I. Do cash registers have to be NF 525 certified to be in compliance with French law?
No, a cash register does not have to be NF525 certified.
The NF525 standard is a standard that certifies that the cash register software publisher meets compliance criteria (inalterability, security, conservation and archiving)
The NF525 certification is a way for manufacturers to demonstrate compliance with these criteria, but it is not mandatory.
Tunder makes available to its users a nominative certificate of conformity, upon request.
This document, issued by the cash register software publisher, certifies that the principles of inalterability, security, preservation and archiving are respected.
II. Entry into force of the law and fines
The law (Sapin) on cash register software came into force on 1 January 2018, requiring the use of a certified cash register system for all persons subject to VAT. In the event of an inspection, a fine of €7,500 will be imposed for each non-certified software or system, with an obligation to regularize the situation within 60 days.
The conditions of inalterability, security, preservation and archiving of data must be respected by the cash register software.
III. The criteria for a compliant cash register
A. Inalterability condition
Information entered into the software must be protected. Any changes to this information should be made in such a way that it remains reliable and cannot be changed without leaving a trace. To ensure this reliability, various methods can be used. It is important to ensure that the information remains accessible to tax authorities. To protect information, it is the software publisher must use reliable means to back it up, to protect it from changes, to detect changes and to be able to prove its reliability.
B. Security condition
The software should protect data from all forms of deletion or modification without traces. To guarantee this protection, the software must implement reliable techniques such as the record chain and the electronic signature of data.
The same level of security should be put in place when training cashiers by clearly displaying and indicating whether the data is fictional or real. The purpose of security is to ensure that data and changes made are recorded in a secure and accessible manner.
C. Conservation condition
Data must be stored in the system or on an external medium to ensure its integrity and traceability. Data must be kept for 6 years.
The cash register system must complete daily, monthly, and annual closings to record cumulative and integral data.
In the event of hardware or software changes, the counters should be reset to zero and the data from the old system should be archived and secured. In the case of a software update, the counters should continue to be incremented without being reset to zero, and the check totals generated by the fences should be maintained to ensure their integrity.
D. Archival condition
The software publisher must keep the data securely and in a format that can be easily read by the tax authorities in the event of an audit.
Archives must be produced at most once a year, and kept for at least six years. It is possible to keep them on an external physical medium, such as a USB stick or a hard disk, or to entrust them to a third party archiver.
Software publishers or cash register systems must provide a function to generate archive files for users. Data can be purged to free up hard drive space or improve performance, but only after producing a complete archive file.
