NF525 in plain terms
NF525 is a certification issued by an independent body to a piece of point-of-sale software or a full till system. It confirms that the product meets the four French tax requirements: sales data must be tamper-proof, secured, retained and archived.
Watch out for the most common misunderstanding. NF525 is not a law. The law is article 286-I-3 bis of the French tax code, introduced by the 2016 Finance Act and in force since 1 January 2018. It requires compliance, not the NF software certificate specifically.
Put differently: NF525 is one of two ways to prove you are in order. The other is an individual statement of compliance issued by your software vendor. In the eyes of the tax authorities, both carry exactly the same legal weight.
Who NF525 applies to
The rule is narrower than most people assume. It targets VAT-registered businesses that record payments from private customers in POS software. A restaurant, a bar, a bakery, a salon: yes. A wholesaler who only invoices other businesses: no.
- You take payments from private customers using POS software or a till system: you are covered.
- You still use a duplicate receipt book or a purely mechanical cash register with no memory: the obligation does not apply.
- You fall under the small-business VAT exemption scheme, or you are otherwise VAT-exempt: you are outside the scope.
- You invoice businesses only, with an invoice for every transaction: out of scope.
The point that gets overlooked: a spreadsheet or an invoicing tool that also gets used to take payments falls squarely within scope. What matters is not what the product is called, but how it is actually used at the counter.
What NF525 certification guarantees
NF525 checks that your till system honours four commitments. These are the four pillars every vendor knows by heart.
Tamper-proof records
Once a sale line is validated, it can never disappear. You can correct it, never delete it. A cancellation creates an additional entry, traced, time-stamped and signed. There is no way to rewrite last night's takings the following morning.
Security
Recorded data is chained together with an electronic signature. Touch a single receipt and the chain breaks, which an inspection picks up immediately. This is the core defence against VAT fraud.
Retention
The software produces daily, monthly and annual closing reports that are cumulative and tamper-proof. They must remain accessible for six years, the period during which the tax authorities can reassess you.
Archiving
The retention and archiving rules mean data has to be exported in a readable, frozen format that an inspector can open without the original software. If your vendor shuts down tomorrow, the archives must still be usable.
In practice, nine restaurant owners out of ten discover their certificate exists the day an inspector asks for it. The document was there all along; nobody had ever opened it.
Which POS systems are compliant today
Almost every professional solution sold in France since 2018 is compliant. The real question is not the brand, but the version and how you use it.
The established hospitality players, touchscreen tills sold through specialist resellers, consumer payment solutions such as SumUp or Zettle, ERPs such as Odoo: all offer a compliant version. But in several cases, compliance depends on a paid module or a French localisation you have to switch on.
Odoo is the textbook example: the certificate covers the Enterprise edition with the French module installed, not a bare Community instance. SumUp, for its part, provides a statement of compliance for its POS products, but a plain card payment terminal is not a till system and falls outside the scope.
NF525 certification or a vendor statement
Both routes lead to compliance. They do not cost the same or carry the same weight.
| Criterion | NF525 certification | Vendor statement |
|---|---|---|
| Who issues it | Accredited third-party body (AFNOR Certification, Infocert) | The software vendor, on its own responsibility |
| Legal weight | Identical | Identical |
| Checks beforehand | Technical and documentary audit, then follow-up audits | No external check |
| Cost to the vendor | Several thousand euros a year, often passed on | Marginal |
| Effect on your price | Roughly 10 to 20 % more on the subscription | None |
| Risk in a dispute | Low, independent proof | Higher if the vendor disappears |
How to tell whether your till is compliant
Five checks are enough, and they take less than half an hour.
- Look in your customer account for the certificate or statement of compliance, as a PDF, issued in your trading name.
- Check the date: the document must cover the version you are running today, not the one from 2019.
- If the document mentions AFNOR or Infocert, verify the certificate number on that body's website.
- Run a test closing report and try to delete a receipt: a compliant system will refuse and create a cancellation entry instead.
- Export your tax archives and open the file outside the software. If it is unreadable, your archiving is not compliant.
If you find nothing, write to your vendor and ask explicitly for the certificate or statement covering your version. A serious supplier replies within 48 hours. Prolonged silence tells you something.
What happens during an inspection
Since 2018, an officer can turn up unannounced for a spot check limited to this single point. They ask for the document, sometimes test a cancellation, and look at the closing reports. The visit rarely lasts more than an hour.
If you can produce nothing, the fine is 7,500 euros per software product concerned, with 60 days to put things right. Miss that deadline without proof and the penalty applies again. So keep the PDF in the office folder, not just in an inbox.
Orders, payments and the till: what actually counts
Plenty of restaurant owners add a digital menu, order-at-table or pay-by-phone, then wonder whether that creates a new obligation. The answer hinges on one thing: does the tool record the payment, or does it merely trigger it?
A digital menu that displays your dishes and sends the order through is not recording a payment. Your till is what records the sale, signs the line and archives it. Compliance still sits with the POS system. If you set up QR code payment at the table, simply make sure the payments flow into the till and not into a spreadsheet running alongside it.
On the technical side, nothing exotic is going on: a code on screen, a scan, a redirect. If this is new to you, our explanation of how a QR code works clears up most of the questions in a few minutes.
The rule fits in one sentence: get certified where the money is recorded, and keep everything else simple.