Loi n° 2022-309 du 3 mars 2022 (loi Cyberscore), Cybersecurity Audit and Disclosure Duty
Loi n° 2022-309 du 3 mars 2022, art. 1 (Code de la consommation, art. L. 111-7-3)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 October 2023.
A sector security regimes rule binding private bodies.
As of 12 September 2026.
What it requires
- This binds a large online platform operator under Code de la consommation Article L. 111-7 (an online marketplace, a service ranking or referencing content, or a price-comparison service) above the visitor-count threshold a decree sets. A large number-independent interpersonal communications service (a large-scale messaging application) is separately bound and is not expressed by any activity in this vocabulary.
- Where a threshold decree brings you into scope, have a cybersecurity audit carried out by a provider ANSSI has qualified (a PASSI), covering the security and location of the data you host (directly or through a third party) and your own security.
- Present the audit result to the consumer in a legible, clear and comprehensible form, using a colour-coded scale, in the conditions a joint ministerial order fixes.
- The decree setting the applicability thresholds and the order setting the audit criteria were reported delayed past the statute's 1 October 2023 commencement date; whether they have since been published and what threshold is currently in force is not confirmed in the sources reviewed here.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Code de la consommation Article L131-4 makes a breach of the Article L. 111-7-3 duty subject to an amende administrative (administrative fine), not a criminal offence.
Penalty structure
Code de la consommation Article L131-4, as amended by this law's Article 1(2°), makes a breach of Article L. 111-7-3 subject to an administrative fine of up to EUR 75,000 for a natural person and EUR 375,000 for a legal person.
- Rule
- Fixed only
- As of
- 12 September 2026
- Currency
- EUR
- Fixed cap
- 375,000
Who enforces it
Enforcement body
The Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF), under the Code de la consommation Book V investigation and sanction powers Article L131-4 invokes.
Settledness
- As of
- 12 September 2026
- Guidance link
- https://cyber.gouv.fr/
- Guidance body
- Agence nationale de la sécurité des systèmes d'information (ANSSI)
- Open questions
- Have the decree fixing the applicability thresholds and the joint order fixing the audit criteria been published, and at what threshold, given press reporting found them delayed past the statute's own 1 October 2023 commencement date?
What it reaches
Obligation class
Security, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 1 inserts Article L. 111-7-3 into the Code de la consommation, requiring an online platform operator (opérateur de plateforme en ligne, Article L. 111-7, covering an online marketplace, a ranking or referencing service and a price-comparison service) and a provider of a number-independent interpersonal communications service, above one or more activity thresholds a decree sets, to undergo a cybersecurity audit by a provider qualified by ANSSI (a prestataire d'audit de la sécurité des systèmes d'information, PASSI), covering the security and location of the data it hosts (directly or through a third party) and its own security, and to present the result to the consumer in a legible, clear and comprehensible form using a colour-coded scale, modelled on the Nutri-Score.
A joint order of the ministers responsible for digital affairs and consumer protection, issued after the CNIL's opinion, fixes the audit criteria and the conditions of validity and presentation.
The law entered into force on 1 October 2023 (Article 2); press reporting at the time and since found the decree fixing the applicability thresholds, expected at 25 million unique monthly French visitors for 2024 and 15 million for 2025, delayed past that commencement date, so the practical reach of the duty as of this writing is not confirmed in the sources reviewed here.
When LexLint raises it
operates_social_platform
Read the law
Journal officiel de la République française n°0053 du 4 mars 2022, Loi n° 2022-309