Certified POS software for bakeries: what France requires in 2026

A bakery that takes payments from consumers through POS software has to be able to prove that software is compliant, either with a certificate from an accredited body or with a self-attestation issued by the vendor. Article 125 of France's 2026 finance act, signed on 19 February 2026, brought that second option back after the 2025 act had removed it a year earlier. The fine is unchanged at €7,500 (about $8,750) per system you can't account for.

The rule moved twice in eighteen months, and the deadline shifted in between. In February 2025 the vendor attestation disappeared from the French tax code. The tax administration then granted two successive grace periods, pushing the certificate requirement to 1 March 2026 and then to 1 September 2026. In February 2026 lawmakers reversed course and put the attestation back. A large share of the pages still ranking on this topic describe a legal position that no longer exists, and plenty of bakers paid for a certification they never actually owed.

The starting point hasn't moved since 1 January 2018. What's left is the practical question a baker asks while standing at the counter: what do you need to be able to hand over the day a tax inspector asks, and what is the audit actually about. The answer comes down to one document, four technical conditions, and a handful of cases specific to the trade.

What the law says, and why it changed twice in eighteen months

The obligation sits in article 286-I-3° bis of the French tax code. Since 1 January 2018, any VAT-registered business that records consumer payments through cash register software or a POS system has to use a product that meets four conditions: inalterability, security, retention and archiving of the data. The stated goal was to kill off so-called permissive software, the kind that lets a merchant delete a sale after the fact and understate VAT collected.

France isn't unusual here. Germany requires a BSI-certified technical security device (TSE) under the KassenSichV, plus a standardised DSFinV-K export and a receipt-issuing duty. Austria runs the RKSV with signature-creation devices. Italy is moving its networked registers toward software-based solutions during 2026. Spain accepts a vendor's responsible declaration under VeriFactu. What makes France unusual is the U-turn: it removed vendor self-attestation and restored it within twelve months.

Until February 2025, two proofs carried equal weight: a certificate from an accredited body, in practice LNE or Infocert under the NF525 scheme, and an individual attestation signed by the vendor. Article 43 of the 2025 finance act deleted the second one as of 16 February 2025. Two updates to the official tax guidance then staggered the transition, the last one setting 1 September 2026 as the date when a certificate became the only accepted proof. Article 125 of the 2026 finance act restored the attestation, and the <a href="https://bofip.impots.gouv.fr/bofip/15035-PGP.html/ACTU-2026-00073" target="_blank" rel="noopener noreferrer">administrative commentary published right after</a> (in French) cancelled that deadline.

So an attestation a vendor signed in 2019 is valid proof again. With one caveat that matters during an audit: the document has to match the software version actually installed on the terminal. A POS updated four times since the attestation was signed is no longer covered by that piece of paper. Serious vendors reissue an attestation with every major release. The rest leave the baker holding an expired PDF and a false sense of safety. It's worth adding to the checklist when you pick a vendor, next to offline mode and accounting exports: our <a href="/blog/fournil-vs-toporder">Fournil versus Toporder comparison</a> covers where each vendor stands on NF525 certification.

The four conditions your POS has to meet

The four conditions aren't vague principles. Each one describes a specific software behaviour, spelled out on the <a href="https://www.economie.gouv.fr/entreprises/gerer-son-entreprise-au-quotidien/gerer-sa-comptabilite-et-ses-demarches/ce-quil-faut-savoir-sur-la-certification-des-logiciels-de-caisse" target="_blank" rel="noopener noreferrer">French finance ministry portal</a> (in French).

Inalterability means you can't delete a recorded transaction. A keying error gets corrected through a reversing entry, traced and time-stamped, never through an erasure. For a bakery that changes one very ordinary habit: the end-of-day discount on unsold stock has to be entered as a commercial operation, not as a line removed from the ticket. Security requires every record to be protected against later modification, with a chaining mechanism that makes any break detectable.

Retention calls for periodic closings, daily, monthly and annual, each freezing a running total. Archiving requires the data to be locked onto durable storage and produced to the tax administration in a readable exchange format. That last condition is the one that catches bakeries still half on paper. A handwritten cash book falls outside the text, which only covers computerised systems. A spreadsheet used to record daily takings can fall inside it, and no spreadsheet satisfies inalterability: any cell can be rewritten without leaving a trace. It's the most common blind spot among bakers who started <a href="/blog/notebook-to-digital">moving from the notebook to digital</a> through office software rather than through a real POS.

A quick test places your own register. If the software lets you delete an already-validated sale without generating a cancellation entry, condition one fails. If there's no day-end closing with a frozen total anywhere in the interface, condition three fails. And if no menu exports the sales data to a readable file, condition four fails too. Three checks of two minutes each are worth more than an attestation nobody has ever read.

The cases specific to a bakery

The text never mentions bakeries, and four situations from the trade land in areas the general guides skip.

