Structuring and registration

Register a company in France as a foreign business: EU corporate structuring before incorporation

Registering a company in France as a foreign business is usually treated as an administrative step to be settled after the commercial decision. It is the other way round. EU corporate structuring comes first, because the form determines who bears the debts, where the profit is taxed, which social security regime the director falls under, and which European regulatory obligations apply, to which entity and against which thresholds. None of those effects is easy to undo.

By Younès Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .

The three forms and what actually separates them

The representative office

It may carry out no commercial activity. Its purpose is limited to prospecting, representation, advertising, market watch and preparatory contacts. It does not invoice, does not contract in its own name and generates no profit. It is the lightest form and the most constrained: as soon as an effective commercial activity is carried on, the characterisation falls away, with the tax consequences that follow. It suits an exploratory phase, rarely more.

The branch

A branch is a permanent establishment of the foreign company, with a degree of management autonomy and a legal representative, but without separate legal personality. It has no capital of its own and no separate estate: commitments entered into by the branch are those of the parent company, which answers for them on the whole of its assets. It may carry on a full commercial activity and must be registered with the commercial register.

The subsidiary

A subsidiary is a company incorporated under French law, most often a société par actions simplifiée or a société à responsabilité limitée, with its own legal personality and its own estate. The parent is exposed only to the extent of its contribution, save for established mismanagement, a guarantee given, or commingling of assets. It is the form that ring-fences the risk.

Tax nexus and the social security regime of the director

The tax analysis does not start from the legal form but from the presence of a permanent establishment. A foreign company is taxable in France on profits attributable to a business carried on in France, that notion being refined, where a bilateral tax treaty applies, by the treaty definition of permanent establishment, generally modelled on the OECD convention.

A branch carrying on an effective commercial activity is in principle a permanent establishment. A representative office genuinely confined to preparatory or auxiliary activities is in principle not. The difficulty is that the characterisation is assessed on the facts, not on the label: an office whose manager habitually negotiates and concludes contracts binding the foreign company is regularly recharacterised, with retroactive effect.

The social security position of the director is the point most often discovered after incorporation. The president of a société par actions simplifiée is, in respect of a remunerated office, affiliated to the general social security scheme as an assimilated employee, with the corresponding cover but without unemployment insurance, and at a contribution cost appreciably higher than that of a self-employed person for the same net remuneration. The majority manager of a société à responsabilité limitée falls under the self-employed scheme: lower contributions, and correspondingly lower cover, particularly for supplementary pension and provident benefits. A minority or equal-holding manager who is remunerated is treated as an assimilated employee.

For a branch, the legal representative is an officer of the foreign company: affiliation depends on their personal situation, their residence, and where relevant the European social security coordination regulations or the applicable bilateral convention.

The effect on European regulatory scope

GDPR: Article 3(1) replaces Article 3(2)

A company established outside the Union falls under Regulation (EU) 2016/679 by virtue of Article 3(2) as soon as it offers goods or services to persons in the Union or monitors their behaviour, and must then designate a representative in writing under Article 27. Opening an establishment in the Union shifts the analysis to Article 3(1), and the representative obligation falls away. The choice of form therefore changes the obligations, in a direction that lightens them.

NIS2: thresholds are assessed per entity

The thresholds in Article 2 of Directive (EU) 2022/2555 are assessed at the level of the entity, by reference to Recommendation 2003/361/EC. A French subsidiary, being a distinct entity, is assessed on its own, subject to the linked-enterprise rules of that Recommendation. A branch, having no legal personality, is not a distinct entity: it is the foreign company that is assessed. The outcome can differ entirely.

DORA: the category of entity follows from the licence

Article 2 of Regulation (EU) 2022/2554 lists the entities covered by legal category, each corresponding to a regulated status. That status is obtained through a licence, the conditions for which generally presuppose an entity incorporated under national law. The form of establishment therefore precedes the licence, which itself precedes whether DORA applies.

AI Act: scope does not depend on establishment

Article 2 of Regulation (EU) 2024/1689 covers providers placing systems on the Union market irrespective of where they are established, and providers and deployers established in a third country where the output produced by the system is used in the Union. It is the only one of the four instruments that the choice of form does not move.

How Sila engages

Structuring precedes registration. The engagement establishes the activity actually to be carried on in France rather than the one projected, infers whether a permanent establishment will be characterised, assesses the level of litigation and sanction risk in order to decide whether a liability shield is needed, settles the director's social security regime against the intended remuneration and the level of cover sought, and checks the effect of the chosen form on scope under the European instruments.

