France's B2B E-Invoicing Mandate Is Live: Verifying the DGFiP's Real 'PA' Registry

Today, 1 September 2026, France's B2B e-invoicing reform becomes binding. Every company established in France must now be able to receive electronic invoices through a registered platform. Large enterprises and mid-caps (ETI) must additionally issue invoices and transmit e-reporting data the same way — small and micro-enterprises get until September 2027 for that half of the obligation. If your SaaS bills French business customers, invoices French suppliers, or builds accounting/ERP tooling that touches either side of that flow, this is no longer a "coming reform" — it's live infrastructure you need to plug into correctly, starting today.

Most coverage of this mandate is either stale (written before the terminology changed) or vague (written by people who never opened the actual government registry). Three things changed or became newly relevant in the last five weeks that most guides published before August don't reflect: a decree quietly renamed the core legal entity, the tax authority itself got breached, and the "grace period" everyone's citing is more conditional than it sounds.

The name changed under everyone's feet: PDP is now "PA"

Until late July 2026, the certified operators that route invoices between businesses and the tax administration were called Plateformes de Dématérialisation Partenaires (PDP). Décret n° 2026-677 du 27 juillet 2026, published in the Journal Officiel on 28 July and effective 29 July 2026, replaces that term throughout the tax code's regulatory annex with Plateforme Agréée (PA — "approved platform"). The decree also tightens what a PA has to commit to: a surveillance audit report within two years of receiving its registration number, prompt disclosure of any material ownership or control change, and (new) a formal procedure for customers switching providers — five-day opposition windows, fifteen-day directory-update windows, and a one-year data-retention obligation on the platform you're leaving.

The practical trap: the DGFiP's own official registry page still lives at a URL literally named liste-des-plateformes-de-dematerialisation-partenaires-pdp-immatriculees-sous-reserve — the government hasn't gotten around to renaming its own web address to match its own decree. If you or a teammate bookmarked "the PDP list" in July, that bookmark still resolves correctly; if you're searching fresh in September and only look for "PA registry," you may miss it because Google still has the old slug indexed more heavily than the new terminology. Search for both terms.

What the registry actually contains — verified today, not from a July snapshot

Every third-party "list of approved platforms" article circulating right now cites a static count from whenever it was written — 146 platforms, 156, 163, take your pick. None of that matters as much as knowing how to check for yourself, because the list changes weekly. The DGFiP publishes two separate files, in ODS, XLSX, and PDF, linked directly from the official registry page:

• liste_pa_attente_rapport_audit.xlsx — platforms that have passed interoperability testing and are operating under provisional registration, pending their two-year compliance audit. This is the list of platforms you can actually build against today.
• liste_pa_attente_test_interop.xlsx — platforms whose registration file is complete but which have not yet passed interoperability testing. Notably, this file's own column headers omit "date de délivrance du numéro d'immatriculation" (registration-number issuance date) — a detail visible only by actually opening the file, and a sign these operators don't have a live registration number yet, whatever their marketing site claims.

Downloading both files directly on the morning of 1 September 2026 for this piece: the operational list carried 151 platform entries, the pending-interoperability list carried 17 — a live combined count of roughly 168, up from the ~166 reported by third parties a few days earlier. That trajectory (adding platforms in the final week before go-live) is itself useful signal: this is an actively moving target, not a fixed list you can screenshot once and trust for the next quarter.

A zero-dependency way to check a provider yourself

You don't need openpyxl or any third-party library to check whether a platform name appears in either list — an .xlsx file is just a zip archive with an XML shared-strings table, and Python's standard library can read both:

import re
import urllib.request
import zipfile
from io import BytesIO

REGISTRY_BASE = (
    "https://www.impots.gouv.fr/sites/default/files/media/1_metier/"
    "2_professionnel/EV/2_gestion/290_facturation_electronique/"
    "listes_plateformes_agreees/"
)
LISTS = {
    "operational (passed interoperability testing)": "liste_pa_attente_rapport_audit.xlsx",
    "pending interoperability testing": "liste_pa_attente_test_interop.xlsx",
}


def fetch_shared_strings(url: str) -> list[str]:
    req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
    with urllib.request.urlopen(req, timeout=20) as resp:
        data = resp.read()
    with zipfile.ZipFile(BytesIO(data)) as z:
        xml = z.read("xl/sharedStrings.xml").decode("utf-8", errors="ignore")
    return re.findall(r"<t[^>]*>([^<]*)</t>", xml)


def check_platform(name_substring: str) -> None:
    found_any = False
    for label, filename in LISTS.items():
        strings = fetch_shared_strings(REGISTRY_BASE + filename)
        matches = [s for s in strings if name_substring.lower() in s.lower()]
        if matches:
            found_any = True
            print(f"MATCH in '{label}' list: {matches}")
    if not found_any:
        print(
            f"No match for '{name_substring}' in either DGFiP list as of today. "
            "Re-check spelling, or treat any 'PA' claim from this vendor as unverified."
        )


check_platform("A-Cube")

