Penalties and audits: what non-compliant cash software costs
Using cash-register software that does not meet the ISCA requirements exposes the business to a fine of €7,500 per software, set out in article 1770 duodecies of the CGI. That fine is assessed through a dedicated on-the-spot control — and it is not the only exposure: a false compliance document is a criminal offence, and a proof that no longer matches the version in use can leave a business non-compliant without realising it. Here is how the risk works, and how to reduce it.
The fine: €7,500 per software
Article 1770 duodecies of the CGI sets a fine of €7,500 for non-compliant cash-register software or systems. It is charged to the business using the software, whether it owns or leases it. The exposure is not capped at a single €7,500: a business running several non-compliant systems can be fined on each, so it scales with the size of the deployment rather than being a one-off.
How an audit works: the on-the-spot check
Verification runs through a specific procedure under article L. 80 O of the LPF — not the slow, written process many businesses expect. Inspectors can arrive unannounced at the place of business, during opening hours (typically between 8:00 and 20:00), hand over a notice of intervention, and ask to see a valid supporting document there and then: a certificate from an accredited body (LNE or InfoCert), or an individual publisher attestation matching the official template. They may also test the software live — for example, attempting a deletion or checking the journals.
If you cannot present a valid document during the visit, you are not fined on the spot. The inspector draws up a report (procès-verbal), and you then have 30 days from that report to produce the certificate or attestation. Produce it in time, and no fine is due. Miss the 30-day window and the €7,500 fine applies. You then have until the end of a 60-day period, counted from the day after the report (the same starting point as the 30 days), to bring the system into compliance. If a later inspection finds the system still non-compliant, a further €7,500 fine can be imposed. This on-the-spot control is distinct from, and can be followed by, a full accounting audit.
The proof must match the exact version in use
A certificate or attestation is valid only for a specific major version of the software. If the publisher changes any part of the code that touches the secure fiscal perimeter — inalterability, signing, journaling, archiving — that creates a new major version, which needs its own updated certificate or attestation. A minor version that leaves those functions untouched stays covered.
The practical trap: a merchant running version 3.0 while holding a document that only names version 2.4 is technically non-compliant at audit, and fully exposed to the €7,500 fine — even though the software may well be compliant in substance. For publishers, the takeaway is operational: issue an updated document with every major release, and make sure customers actually receive and store it.
Criminal exposure for fake documents
Beyond the tax fine, a fabricated, backdated, or knowingly false certificate or attestation is a criminal offence under article 441-1 of the Penal Code, punishable by up to three years’ imprisonment and a €45,000 fine. This reaches both sides: the merchant who knowingly presents a fake document to an inspector, and the publisher — including a foreign publisher — that fabricates or issues a false attestation or a false copy of a certificate.
Who the fine targets
The €7,500 fine targets the VAT-liable user holding the non-compliant software. But where the non-compliance stems from a defective attestation, the liability of the publisher that issued it is engaged — and, if the document was knowingly false, the criminal exposure above applies on top.
Reducing the risk
- Hold an up-to-date supporting document matching the exact version in production.
- Re-issue the document on every major release, and push it to customers so they can store it — don’t assume they will ask.
- Keep the technical documentation and version history, ready to present quickly during an unannounced visit.
- Choose knowingly between the two modes of proof, based on your customers and market.
Not to be confused with e-invoicing
The penalties described here belong to the anti-fraud regime for cash-register software. They are separate from the rules and penalties specific to e-invoicing. Don’t mix the two regimes.
Next steps
The best way to avoid the fine is to start from a compliant technical foundation. fiskaly SIGN FR covers the four ISCA requirements — signing, tamper-proof journaling, conservation, and archiving — to make your mode of proof solid at an audit. Test the API for free, with no commitment, or talk to our team.
Related reading: Who must comply with French fiscalization? Scope and exemptions, French fiscalization explained: the four ISCA obligations, VAT recodification CGI to CIBS: impact on certified cash register software.
Last updated: October 2026. This article is general guidance, not legal or tax advice. Confirm the applicable scope and requirements against the French tax authority’s current guidance (BOFiP, bofip.impots.gouv.fr) and the text of article 286-I-3° bis of the CGI on Légifrance.
