, board rules and governance codes. Undisclosed conflicts may support liability, nullity in limited circumstances and reputational or regulatory consequences.

Regulated-agreement procedures apply to transactions between a company and specified officers, shareholders or related entities. In an SA, prior board approval is generally required, followed by a statutory auditor’s special report and a shareholder vote. In an SAS, the procedure is usually post-completion reporting and shareholder review, subject to the articles and exceptions for ordinary-course transactions on arm’s-length terms. A SARL has a comparable statutory process.

Group transactions require particular attention to corporate benefit, pricing, cash pooling, guarantees and financial assistance. French case law permits a group interest to be considered where the entities form a genuine group, the support pursues a common economic policy, and the burden is not disproportionate to the supporting company’s financial capacity or liable to disrupt its financial equilibrium. Listed companies must also comply with market-abuse disclosure and enhanced approval and public-disclosure requirements for material related-party agreements.

Statutory and Contractual Rights

Shareholders vote on reserved matters, receive distributions lawfully declared, participate in capital changes and share in liquidation proceeds according to their rights. They are entitled to specified corporate documents before meetings and may ask written questions. Minority thresholds allow shareholders in certain forms to request agenda items, seek appointment of an expert to report on management transactions, call or obtain a court-convened meeting, and bring derivative actions.

Majority decisions may be set aside for abuse where they are contrary to the corporate interest and adopted solely to favour the majority at the minority’s expense. A blocking minority may itself be liable for abusive obstruction when it prevents an essential transaction for the sole purpose of advancing its own interests. Emergency and merits proceedings can provide injunctions, nullity, damages or appointment of a provisional administrator, although courts avoid substituting themselves for corporate bodies.

An SAS offers broad scope to create vetoes, class consents and information rights in the articles. Rights appearing only in a shareholders’ agreement bind its parties but normally do not invalidate a corporate decision taken in breach. Investors therefore place structural governance and transfer restrictions in the articles where enforceability against the company and third parties is important.

Typical Provisions

Shareholders’ agreements commonly regulate board representation, reserved matters, business plans, financing, information, anti-dilution, pre-emption, rights of first offer or refusal, lock-ups, permitted transfers, tag-along and drag-along rights, founder vesting, leaver arrangements and exit processes. Private-equity agreements also address management packages, liquidity waterfalls and lender rights.

The agreement must be consistent with mandatory company law and carefully coordinated with the articles. A perpetual agreement, which is not usual, may be terminable on reasonable notice; parties therefore use a fixed duration or objective end date. Transfer undertakings must identify price or a determinable pricing mechanism. Penalty clauses may be reduced or increased by a court if manifestly excessive or derisory.

Remedies include damages, contractual penalties and, where sufficiently precise and legally possible, specific performance. Courts may appoint a provisional administrator in exceptional circumstances or dissolve a company for just cause where serious dissension paralyses it. Forced-transfer promises and drag clauses require particular drafting to secure execution if a party defaults. In February 2025, the Cour de cassation confirmed the validity of an objectively triggered “Russian roulette” or “American” clause whose reciprocal mechanism made the transfer price determinable. Confidentiality and arbitration clauses are common, while listed-company agreements may trigger AMF disclosure and concert-party analysis. Tax, employment and financial-assistance consequences should be reviewed when the agreement confers benefits on managers or commits the company itself.

Private and Public M&A

Private acquisitions are governed by general contract and company law, with sector rules for employee consultation, merger control, foreign investment, regulated businesses and tax. Share deals are most common, using a signing followed by conditions precedent or a simultaneous signing and closing. Asset deals, contributions, statutory mergers, demergers and universal transfers are used where perimeter, tax or succession considerations favour them.

Public takeovers are governed by the Monetary and Financial Code, AMF General Regulation and EU market-abuse rules. Mandatory offers generally arise when a person, alone or in concert, crosses 30% of capital or voting rights of a company listed on a regulated market, or increases a holding between 30% and 50% by at least 1% in less than 12 months. The AMF reviews offer documentation, timetable, equal treatment and, where required, the independent expert’s fairness analysis.

