Cryptographic software: understanding the French import and export formalities

Key Takeaways

In France, the use of cryptographic means is unrestricted. However, their supply, import, intra-EU transfer, or export may be subject to formalities with the French National Information System Security Agency (Agence nationale de la sécurité des systèmes d’information – ANSSI).

Encryption is incorporated into a very wide range of software, including VPNs, cybersecurity solutions, secure messaging services, and cloud applications. Depending on the software’s cryptographic functions and the contemplated transaction, a declaration or an application for authorization may have to be filed with ANSSI.

Two regulatory frameworks must be distinguished: the French regime governing cryptographic means, established under the French Law for Confidence in the Digital Economy (Loi pour la confiance dans l’économie numérique – LCEN), and the European regime governing dual-use items. These two regimes are complementary and may require, for the same export transaction, formalities to be completed both with ANSSI and with the French Dual-Use Goods Department (Service des biens à double usage – SBDU). The applicable regime depends primarily on the software’s cryptographic functions and the contemplated transaction.

This article addresses the formalities to be completed with ANSSI. The formalities applicable to dual-use items are discussed in a separate article.

1. Cryptographic means and cryptology services: two concepts that must be distinguished

Article 29 of the LCEN defines a cryptographic means as “any hardware or software designed or modified to transform data, whether information or signals, using secret conventions, or to perform the reverse operation, with or without secret conventions. The primary purpose of such cryptographic means is to ensure the security of data storage or transmission by ensuring confidentiality, authentication, or integrity control.”

A cryptology service includes “any operation aimed at implementing cryptographic means on behalf of another party.”

This distinction is essential because supplying software and providing a service that implements that software are not subject to exactly the same formalities.

1.1 Supply of cryptographic means

According to article 30 of the LCEN, the use of cryptographic means is unrestricted.

Article 30 also provides for an unrestricted regime for the supply, transfer from or to an EU Member State, and import or export of cryptographic means that exclusively provide authentication or integrity-control functions.

However, where software does not exclusively provide authentication or integrity-control functions but also, for example, ensures data confidentiality, its supply, import, transfer, or export may be subject to a declaration or authorization from ANSSI.

The formalities are the responsibility of the supplier or first importer.

1.2 Provision of cryptology services

The provision of a cryptology service is subject to prior declaration to ANSSI unless it falls within a category exempted under Annex 1 to the Decree of May 2, 2007. (1) The declaration requirements are specified in the Decree. A distinction must therefore be made between distributing software and implementing that software on behalf of a customer as part of a service.

2. What types of software are concerned?

Several types of software may fall within the regulations governing cryptographic means.

2.1 Encryption software and business software

Depending on their technical characteristics, the software concerned may include file or database encryption software, encrypted backup software, VPNs, secure messaging solutions, key-management solutions, and certain cybersecurity tools.

However, the mere use of a cryptographic algorithm is not sufficient to determine the applicable regime. The software publisher or first importer must be able to identify the purpose of the functions used (authentication, signature, integrity, or confidentiality), the algorithms, key lengths, functionalities available to the user, and whether encryption is a primary or ancillary feature.

This analysis is particularly important for management software, ERP systems, or business applications in which cryptography is merely a technical security feature: the product’s commercial name or general purpose is not sufficient to determine its classification.

2.2 Cryptanalysis means

Cryptanalysis refers to techniques used to defeat cryptographic mechanisms in order to obtain protected information, such as plaintext, passwords, or cryptographic keys. Software capable of performing such operations does not constitute a separate category under the LCEN. However, it is subject to enhanced controls and must be identified separately for classification purposes.

3. Classification of the cryptographic means determines the applicable formalities

The applicable regime depends both on the cryptographic functions involved and on the contemplated transaction: supply, import, intra-EU transfer, or export. It is necessary to determine successively whether an exemption applies, whether the product qualifies for “mass-market” classification and, failing that, whether a declaration or an application for authorization is required.

3.1 Exempt cryptographic means

Article 1 of the Decree of May 2, 2007 exempts certain categories of cryptographic means from prior declaration or authorization requirements, subject to the conditions set out in Annex 1. These exemptions include, in particular, certain products whose cryptographic functions are limited, standardized, or ancillary, as well as certain specific uses or transactions.

Annex 1 covers, for example, certain radio communication or audiovisual equipment, copy-protection devices, products used for information-system administration, and certain products imported or transferred for personal, development, validation, or demonstration purposes.

Whether an exemption applies always depends on the technical characteristics of the product and the transaction concerned. Annex 1 to the Decree must therefore be reviewed on a case-by-case basis.