A connected scale that stores payments is a POS system as far as the law is concerned. Weighing a sourdough loaf and then taking payment on the same device is enough to bring the scale into scope. Plenty of bakers check their sales software and forget the scale sitting on the counter. The reverse also holds: multifunction software doesn't have to be certified end to end. If the tool handles production, recipes, stock and payments, only the payment functions are covered. The distinction is worth using when you <a href="/blog/meilleur-logiciel-boulangerie-2026">compare bakery management software</a>. A vendor who won't state the exact scope its document covers deserves one more question.

Several exemptions exist, and they cover a real share of small food businesses. Out of scope: businesses trading only with other businesses, those whose transactions are VAT-exempt, taxpayers under the French small-business VAT franchise including micro-entrepreneurs, and those on the flat-rate agricultural scheme. There's also a less familiar case listed in the <a href="https://www.impots.gouv.fr/professionnel/questions/quel-est-le-champ-dapplication-de-lobligation-de-detenir-un-logiciel-de" target="_blank" rel="noopener noreferrer">tax administration's own FAQ</a> (in French): a business whose payments all pass through a credit institution established in France or in another EU member state. A bakery that no longer takes cash and settles everything by card meets that condition. Few bakeries do, but those that do have nothing to prove.

One last point that gets misread constantly: the law doesn't force anyone to buy POS software. It regulates the one you use. A notebook and a calculator remain perfectly legal, with the drawbacks every baker already knows.

Don't confuse this with the e-invoicing deadline of 1 September 2026

Two separate obligations land in the same month, and the confusion is widespread.

POS certification comes from article 286-I-3° bis. It covers sales to consumers, it has applied since 2018, and the expected proof is a document the vendor or an accredited body issues once. E-invoicing comes from article 289 bis. It covers business-to-business exchanges and starts on 1 September 2026 with the duty to receive invoices, which applies from that date to every company regardless of size. Issuing e-invoices and e-reporting become mandatory on 1 September 2026 for large companies and mid-caps, then on 1 September 2027 for small and medium businesses, which covers nearly every artisan bakery. The timeline and the accredited platform choice are covered in our article on <a href="/blog/facturation-electronique-boulangerie-2026">e-invoicing for bakeries</a>.

The two topics meet on one point. E-reporting requires transaction data from consumer sales to be transmitted to the tax administration, and that data comes out of the register. A bakery whose payments already run through a compliant tool, with clean closings and a standard export, will have roughly one button to click in 2027. A bakery still adding up its takings by hand will be running two projects at once, one of which it should have dealt with back in 2018.

One trap comes up constantly in conversations with vendors. Signing up with an accredited e-invoicing platform says nothing about whether your POS software is compliant. These are two files, two legal texts and two separate pieces of evidence. A bakery can be perfectly in order on one and owe €7,500 on the other.

Key takeaways

The POS compliance obligation has applied since 1 January 2018 and covers every VAT-registered business that records consumer payments on a computerised system. It rests on four cumulative conditions: inalterability, security, retention and archiving of the data.

Since article 125 of the 2026 finance act, signed on 19 February 2026, two proofs are acceptable again: a certificate from an accredited body and an individual attestation from the vendor. The 1 September 2026 deadline that would have made the certificate mandatory is cancelled.

The penalty under article 1770 duodecies of the French tax code is €7,500 (about $8,750) per software or POS system whose compliance can't be established. The business then has sixty days to fix the situation; past that point the fine falls due a second time.

A connected scale that stores payments counts as a POS system. For multifunction software, only the payment functions have to be covered by the attestation or the certificate.

Exempt: businesses trading only with other businesses, those whose transactions are VAT-exempt, taxpayers under the small-business VAT franchise including micro-entrepreneurs, those on the flat-rate agricultural scheme, and businesses whose payments all pass through a European credit institution.

POS certification and e-invoicing are two different obligations. The first covers consumer sales and dates from 2018; the second covers business-to-business exchanges, with mandatory receipt for everyone on 1 September 2026 and mandatory issuing on 1 September 2027 for small and medium businesses. An <a href="/#features">integrated POS and management tool</a> handles both from the same dataset.

Conclusion

Sorting this out takes about fifteen minutes. Open the POS software, read the exact version number from the About screen, then dig through your email or the vendor's customer portal for the attestation or certificate matching that version. If the document is missing, or if it refers to an earlier release, one email to the vendor is enough to request it. Repeat the exercise for the counter scale if it stores payments. File both documents with your tax records, next to the sales ledger. That's everything an audit will ask for.

The subject goes beyond compliance, though. A register that records every sale cleanly, closes its days and exports its data produces exactly the material a baker needs to <a href="/blog/calculate-real-margins">work out real margins</a> and adjust production. The tax constraint and the management tool are the same piece of software. Fournil brings payments, recipes, stock and margin into one interface, at <a href="/#pricing">pricing built for an artisan bakery</a>.

One last word on timing. Lawmakers changed their minds twice in eighteen months on this file, and nothing guarantees a future finance act won't reinstate the certificate requirement. A vendor starting an NF525 process needs several months to complete it. Asking the question now, before the rule moves again, costs one email.