Execution Points

Transactions commonly use locked-box or completion-account pricing, earn-outs, escrow, bank guarantees or W&I insurance. Before signing, parties assess social and economic committee (CSE) information and consultation, merger control, foreign direct investment (FDI) and sector approvals. For sales completed from 27 July 2026, the Law of 26 May 2026 removed the separate employee information procedure for companies whose CSE exercises the powers applicable at 50 employees and reduced the notice period to one month for other in-scope sales of a business or controlling interest; CSE consultation and other applicable procedures remain transaction-critical. Recent reforms also facilitate cross-border conversions, mergers and divisions within the EU and have modernised listed-company financing and governance. Recent case law reinforces drafting discipline: in February 2025, the Cour de cassation validated an objectively triggered reciprocal buy-sell clause, while its May 2025 decision on interdependent settlement and share-transfer agreements underlined the importance of joining all affected parties to proceedings seeking consequential invalidity or lapse.

Regulatory Architecture and Offering Process

The AMF supervises issuers, public offers, market conduct and regulated-market disclosure; the Autorité de contrôle prudentiel et de résolution supervises regulated financial institutions. Euronext Paris operates the regulated market, while Euronext Growth and Euronext Access provide multilateral trading venues with lighter admission regimes.

An offer of securities to the public or admission to a regulated market generally requires an EU Prospectus Regulation approved by the AMF, unless an exemption applies. Preparation commonly includes issuer reorganisation, audited financial statements, due diligence, governance work, underwriting documentation and AMF review. Timing varies materially, but a first-time issuer should allow several months. Listing rules operate alongside securities law and impose free-float, financial-history, governance and ongoing obligations appropriate to the chosen venue.

Exemptions include offers solely to qualified investors, to fewer than 150 non-qualified persons per EEA state, with a denomination or minimum consideration of at least EUR100,000 per investor, and certain small offers. In France, since 5 June 2026, public offers below EUR12 million calculated over 12 months are exempt from the prospectus requirement, although an information document and filing may still be required depending on the offer. Securities law does not impose a general private-placement holding period, but contractual lock-ups, market-abuse rules and exemptions relied upon for resale must be respected. Non-compliance can result in AMF sanctions, civil liability and criminal offences.

Periodic and Inside Information

Issuers on a regulated market publish annual and half-yearly financial reports within statutory deadlines and provide governance, shareholding, remuneration and sustainability information as applicable. They must ensure equal and effective dissemination through regulated information channels and file information with the AMF. Euronext Growth issuers have a distinct, but still material, reporting framework.

Under the EU Market Abuse Regulation, an issuer must disclose inside information concerning it as soon as possible. Disclosure may be delayed on the issuer’s responsibility when immediate publication would prejudice legitimate interests, delay would not mislead the public, and confidentiality can be maintained. The issuer documents the decision and notifies the AMF after disclosure, as required. Special rules apply to protracted processes and regulated financial institutions.

Transaction teams should establish a disclosure committee, restricted lists, clean teams and a documented leak response. Financial guidance, cyber incidents, litigation, management changes and M&A may be material depending on their price sensitivity. Information published in another context should be consistent with regulated disclosures and made available on the issuer’s website for the required period.

Prohibited Conduct

The EU Market Abuse Regulation prohibits insider dealing, recommending or inducing insider dealing, unlawful disclosure of inside information and market manipulation. Inside information is precise, non-public information relating directly or indirectly to an issuer or financial instrument that would be likely to have a significant price effect if made public. Legal persons can be liable alongside individuals.

Issuers and persons acting for them maintain insider lists, notify insiders and preserve records. Persons discharging managerial responsibilities and closely associated persons must report relevant own-account transactions once the annual threshold is reached and generally observe a 30-day closed period before financial reports. Market soundings, buy-backs and stabilisation benefit from specific frameworks when conditions are met.