Run this against whatever your provider's marketing page calls itself before you sign a contract or wire your first e-reporting feed through them — "PDP-ready" or "PA-compatible" language on a vendor's homepage is not the same claim as an actual row in the DGFiP's file. This same technique works for any downstream integration you build: cache the two lists nightly, diff them against yesterday's snapshot, and alert your team when a platform you depend on drops off the operational list (deregistration for repeated non-compliance is an explicit possibility under the July decree) or a new competitor appears.

Why the DGFiP's own August breach raises the stakes, not the deadline

On 14 August 2026, France's tax administration confirmed what a criminal forum post had claimed two days earlier: an attacker had used a compromised employee VPN identity to query internal systems and extract data on 678,000 taxpayers — names, tax reference income, family quotient, and withholding rates. The intrusion itself happened at the end of June 2026 and went undetected until the data surfaced for sale in August. ANSSI (France's national cybersecurity agency) and CNIL (the data protection authority) are both involved in the ongoing investigation.

The reform did not slip because of this. French officials have been explicit that 1 September 2026 is a soft landing, not a delay — the breach changed nothing about the calendar. What it should change is how carefully you treat any credential or connection that touches French tax infrastructure, directly or through a PA. The DGFiP's own incident was not a sophisticated exploit — it was one person's VPN identity, reused to run bulk queries nobody noticed for six weeks. If your e-reporting pipeline holds a long-lived API key or service-account credential for your chosen PA, this is the week to confirm it's scoped to the minimum required permission, rotated on a real schedule, and monitored for anomalous query volume — the exact failure mode that just played out at the agency on the other end of your integration.

The "soft landing" is real, but it is not a blank check

Article coverage of the "no penalties at launch" rule tends to flatten it into a four-month free pass. The actual position, as reported from the Minister of Public Accounts, is narrower: penalties won't be applied automatically to businesses acting in good faith through 31 December 2026, but "good faith" is being interpreted as demonstrable progress, not a statement of intent. If the DGFiP contacts you about a gap, showing a signed PA contract, a migration timeline, and evidence of partial implementation is what the tolerance is actually built around — showing nothing, or showing that you haven't started, is not covered by it. Treat 1 January 2027 as your real hard deadline for anything you can't finish today, and treat the next four months as the window to fix gaps you find, not to ignore the mandate entirely.

What to actually do this week

1. Confirm your PA (or your accounting software's PA) is on the operational list, using the registry directly — not a vendor's own claim, not a third-party comparison site with a stale snapshot date.
2. Check both lists, not just one. A platform on the "pending interoperability" file can complete a registration form and take your money without being able to actually exchange invoices with other platforms yet.
3. Search the registry under both "PDP" and "PA" until the DGFiP's own indexing catches up with its own decree — don't let outdated bookmarks or stale search results tell you a platform doesn't exist.
4. Audit the credentials your e-reporting pipeline uses for scope and rotation — the DGFiP's own August breach is a live example of what a stale, over-privileged, unmonitored credential costs.
5. If you're not fully compliant today, document what you have (signed contract, timeline, partial rollout) rather than doing nothing — that documentation is what the soft-landing tolerance through 31 December 2026 is actually conditioned on.
6. Re-check the registry on a schedule, not once. Registrations can lapse under the July decree's audit and disclosure requirements; a provider compliant in September is not guaranteed to still be listed in December.

Sources

• Décret n° 2026-677 du 27 juillet 2026 relatif à la généralisation de la facturation électronique (Légifrance) — PDP → PA terminology change, audit/disclosure/switching requirements, entry into force 29 July 2026.
• DGFiP — "Facturation électronique et plateformes agréées" (official registry page) — PA definition, 1 September 2026 mandate date, three-year renewable registration.
• DGFiP — official registry file list (ODS/XLSX/PDF) — direct downloads used to verify live platform counts on 1 September 2026.
• vatcalc.com — "France insists no delay to Sept 2026 e-invoicing & e-reporting" — soft-landing scope, good-faith conditionality, no postponement confirmation.
• The Record (Recorded Future News) — "French tax authority DGFiP confirms data breach" — breach discovery timeline, VPN-identity attack method.
• Escudo Digital — "French Treasury confirms cyberattack compromising data of 678,000 taxpayers" — confirmed victim count, ANSSI/CNIL involvement.