When can cryptographic software qualify as “mass-market”?
Key takeaways
Certain cryptographic software products that are commonly available on the market may qualify as “mass-market.” This regime nevertheless requires a prior declaration to ANSSI and compliance with specific criteria.
Software incorporating cryptographic functions may be subject to regulatory formalities when supplied, imported into, or exported from France.
The Decree of May 2, 2007 establishes a specific classification system for certain cryptographic tools commonly available on the market: the so-called “mass-market” classification. (1)
For software publishers and suppliers, this classification has significant practical benefits. Once a cryptographic product has been classified as “mass-market” by ANSSI, the software may be exported without having to apply for an export authorization from ANSSI. This nevertheless requires a prior declaration to ANSSI and compliance with certain conditions.
This article supplements our two previous articles on cryptographic products: understanding import and export formalities and the formalities applicable to dual-use items.
1. What does “mass-market” classification mean for cryptographic software?
The Decree of May 2, 2007 on cryptographic products and services sets out the rules applicable to the supply, import, transfer, and export of cryptographic products.
For software incorporating cryptographic functions, the “mass-market” classification does not simply depend on widespread commercial distribution or on the software being intended for a large number of users. It is a regulatory classification based on specific conditions.
A supplier cannot rely on the “mass-market” classification solely on the basis of its own assessment of the software. The classification must be requested when the cryptographic product is declared and must then be validated by ANSSI.
To qualify as “mass-market” (Annex 2, Category 3), a cryptographic product must first fall within Category 1 or 2 of the Decree and then meet the following three cumulative criteria: (2)
i. The product must be commonly available to the public. The Decree refers to cryptographic products “sold directly from stock, without restriction, at retail selling points, whether such sales are made over the counter, by mail order, by electronic transactions or by telephone.” It must therefore be possible to demonstrate that the software is actually offered to the public through a standardized distribution model.
ii. The software must be designed so that its cryptographic functionality cannot easily be modified by the user.
iii. Its installation must not require “substantial subsequent support from the supplier,” meaning that the software must be capable of being installed by the user without substantial technical intervention by the supplier.
This third condition applies to packaged software that can easily be downloaded, installed, and configured using standard user documentation. Conversely, packaged software requiring complex integration, specific cryptographic configuration, or significant intervention by the supplier would not satisfy this final condition.
If the mass-market classification is validated, ANSSI issues the corresponding classification certificate. This certificate then allows the cryptographic product to be exported without having to apply for an export authorization from ANSSI or an export license from the SBDU, the French Dual-Use Goods Service.
2. How to obtain “mass-market” classification
2.1 The request is submitted as part of the declaration to ANSSI
The request for “mass-market” classification is submitted when the cryptographic product is declared to ANSSI.
The form and the list of supporting documents are prescribed by the Order of January 29, 2015. (3) The information to be provided in the form includes a general description of the cryptographic product and its technical characteristics.
The form contains a specific section for cryptographic products falling within Category 3 of Annex 2 to the Decree of May 2, 2007 (mass-market cryptographic products). The declarant must provide information demonstrating that the three conditions referred to above are satisfied.
The declarant is required to describe:
· how the product is marketed and the market for which it is intended. The declarant may describe the distribution channels used, the conditions under which the software may be purchased or downloaded, and the target customer base;
· why its cryptographic functionality cannot easily be modified by the user. The declarant may specify which functions can be configured by the user and which remain embedded in the product;
· why its installation does not require substantial support from the supplier. The installation process may be described by reference to the deployment procedure, user documentation, or any other material demonstrating that the product can be installed without significant intervention by the software publisher.
The information provided must enable ANSSI to understand how the software operates and how it is distributed.
The commercial materials, technical documentation, and application submitted to ANSSI must be consistent. For example, commercial documentation highlighting extensive possibilities for users to customize cryptographic functions while the declaration form states otherwise could raise questions as to whether this criterion is satisfied.
2.2 ANSSI validates or refuses the classification
Filing the declaration does not automatically result in “mass-market” classification. ANSSI reviews the information provided and may validate or refuse the classification if it considers that the regulatory requirements have not been met.
If the classification is validated, ANSSI issues a classification certificate. This certificate is required for exporters’ customs formalities.
If “mass-market” classification is refused, the export of the software must then be assessed under the normally applicable regime.
When reviewing the declaration, ANSSI may request additional technical information, including the source code of the cryptographic product, in order to verify its characteristics against the information provided in the declaration. (4)
Finally, the classification should be reassessed whenever a new version of the software materially changes its cryptographic functions, configuration options, or distribution model.
* * * * * * * * * * *
(1) Decree No.2007-663 of May 2, 2007 implementing Articles 30, 31 and 36 of Law No.2004-575 of June 21, 2004 on Confidence in the Digital Economy and relating to cryptographic products and services
(2) See Annex 2, Part B, Category 3 of the Decree. Category 1 covers cryptographic products that do not exclusively provide authentication or integrity-control functions and that implement certain cryptographic algorithms exceeding the thresholds set by the Decree. Category 2 covers certain products using frequency-hopping or ultra-wideband modulation techniques. See Annex 2, Part A, Categories 1 and 2 of Decree No.2007-663 of May 2, 2007.
(3) Order of January 29, 2015 defining the form and content of declaration files and applications for authorization relating to cryptographic products and services
(4) Article 7 of Decree No.2007-663 of May 2, 2007
Bénédicte DELEPORTE
Avocat
Deleporte Wentz Avocat
October 2026