The AMF may investigate, require documents and data, conduct inspections, cooperate internationally and impose substantial administrative fines and professional bans. Serious conduct may also be referred for criminal prosecution. Companies should use dealing codes, pre-clearance, training, information barriers and escalation procedures, particularly during confidential transactions.

Statutory Thresholds

For issuers admitted to trading on a regulated market, a shareholder must notify the issuer and the AMF when crossing, upward or downward, statutory thresholds of 5%, 10%, 15%, 20%, 25%, 30%, one-third, 50%, two-thirds, 90% or 95% of capital or voting rights. Notification is generally due within four trading days. Holdings are aggregated with specified financial instruments and interests held in concert.

At 10%, 15%, 20% and 25%, the shareholder must also declare its intentions for the following six months, including financing, control and board plans. The issuer’s articles may add thresholds from 0.5% upwards, reported to the issuer under the articles. Separate monthly disclosure by the issuer of total voting rights supports investor calculations.

Late disclosure can suspend voting rights above the unreported threshold, automatically for statutory thresholds and, subject to conditions, at another shareholder’s request for articles-based thresholds. AMF sanctions may also apply. Crossing 30% can trigger a mandatory public offer unless an exemption is granted, so derivatives, concert arrangements and intragroup reorganisations should be analysed before execution.

Controls and Reporting Channels

Listed issuers describe internal control and risk-management arrangements in their governance reporting and maintain systems capable of producing reliable financial and sustainability information. Public-interest entities require an audit committee or equivalent body. Regulated sectors impose additional governance, compliance and fit-and-proper requirements.

The Sapin II framework requires companies meeting the statutory workforce and turnover thresholds, and groups headed in France meeting the consolidated test, to implement an anti-corruption programme. Core measures include a code of conduct, internal reporting channel, risk mapping, third-party due diligence, accounting controls, training, disciplinary measures and internal evaluation. The French Anti-Corruption Agency may review programmes and its sanctions commission may order remediation and impose fines.

Whistle-blower rules protect individuals reporting in good faith and without direct financial consideration facts within the statutory scope. Entities with at least 50 employees generally maintain an internal reporting procedure after consultation with employee representatives. Confidentiality, acknowledgement, feedback, GDPR compliance and anti-retaliation are essential. Groups should coordinate French procedures with global hotlines while preserving local rights, privilege and data-transfer safeguards.

Security Package

French law recognises pledges over shares, securities accounts, receivables, bank accounts, business assets, inventory and equipment, as well as assignments of receivables by way of security, mortgages over real estate and personal or autonomous guarantees. Choice of security depends on the asset, the obligor and whether the financing qualifies for simplified financial-collateral rules.

Perfection may require a written agreement, registration, account entry, dispossession, notification or control. Security over shares or partnership interests must follow the form, account-entry, notice and, where applicable, registration rules for the relevant instrument; business-asset pledges and mortgages are registered. Priority generally follows the applicable perfection or registration date, subject to statutory preferences. Enforcement routes include judicial sale, contractual appropriation where permitted and court attribution, with insolvency stays and avoidance rules materially affecting recovery.

Acquisition financing commonly combines senior facilities, shareholder instruments and a security package granted at closing or after funds flow. French financial-assistance rules prohibit companies limited by shares, including an SA or SAS, from advancing funds, granting loans or providing security for the acquisition of their own shares; corporate benefit and group-support rules apply to all companies. Intercreditor agreements regulate ranking, turnover, enforcement and standstill. The 2021 security-law reform modernised and consolidated many security interests; transaction documents should use the current statutory forms and publicity registers.

A contract requires consent, capacity and lawful, certain content; consideration is not a separate French-law requirement. Contracts are generally consensual unless legislation requires writing, notarisation, registration or specific consumer formalities. Electronic signatures and records can satisfy writing requirements if identity and integrity conditions are met.

Negotiations must be conducted in good faith. A party may terminate negotiations, but can be liable for wrongful conduct; damages do not normally include the profits expected from the unmade contract. Parties must disclose information that is decisive for consent when the other party legitimately does not know it, excluding valuation of the performance. Error, fraud, duress, incapacity and unlawful content can cause nullity.