Only then are the articles of association drafted and the registration filed with the single window for business formalities. Sila does not provide tax advice in place of a tax adviser: where a bilateral treaty governs the analysis, it is instructed jointly.

Where the projected activity makes the appointment of a data protection officer mandatory under Article 37 of Regulation (EU) 2016/679, that obligation arises when the activity starts, not at the end of a first year of trading.

The method, in four steps

  1. 01Gap assessment

    Establishing whether, and on what basis, the instrument applies to the activity as it is actually carried out, then comparing what the instrument requires against what already exists inside the organisation. The assessment ends with a ranked list of gaps, not an overall score. An organisation that falls outside the scope learns so at this stage, and the engagement stops there.

  2. 02Mapping

    Recording what the measures will apply to: processing activities and data flows, systems, service providers, contracts in force, roles and responsibilities. The map is the working document for everything that follows, and it is the document produced to a supervisory authority in the event of an inspection.

  3. 03Technical and organisational measures

    Implementing the measures the mapping has shown to be necessary: internal procedures, policies, contractual clauses to be renegotiated with providers, governance decisions, and training for the people concerned. Measures that sit inside the information system are specified by Sila and implemented by your own teams or your IT provider.

  4. 04Evidence file

    Assembling the file that can be produced to a supervisory authority: records, impact assessments, dated and versioned policies, decision trails, proof of training. Compliance is not demonstrated by the absence of an incident but by the production of this file, which means it has to be kept current once the engagement ends.

A tailored quotation within 48 hours

The scope of an engagement cannot be guessed at: it depends on whether and how the instrument applies to you, on the number of processing activities, systems and contracts involved, and on what already exists inside your organisation. No amount is therefore published on this site.

The process starts with a scoping discussion, at no charge and without commitment, to define what the engagement will cover. A tailored quotation follows within 48 hours, setting out the scope, the deliverables and the amount.

Frequently asked questions

What is the difference between a branch and a subsidiary in France?

A branch has no separate legal personality: its commitments are those of the foreign company, which answers for them on the whole of its assets. A subsidiary is a company incorporated under French law with its own legal personality and its own estate, so the parent is exposed only to the extent of its contribution, save for established mismanagement, a guarantee given, or commingling of assets. Both may carry on a full commercial activity and both must be registered.

Does a representative office create a taxable presence in France?

In principle not, where it is genuinely confined to preparatory or auxiliary activities such as prospecting, representation and market watch. The characterisation is assessed on the facts rather than on the label: an office whose manager habitually negotiates and concludes contracts binding the foreign company is regularly recharacterised as a permanent establishment, with retroactive effect on the financial years concerned. Where a bilateral tax treaty applies, the treaty definition of permanent establishment governs.

Does opening a subsidiary remove the obligation to appoint a GDPR representative?

Where the subsidiary constitutes an establishment in the Union in the context of whose activities the processing is carried out, the analysis moves from Article 3(2) to Article 3(1) of Regulation (EU) 2016/679, and the obligation to designate a representative under Article 27, which applies only to controllers and processors not established in the Union, no longer arises.

Which social security regime applies to the director?

It depends on the form and, for companies, on the office held. The president of a société par actions simplifiée is affiliated to the general scheme as an assimilated employee in respect of a remunerated office, without entitlement to unemployment insurance on the strength of the office alone. The majority manager of a société à responsabilité limitée falls under the self-employed scheme. A minority or equal-holding manager who is remunerated is treated as an assimilated employee. For a branch, the legal representative is an officer of the foreign company and affiliation depends on their personal situation and residence, and where relevant on the European coordination regulations or the applicable bilateral convention.

What this regime triggers elsewhere

Until an establishment is set up in the Union, a business targeting people located there may have to designate a representative under Article 27 GDPR.

Appointing your EU representative under Article 27

A company established outside the Union falls under the GDPR by virtue of Article 3(2) before it has any European establishment, and must then designate a representative under Article 27. Incorporating a subsidiary shifts the analysis to Article 3(1) and removes that obligation.

Addressing the GDPR from incorporation

The thresholds in Article 2 of Directive (EU) 2022/2555 are assessed at entity level. The choice between a branch, which has no legal personality, and a subsidiary, which does, therefore changes the basis of the calculation.

Checking the future establishment against NIS2

Article 2 of Regulation (EU) 2022/2554 lists the entities covered by legal category. The category follows from the licence applied for, which depends on the form of establishment chosen.

Anticipating DORA for a financial activity

Where the projected activity falls within Article 37 of the GDPR, appointment is due from the start of the activity.

Planning for the appointment of a data protection officer

Reference texts

The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.