The rules decide, the assistant explains
Verdicts come from a deterministic, sourced engine, never from a model that guesses. Here's what Normivia's regulatory assistant evaluates today.
One conclusion, one source, one scope
The themes detailed below are the most requested. The same requirement applies to all 85 standards in the catalog: none enters it without its reference text and its applicability criteria.
- Source
- 85 out of 85
- Applicability
- 85 out of 85
- Status
- 75 in force, 10 upcoming
Every standard cites the text it derives from, article included. You can trace back to the official source without taking our word for it.
A verdict is never "it depends": it follows from written criteria — sector, size, activity — that the engine applies to your declared profile.
What already applies and what's coming are kept distinct, never blended to inflate urgency.
What this catalog is not
Guidance library. Does not constitute legal or tax advice. Check the official texts before making any decision.
Catalog verified on 26 September 2026. Monthly review of official sources, whether or not the texts have changed.
E-invoicing
UpcomingEvery company subject to VAT must be able to receive electronic invoices via a platform (PDP or PPF directory), regardless of size. Issuance of all domestic B2B invoices in electronic format, with e-reporting, follows a timeline staggered by company size.
- Deadline
- Reception: 1 Sept 2026 · Issuance: 1 Sept 2026 (large/mid-size companies) or 1 Sept 2027 (SMEs/micro-businesses)
- Who it concerns
- Any company subject to VAT in France.
- Source
- Art. 26 LFR 2022 · impots.gouv.fr
Payments: ISO 20022 & VoP
In force & upcomingThe addresses of your transfer beneficiaries will need to be structured into distinct fields (ISO 20022): free-text addresses expose you to bank rejections or delays. In addition, since October 2025, your bank verifies the name/IBAN match of every beneficiary before any transfer (VoP); incorrect third-party reference data generates mismatch alerts, blocks and payment delays.
- Deadline
- ISO 20022: 22 Nov 2026 · VoP: in force since 9 Oct 2025
- Who it concerns
- Any company that issues transfers.
- Source
- SWIFT CBPR+ / EPC · Regulation (EU) 2024/886
Sustainability: CSRD & CS3D
In forceSince the Omnibus package (2026), CSRD applies to companies with at least 1,000 employees and €450M in revenue (revised ESRS sustainability report). CS3D (value chain due diligence) applies to groups with at least 5,000 employees and €1.5B in global revenue. Below these thresholds, the direct obligation doesn't apply, but your clients subject to these texts will ask you for ESG data via the voluntary VSME standard, or via one of the international frameworks Normivia also covers: GRI (sustainability reporting), CDP (climate/water/forests questionnaires) and ISSB IFRS S1/S2 (climate-related financial disclosure). For financial institutions, the PCAF framework (financed emissions) is also covered.
- Deadline
- CSRD: fiscal year 2027, published 2028 · CS3D: 26 July 2029
- Who it concerns
- Large companies and groups, with a cascading effect on their suppliers.
- Source
- Omnibus Directive (EU) 2026/470
Taxation: Pillar 2
In forceGroups with global consolidated revenue of €750M or more must file GloBE returns under the 15% global minimum tax.
- Deadline
- In force since 1 January 2024
- Who it concerns
- Groups with global consolidated revenue ≥ €750M.
- Source
- Directive (EU) 2022/2523
AI Act
In force & upcomingEvery company that uses or develops AI systems must have dedicated governance in place (system inventory, designated owner, documentation), regardless of risk level. Prohibited practices (social scoring, behavioral manipulation, emotion recognition at work...) have been subject to sanctions since August 2025, up to €35M or 7% of global revenue. Transparency (informing users they're interacting with AI) has been in force since August 2026; the stricter obligations for high-risk systems (Annex III) arrive in December 2027.
- Deadline
- Governance & prohibitions: in force since 2 February / 2 August 2025 · Transparency: 2 August 2026 · High-risk: 2 December 2027
- Who it concerns
- Any company that uses or develops an AI system, regardless of size.
- Source
- Regulation (EU) 2024/1689 (AI Act), art. 5 and 50
NIS2
UpcomingNIS2 significantly widens the scope of regulated cybersecurity (18 sectors, roughly 15,000 French entities expected according to ANSSI): cyber risk management, incident notification within 24h/72h/1 month, registration with the national authority. Two categories depending on sector and size (essential or important entity), with sanctions of up to €10M or 2% of global revenue.
- Deadline
- Directive in force since 2023, but the French transposition law has not yet been enacted (verified 26/09/2026): no direct legal obligation for now
- Who it concerns
- Medium and large companies in critical sectors (energy, healthcare, digital, manufacturing, chemicals...).
- Source
- Directive (EU) 2022/2555 (NIS2)
DORA
In forceThe broader financial sector (credit institutions, insurance, asset management, payments, crypto-assets) must have an ICT risk management framework, a major incident reporting procedure, and must carry out regular digital operational resilience testing.
- Deadline
- In force since 17 January 2025
- Who it concerns
- Financial sector entities (NAF codes 64, 65, 66).
- Source
- Regulation (EU) 2022/2554 (DORA)
Beyond France
The catalog also covers Luxembourg law and Swiss federal law, verified against the official texts, and applies EU texts according to the country of the head office.
What we're adding next
These regulations are not yet evaluated by the assistant today: they're part of the scope we're building for a future version, on top of what already exists above.
ViDA
VAT in the Digital Age reform