Contracts bind the parties and must be negotiated, formed and performed in good faith. Courts seek the parties’ common intention rather than relying solely on literal wording and interpret standard terms against the party proposing them. In adhesion contracts, a non-negotiable term creating a significant imbalance may be deemed unwritten. Clauses excluding liability cannot neutralise an essential obligation, and liability for fraud or gross misconduct cannot effectively be excluded. Commercial parties should specify hierarchy, entire agreement, notice, evidence and liability mechanics with precision.

For non-performance, the creditor may suspend its own performance, seek specific performance, obtain a price reduction, terminate the contract and/or claim damages, subject to statutory conditions and proportionality. Contractual notice and cure provisions should be followed. Termination may result from an agreed clause, unilateral notice for sufficiently serious breach or a court order; wrongful termination exposes the terminating party to damages and may leave the contract in force.

Damages ordinarily cover foreseeable direct loss, except in cases of gross or intentional breach. Penalty clauses are enforceable but may be adjusted by a court if manifestly excessive or derisory. Parties often exclude indirect loss and cap liability, with carve-outs for fraud, gross fault, confidentiality, IP, data protection and other negotiated risks.

Force majeure requires an event beyond the debtor’s control that could not reasonably have been foreseen at contracting and whose effects cannot be avoided by appropriate measures. Temporary prevention suspends performance unless delay justifies termination; permanent prevention discharges the affected obligation. Article 1195’s hardship provision permits a party to seek renegotiation when an unforeseeable change makes performance excessively onerous and it did not accept that risk. Commercial contracts commonly exclude or tailor this mechanism.

Ownership and Transfer

Assignments and licences should identify the rights, territory, duration, permitted uses, exclusivity, consideration, warranties and enforcement responsibilities. French copyright assignments must separately specify transferred rights and their scope, destination, territory and duration; assignments of future works are restricted. Trade-mark and patent transfers should be recorded with the INPI to be effective against third parties. Know-how requires robust confidentiality and access controls.

Employee inventions follow a statutory regime distinguishing mission inventions, which belong to the employer with additional remuneration, from other inventions that may be claimed for a fair price. Software created by employees in the course of duties generally vests in the employer, but copyright in other employee or commissioned works does not automatically transfer without a compliant agreement. Joint-development contracts should allocate background IP, results, filing, exploitation and exit rights. Purely AI-generated material may lack human authorship and should not be assumed to attract copyright protection.

Remedies for infringement include interim and final injunctions, preservation and seizure measures, damages, recall or destruction and publication of the judgment; counterfeiting may also be criminal. M&A diligence should verify chain of title, open-source use, contractor assignments, domain names, trade secrets, licences, security interests and change-of-control clauses.

The Consumer Code imposes pre-contract information, transparent pricing, conformity guarantees, controls on unfair terms and specific distance and off-premises selling requirements. Consumers generally have 14 days to withdraw from distance and off-premises contracts, subject to exceptions and formalities. Digital content, digital services and goods with digital elements are subject to dedicated conformity and update obligations.

Terms creating a significant imbalance to the consumer’s detriment may be deemed unfair and unenforceable. Aggressive or misleading commercial practices, hidden advertising, false environmental claims and manipulated online interfaces can trigger enforcement. E-commerce businesses must provide seller identity, ordering steps, payment and delivery information, withdrawal mechanisms and accessible terms on a durable medium.

The Directorate-General for Competition, Consumer Affairs and Fraud Control may investigate, issue injunctions, impose or seek administrative and criminal penalties, and coordinate product recalls. Consumers and approved associations may bring individual or group actions in specified fields. The EU Digital Services Act and platform rules add obligations for online intermediaries. International groups should localise consumer journeys rather than relying solely on a global template.