3.2 “Mass-market” classification

Certain widely distributed products falling within categories 1 or 2 of Annex 2 to the Decree may qualify for “mass-market” classification (classement “grand public”) if they meet three cumulative conditions: they are routinely made available to the public through unrestricted over-the-counter sales, their cryptographic functionality cannot easily be modified by the user, and they can be installed without significant assistance from the supplier. (2)

Mass-market classification therefore depends on how the product is marketed, modified, and installed, rather than on whether the user is a consumer or a business.

The request for mass-market classification is made by the supplier at the time of filing the declaration. The classification must be approved by ANSSI. Once issued, the resulting mass-market certificate allows the product to be exported without applying for an export authorization.

3.3 Declaration

The import into France and supply in France of cryptographic means are subject to declaration, unless an exemption applies. Certain transfers or exports covered by Annex 2 to the Decree are also subject to this requirement, as is the provision of non-exempt cryptology services.

The declaration must be filed at least one month before the transaction. This period is extended to two months for the provision of a cryptology service or the export of cryptographic means to a non-EU country. If the application is incomplete, the period starts again once the additional information has been received. If no objection is raised by the end of the applicable period, the transaction may proceed. ANSSI may issue a certificate confirming that the required formality has been completed.

The declaration form for cryptographic means is available on ANSSI’s website. For cryptology services, the declaration is made using the form attached as Annex II to the Order of January 29, 2015. (3)

The Decree does not specify a fixed validity period for a declaration. However, any material change to the software or its cryptographic functions should prompt a review of whether the initial formality remains sufficient or whether a new or updated declaration must be filed.

3.4 Application for authorization

The transfer from France to another EU Member State and the export to a non-EU country of cryptographic means that do not exclusively provide authentication or integrity functions are subject to authorization, unless an exemption applies or the declaration regime provided for under the Decree is available.

Before filing an application, it is therefore necessary to review successively the cryptographic functions of the product, the contemplated transaction, and the categories set out in the annexes to the Decree.

The same form is used for an application for authorization as for a declaration. ANSSI has four months to notify its decision once the application is complete. The application is deemed complete if no additional documents are requested within two months of receipt. If additional documents are requested, the four-month period starts upon their receipt. If no decision is issued within that period, the administration’s silence constitutes authorization for a period of one year.

An export authorization may be issued for a maximum period of five years. It must be available where the exporter subsequently needs to apply for a license from the SBDU.

An application for authorization may be renewed under the same conditions as the initial application.

3.5 Summary table: ANSSI declaration or authorization

In summary, declaration is the general regime applicable to transactions involving entry into and supply within France. For transactions involving products leaving France, it is necessary to determine whether the cryptographic means qualifies for an exemption or for the declaration regime under Annex 2 to the Decree; otherwise, an authorization is required. Cryptanalysis means are subject to an enhanced regime: transfers or exports from France require an authorization.

The applicable regime therefore cannot be determined solely on the basis of the software’s destination. It requires a combined assessment of the nature of the transaction, the cryptographic functions involved, and the categories set out in the annexes to the Decree.

4. Best practices before a transaction involving cryptographic software

Before carrying out any transaction involving cryptographic software, it is recommended to:

·       identify the software’s cryptographic functions and determine whether it constitutes a cryptographic means;

·       determine whether the contemplated activity also constitutes a cryptology service;

·       identify the transaction concerned: supply, import, intra-EU transfer, or export;

·       determine whether an exemption applies or whether the product qualifies for “mass-market” classification;

·       prepare the technical documentation and anticipate the applicable declaration or authorization timeframes;

·       reassess the classification whenever the software’s cryptographic functions evolve.

The regulatory classification should be determined before the product is marketed or shipped, rather than when the transaction is due to be carried out.

Failure to comply with the formalities applicable to cryptographic means may result in criminal penalties.

For individuals, failure to declare cryptographic means is punishable by one year’s imprisonment and a fine of €15,000. Exporting or transferring cryptographic means without the required authorization is punishable by two years’ imprisonment and a fine of €30,000. Providing, without declaration, a cryptology service that ensures confidentiality is also punishable by two years’ imprisonment and a fine of €30,000.

For legal entities, the maximum fine is increased to €75,000 for the first offense and €150,000 for the other two offenses. (4)

* * * * * * * * * * *

(1) Decree No.2007-663 of May 2, 2007 implementing articles 30, 31 and 36 of Law No.2004-575 of June 21, 2004 on Confidence in the Digital Economy (LCEN) and relating to cryptographic means and cryptology services.

(2) Annex 2 to Decree No.2007-663 of May 2, 2007.

(3) Order of January 29, 2015 defining the form and content of declaration files and applications for authorization relating to transactions involving cryptographic means and cryptology services.

(4) Article 35 of the LCEN and articles 131-38 and 131-39 of the French criminal code.

Bénédicte DELEPORTE

Avocat

Deleporte Wentz Avocat

www.dwavocat.com

August 2026