CRA for French Manufacturers: ANSSI, ANFR and CE Marking

French manufacturers face the same CRA obligations as every other EU manufacturer. This page is a country brief for France: how vulnerability and incident reports route through CERT-FR (ANSSI's operational CSIRT), how conformity-assessment bodies are expected to be designated under the French split (ANSSI notifies, COFRAC accredits), how ANFR is the leading candidate for CRA market surveillance pending the formal Journal Officiel instrument (a role often mistakenly attributed to DGCCRF), what the French-language obligations actually require, and which of the Bpifrance and France 2030 lines are open for compliance investment. For the full manufacturer obligation set, see the manufacturer cluster guide.

When this guide applies to you

You are the target reader if your manufacturer "main establishment in the Union" is in France. That means the place where decisions related to the cybersecurity of your products with digital elements are predominantly taken. A French-registered sales subsidiary with engineering offshore is not the main establishment. If your engineering team, your SDLC governance, and the people approving security-update releases sit in France, this guide is for you.

If your main establishment is elsewhere in the EU and you only ship into France, your CRA reports route through the CSIRT of your main-establishment Member State, not CERT-FR. The French-language obligation for user-facing information still applies for any product placed on the French market.

ANSSI and CERT-FR: the French CSIRT route

CRA notifications route through the CSIRT designated as coordinator of the Member State where the manufacturer has its main establishment in the Union. For a manufacturer whose main establishment is in France, that CSIRT is CERT-FR, the operational arm of ANSSI (Agence nationale de la sécurité des systèmes d'information).

ANSSI is attached to the SGDSN and runs the French national certification schemes (CSPN, Visa de Sécurité) and the accredited evaluation centres (CESTI). CERT-FR publishes French-language vulnerability advisories and operates the national vulnerability-coordination stream.

CERT-FR contact: website https://www.cert.ssi.gouv.fr, email cert-fr@ssi.gouv.fr. ANSSI: https://www.ssi.gouv.fr.

The technical channel for the 24h / 72h / 14d reporting cadence is the ENISA single reporting platform, which goes operational on 11 September 2026. A French manufacturer files via that platform with CERT-FR as the receiving coordinator. The CSIRT designation is the routing. The platform is the transport.

Notified bodies: ANSSI notifies, COFRAC accredits

Important Class I products need a notified body (Module B+C or Module H) only where harmonised standards, common specifications, or a certification scheme do not fully cover them. Important Class II products use a notified body (Module B+C or Module H) or an available and applicable certification scheme. Critical products (Annex IV) follow Article 32(4): the Article 8(1) certification route where the Commission has triggered it, otherwise the same Article 32(3) routes.

The French institutional split is:

• ANSSI acts as the notifying authority that formally designates French notified bodies to the European Commission under the CRA. ANSSI evaluates, controls, and notifies the conformity-assessment bodies.
• COFRAC (Comité français d'accréditation) is the French national accreditation body and assesses the technical competence of a candidate before ANSSI notifies it.

The CRA framework for notified bodies applies from 11 June 2026, with ANSSI's accreditation and notification phase running from June to December 2026. As of late May 2026, zero notified bodies are designated EU-wide under the CRA, and France's formal national designation remains pending in the Journal Officiel. The chain is being stood up.

A French manufacturer can use any EU-notified body, not only French-designated ones. Choosing a French-designated one (LNE, LCIE Bureau Veritas, SGS France, and other historically-accredited bodies) is a procurement preference, not a CRA requirement. Final CRA designations are published in the European Commission NANDO database.

ANFR: the CRA market-surveillance authority

CRA market surveillance for products with digital elements placed on the French market is expected to sit with ANFR (Agence nationale des fréquences), not with DGCCRF. ANSSI confirms this institutional direction on its official CRA page at cyber.gouv.fr, and ANSSI itself provides technical support to ANFR in the market-surveillance framework. Verify the final designation in the Journal Officiel before formal filings.

The French implementation path would give ANFR sanction powers up to 15 million euros or 2.5% of global annual revenue for the most serious CRA infringements, within the EU-level ceilings set by the Regulation.

DGCCRF retains its general consumer-product safety inspection role and will continue to surface non-compliant goods at the border or in retail, but the expected CRA market-surveillance role for digital products is ANFR's. Plan toward ANFR, while checking the final JO text before formal filings.

French-language requirements in practice

The CRA requires user-facing product information to be in a language easily understood by users and the local market-surveillance authority. For products placed on the French market, that is French. The Loi Toubon (Law 94-665) independently requires French in all consumer information, so the CRA obligation aligns with a long-standing national rule.

Must be in French:

• The user instructions and product information shipping with the product.
• The manufacturer contact details (name, address, email or other digital contact) wherever they appear, including on the product itself, packaging, or accompanying document.
• The end-of-support date disclosure shown at the point of purchase.

Can be multilingual:

• The product label and CE marking.
• Packaging text.
• Online documentation, provided a French version is reachable.

English is normally accepted for:

• Internal technical documentation. ANFR or any other Member State's market-surveillance authority can request a French translation if they make a reasoned request, so plan for that contingency even if you do not translate proactively.

The EU Declaration of Conformity must be made available in the languages required by the Member State where the product is placed or made available. For France, plan a French version rather than treating translation as an inspection-only contingency.

Selling cross-border from France

French manufacturers selling into Belgium, Spain, Germany, Italy, or any other EU Member State carry the same single-routing rule: your reports still go to CERT-FR, because routing follows main establishment, not per-shipment destination. You do not file with the Belgian, Spanish, German, or Italian CSIRT.

The language obligation does fan out per market. A product shipped into the Spanish market needs Spanish user-facing content. A product shipped into the German market needs German content. The single French-language pack does not cover those markets.

Each receiving Member State's market-surveillance authority can also request your technical documentation in a language easily understood by that authority. If your supply runs broadly across the EU, expect requests in at least one widely-used working language, and treat early translation of the most-requested technical-documentation sections as a practical hedge.

National funding programmes

Unlike the Spanish Plan de Recuperación that is closing its NextGenEU window in 2026, French national programmes for cybersecurity investment remain open and active in 2026 and beyond.

• Bpifrance runs the Diagnostic Cybersécurité (a subsidized cybersecurity audit for SMEs) and the Cyber PME programme. Cyber PME Phase B accepted applications up to 26 November 2025 for companies whose security-plan submission date is after 1 January 2024. Phase A and follow-up calls continue to be staged.
• France 2030 is the national investment plan with cybersecurity-specific calls run jointly by the General Secretariat for Investment (SGPI), Bpifrance, and ANSSI. Cybersecurity-product-development calls are co-financed with the EU Digital Europe Programme, with recent calls offering up to 2 million euros in combined support. CRA-driven security R&D fits where the angle is genuine product-development innovation.
• France Num offers regional diagnostic vouchers run through the chambers of commerce and industry. Useful for an initial Plan de Cybersécurité but not for the full CRA tooling investment.
• Prêt Innovation and the Aide pour le développement de l'innovation are Bpifrance loan and grant lines that can underwrite SBOM tooling, vulnerability-handling capability build-out, and conformity-assessment fees where the cybersecurity work has a genuine innovation component.

Eligibility windows and budget caps change annually. Confirm the current convocation before scoping any line item against these programmes.

This article is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel for specific CRA compliance guidance.