For transactions notified from 1 September 2026, French notification is mandatory when the parties’ combined worldwide turnover exceeds EUR250 million and at least two parties each generate more than EUR80 million in France, provided the transaction lacks an EU dimension. For retail transactions, the corresponding thresholds are EUR100 million worldwide and EUR20 million of French retail turnover for at least two parties. Specific lower thresholds continue to apply in certain French overseas territories. A concentration includes mergers, acquisitions of sole or joint control and full-function joint ventures.

Transactions must not be implemented before clearance. Phase I is normally 25 working days from a complete filing, extendable in specified circumstances; an in-depth Phase II review is usually 65 working days, subject to suspensions and extensions. The Autorité de la concurrence tests whether the transaction significantly lessens competition, considering unilateral, coordinated, vertical and conglomerate effects and efficiencies. Remedies may be structural or behavioural.

Gun-jumping and failure to notify can attract fines of up to 5% of the notifying company’s French pre-tax turnover for the last closed financial year, increased where relevant by the target’s French turnover, plus remedial orders. Anticompetitive agreements and abuse of dominance are separately prohibited under French and EU law, with corporate fines potentially reaching 10% of worldwide group turnover. Transaction protocols should include information-sharing safeguards, clean teams and conduct-of-business covenants that preserve the target’s independence before clearance.

Scope of French FDI Review

Prior authorisation from the French Minister for the Economy is required where a foreign investor acquires control of a French entity, acquires all or part of a business line, or, if the investor is established outside the EU or EEA, crosses 25% of the voting rights in an unlisted French entity carrying out a sensitive activity. The investor test follows the chain of control. A separate regime applies when a non-EU/EEA investor crosses 10% of the voting rights in a French listed company carrying out a sensitive activity: the investor makes a prior notification and is exempt from a full authorisation request if the Minister does not object within ten business days.

Sensitive activities include defence, security, critical infrastructure and services, energy, water, transport, communications, public health, food security, certain media and R&D in critical technologies such as cybersecurity, AI, semiconductors and biotechnologies. A prior request may be made to confirm whether the target’s activity is in scope. There is no filing fee. The initial review is 30 business days, followed, where necessary, by a further 45 business days; information requests can affect timing.

Clearance may be unconditional or subject to commitments on governance, information, supply, assets or French capabilities. The Treasury’s 2025 report recorded 418 filings and 167 authorised transactions, 49% with conditions. Failure to obtain approval can lead to suspension, unwinding, injunctions and financial penalties. Sector approvals and EU co-operation may run in parallel. France offers grants, tax credits and investment programmes, but incentives depend on project, location and EU state-aid rules.

Core Data-Protection Obligations

The GDPR, the French Data Protection Act and CNIL guidance govern personal data, alongside sector rules for health, communications, finance, employment and cookies. Controllers need a lawful basis for each purpose, clear information, purpose limitation, data minimisation, accuracy, retention controls and appropriate security. Where consent is relied on, it must be freely given, specific, informed and unambiguous; France sets the age of digital consent at 15, and the CNIL actively enforces cookie consent. Controllers must honour individual rights, maintain processing records, use compliant processor agreements and carry out data-protection impact assessments for likely high-risk processing. Disclosure to third parties requires a lawful basis, transparency and appropriate contractual safeguards.

A personal-data breach must be documented and notified to the CNIL within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals’ rights and freedoms. Affected individuals must be informed without undue delay where the risk is high, subject to exceptions. Administrative fines can reach EUR20 million or 4% of worldwide annual turnover, whichever is higher. The CNIL may also issue warnings, compliance orders with daily penalties, and temporary or permanent processing bans, and often publishes its sanctions. In addition, certain breaches of data-protection rules are criminal offences under Articles 226-16 et seq of the French Criminal Code, punishable by up to five years’ imprisonment and a EUR300,000 fine for individuals (up to five times that amount for legal entities). Data subjects may also claim compensation for material or non-material damage, including through collective actions. The EU Digital Omnibus proposal would raise the notification threshold to high-risk breaches and extend the deadline to 96 hours, but it has not yet been adopted.

The GDPR, the French Data Protection Act and CNIL guidance govern personal data, alongside sector rules for health, communications, finance, employment and cookies. Controllers need a lawful basis for each purpose, clear information, purpose limitation, data minimisation, accuracy, retention controls and appropriate security. Where consent is relied on, it must be freely given, specific, informed and unambiguous; France sets the age of digital consent at 15, and the CNIL actively enforces cookie consent. Controllers must honour individual rights, maintain processing records, use compliant processor agreements and carry out data-protection impact assessments for likely high-risk processing. Disclosure to third parties requires a lawful basis, transparency and appropriate contractual safeguards.

A personal-data breach must be documented and notified to the CNIL within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals’ rights and freedoms. Affected individuals must be informed without undue delay where the risk is high, subject to exceptions. Administrative fines can reach EUR20 million or 4% of worldwide annual turnover, whichever is higher. The CNIL may also issue warnings, compliance orders with daily penalties, and temporary or permanent processing bans, and often publishes its sanctions. In addition, certain breaches of data-protection rules are criminal offences under Articles 226-16 et seq of the French Criminal Code, punishable by up to five years’ imprisonment and a EUR300,000 fine for individuals (up to five times that amount for legal entities). Data subjects may also claim compensation for material or non-material damage, including through collective actions. The EU Digital Omnibus proposal would raise the notification threshold to high-risk breaches and extend the deadline to 96 hours, but it has not yet been adopted.

Transfers to countries recognised as adequate by the European Commission (such as the UK, Switzerland, Japan, Brazil and, for certified organisations, the US under the Data Privacy Framework, whose validity is currently under appeal before the Court of Justice of the EU) may take place freely. Other transfers outside the EEA require safeguards such as standard contractual clauses or binding corporate rules, together with a transfer impact assessment and supplementary measures where necessary. There is no general data localisation requirement under French law, but specific rules apply in certain areas, such as public archives, classified defence information and tax records. In particular, since the April 2026 implementing decree of Article 31 of the SREN Act, State administrations, their operators and certain public interest groupings must use SecNumCloud-qualified (or equivalent EU-certified) cloud services when hosting particularly sensitive data with private providers. Anyone hosting health data on behalf of a third party must also be HDS-certified (hébergeur de données de santé), and the current HDS framework requires such data to be hosted within the EEA, with transparency on risks of access by third-country authorities. In transactions, parties should diligence lawful datasets, cyber incidents, cookies, AI training data and international flows, and should control personal-data disclosure through minimisation and clean-room protocols.

Banks, insurers, investment firms, accountants, lawyers in specified transactions and other regulated professionals must identify customers and beneficial owners, assess risk, monitor relationships, retain records and report suspicions to TRACFIN. Obligations intensify for politically exposed persons, high-risk jurisdictions and opaque structures. Commercial companies outside the regulated perimeter still face banking KYC, beneficial-ownership and criminal money-laundering exposure.

EU and French sanctions impose asset freezes, sector restrictions and trade controls. Businesses should screen counterparties, ownership and control, banks, goods, technology, end-use and destination. Dual-use items are governed by EU export-control rules; defence items and certain sensitive products require separate licences. Contractual sanctions clauses do not replace a documented compliance process.

Sapin II requires qualifying large companies and groups to maintain an anti-corruption programme. Bribery of public or private persons, influence peddling and illegal conflict of interest (to name only the most common offenses) can result in corporate and individual criminal liability, exclusion and reputational harm in addition to the annulment of unlawfully awarded public contracts. The Parquet National Financier, criminal courts, customs, Treasury and AFA have complementary powers. Risk-based third-party diligence, approval controls, gifts and hospitality rules, training, accounting controls and investigations are central to transaction and post-acquisition compliance.

Environmental due diligence should identify classified installations, environmental permits and planning permissions, soil and groundwater contamination, waste, emissions, protected sites, climate obligations and historic liabilities. Operators may face administrative remediation orders and civil or criminal liability; landowners can also be exposed in defined circumstances. Share deals preserve entity-level liabilities, while asset deals require analysis of permit transfer (and associated risks) and successor obligations. Carbon pricing principally arises through the EU Emissions Trading System for covered activities.

France’s duty-of-vigilance regime and expanding climate and environmental litigation increase scrutiny of group risk mapping and public statements. Green claims must be substantiated. Employers must protect physical and mental health, assess occupational risks in a written risk-assessment document, implement prevention measures and consult employee representatives. Serious incidents may trigger reporting, inspection and criminal proceedings. Liability arising from the operation of a classified installation extends for 30 years following cessation of operations.

Licensing is sector-specific. Financial services, insurance, healthcare, pharmaceuticals, energy, transport, telecoms, defence, food and public-service activities can require regulator approval for operations or changes of control. Urban-planning and environmental authorisations may condition industrial and real-estate projects. Transaction timetables should therefore include an early regulatory matrix, permit portability review and allocation of remediation and compliance costs.

EU and French Framework

The EU AI Act applies directly in France using a risk-based model. Most prohibited practices and AI-literacy duties have applied since February 2025; governance rules and obligations for general-purpose AI models since August 2025; and the general enforcement framework and Article 50 transparency requirements since 2 August 2026. Following the revised implementation timetable, requirements for Annex III high-risk use cases apply from 2 December 2027 and those for high-risk AI embedded in regulated products from 2 August 2028.

Providers and deployers must first classify systems and their role. Depending on the category, obligations include risk management, data governance, technical documentation, logging, human oversight, accuracy, cybersecurity, conformity assessment, registration, incident reporting and transparency to individuals interacting with AI or exposed to synthetic content. Employment, credit, essential services and biometric uses warrant particular care. GDPR, consumer, product-safety, discrimination, employment and IP rules apply in parallel.

Businesses should maintain an AI inventory, procurement clauses, acceptable-use policy and approval process; document training data, testing and human review; and allocate incident and regulatory responsibilities. In M&A, diligence should identify proprietary models, third-party dependencies, data rights, open-source components, prohibited uses and future remediation costs. Enforcement can involve substantial turnover-based fines.

Additional Regimes

French businesses must consider competition, consumer, product-safety, cybersecurity, tax, customs, employment and sector regulation alongside corporate law. The EU NIS2 Directive is intended to expand cybersecurity risk-management and incident-reporting duties for essential and important entities, but, as at 3 October 2026, the French transposition legislation has not yet been enacted. Potentially in-scope businesses should nevertheless prepare against the directive and monitor the final French legislation and implementing instruments. The EU Digital Operational Resilience Act applies to much of the financial sector, while the Digital Services Act regulates online intermediaries and platforms.

Supply-chain and product businesses should assess CE marking, product traceability, market surveillance and the EU General Product Safety Regulation. Importers and exporters must classify goods, origin and value and manage VAT and customs records. Public-contract counterparties face procurement, integrity and performance requirements.

The applicable compliance perimeter should be mapped by entity, activity, workforce, turnover, data and geography. Acquirers should convert diligence findings into closing conditions, specific indemnities, remediation plans, governance reporting and integration priorities. A global policy is useful, but French employee consultation, whistle-blower, language, data and regulator expectations often require local procedures.

Employment Framework

The Labour Code, collective bargaining agreements, company agreements, employment contracts and case law regulate employment. Core rules govern working time and leave, remuneration, health and safety, equal treatment and non-discrimination, employee representation and social-security matters. Collective agreements often set more favourable or sector-specific terms.

Companies employing at least 11 employees for 12 consecutive months must establish a social and economic committee, with broader information and consultation rights in companies with at least 50 employees.

An indefinite-term employee may be dismissed only for a real and serious personal or economic cause and after the prescribed process. Personal dismissal normally requires an invitation to a preliminary meeting, the meeting itself, and a reasoned dismissal letter sent after the statutory waiting period. Notice and severance depend on seniority, contract and collective agreement, except in cases of gross misconduct. Protected employees require labour-inspector authorisation.

Economic dismissals are subject to specific requirements, including prior redeployment efforts and employee-representative consultation. Selection criteria must also be applied where several employees within the relevant professional category may be affected. Depending on the number of contemplated redundancies and the employer’s workforce, a job-protection plan (plan de sauvegarde de l’emploi – PSE) and administrative validation or approval may also be required. Claims are heard by employment tribunals. Compensation for dismissal without real and serious cause is subject to the statutory scale, but null dismissals, including discrimination or whistle-blower retaliation, follow separate remedies.

Compensation and Incentives

Executive packages combine salary, variable compensation, benefits, severance and equity instruments. Corporate officers may not have an employment contract unless they perform genuine separate technical duties under subordination. Listed companies face shareholder votes, disclosure and governance-code constraints. Change-of-control protection must be coordinated with corporate approvals, regulated remuneration rules and tax and social-security treatment.

Equity tools include free shares, stock options, warrants and founders’ warrants, as well as ordinary or preference shares and carried-interest mechanisms. Each has eligibility, vesting, holding, valuation and tax conditions. Good-leaver/bad-leaver terms and repurchase prices must be drafted carefully in light of corporate, employment and tax rules. The 2025–26 tax framework and transaction structure should be confirmed when grants are made and on exit.

A post-termination non-compete covenant is enforceable only if necessary to protect legitimate interests, limited in time and geography, proportionate to the role and accompanied by financial compensation. The applicable collective agreement may impose further conditions. Non-solicitation and confidentiality clauses do not always require compensation, but they must not operate as disguised non-competes. IP, confidentiality, return-of-property and data-access provisions should be reinforced for senior executives.

Ownership and Foreign Investors

Real estate may be held directly, jointly, through co-ownership, through a civil real-estate company or another corporate vehicle. Ownership and other rights in rem are evidenced through notarised deeds and registration with the land registry. Long leases, building leases and emphyteutic leases can allocate durable development rights without transferring freehold title.

Foreign individuals and companies can generally acquire, hold and dispose of French real estate without residence or nationality restrictions. They should nevertheless consider legal capacity, certified corporate documents, sanctions and AML checks, tax residence, financing and ownership structure. Agricultural land may be subject to SAFER pre-emption and operational approvals, while strategic assets or an entity conducting sensitive activities can raise foreign-investment issues.

Acquisition taxes, registration duties, VAT and capital-gains taxation depend on the asset, seller, purchaser and structure. Ultimate beneficial owners must be disclosed for acquisition vehicles. Notaries verify title, mortgages and public-law rights and collect applicable taxes. Non-resident ownership does not eliminate French filing, property-tax or representative obligations.

Acquisition and Financing

Commercial real-estate transfers are normally documented by a notarised deed registered with the land registry. Due diligence covers title, easements, security, leases, planning, construction, environmental condition, energy performance, co-ownership, insurance, tax and technical matters. Title insurance is less common than in common-law jurisdictions because notaries and registration verify title, although transactional insurance may cover identified risks.

Environmental diligence is essential for industrial sites. Parties allocate remediation risk contractually, but public-law liability may remain. Financing commonly uses a conventional mortgage or, where available, a lender’s statutory special mortgage, assignments of rents and insurance, account pledges and share security. Registration determines mortgage priority, and enforcement is generally judicial.

Commercial Leases

The statutory commercial-lease regime commonly provides a nine-year term with tenant break rights every three years, subject to exceptions. Tenants generally benefit from renewal rights or an eviction indemnity. Assignment, subletting, service charges, works, indexation, reinstatement and guarantees require careful drafting. Since 28 May 2026, a qualifying commercial tenant without undisputed rent or service-charge arrears may request monthly rent payments. For leases concluded or renewed from 26 May 2026 and eligible for monthly payment, the aggregate security requested by the landlord is capped at one quarter’s rent; statutory deadlines also govern the return of deposits and other security at the end of the lease.