Cybersecurity lawyer Paris: SME obligations and cyber insurance.

Start with the list of covers actually taken out, because a cyber policy often groups several distinct blocks: crisis management costs, business interruption, liability to third parties, sometimes transfer fraud. Each has its own definition, limits and deductibles, and a loss may fall within none of them. Then read the exclusions, which must be formal and limited, and which the Insurance Code requires to appear in very conspicuous characters (Article L. 113-1 and Article L. 112-4). Finally, check the underwriting questionnaire: it describes the backups, remote access, authentication and updates, and the insurer refers back to it after the attack. The insurance distributor must specify in writing the policyholder's requirements and needs and advise a contract consistent with them (Insurance Code, Article L. 521-4). For an SME, three points deserve particular attention: the designation of all the companies to be insured, the definition of the business interruption loss covered, and the clause setting the time limit for notifying a loss. The firm reviews these documents before signing, on the basis of the measures the business actually applies.

Yes, but only under strict conditions. The policyholder must answer accurately the questions put by the insurer when the contract is concluded (Insurance Code, Article L. 113-2, 2°). Concealment or an intentional false declaration that changes the subject of the risk or diminishes the insurer's assessment of it results in nullity, even if the omitted risk had no influence on the loss (Article L. 113-8). Case law nevertheless requires that the false declaration result from the policyholder's answers to the insurer's questions, or from a statement made on the policyholder's own initiative. The Court of Cassation quashed a judgment that had ordered nullity without finding that the insurer had put, at underwriting, specific questions requiring the disclosure of the information complained of (Cass. 2e civ., 13 December 2018, No. 17-28.093). It accepts that pre-printed statements may be taken into account, but on conditions: the court may take them into account, “provided, first, that it finds that, by their precision and individualisation, these statements resulted from specific questions put by the insurer or it finds that these statements had been made by the policyholder, on its own initiative alone, when the contract was concluded” (Cass. 3e civ., 26 March 2026, No. 24-16.175) (our translation), the other condition being that the special conditions were signed by the policyholder. A spontaneous statement by the policyholder can therefore be held against it without any prior question. The firm examines the exact content of the question, that of the declaration and the evidence that the policyholder adopted them before discussing nullity.

Everything depends on the nature of the inaccuracy and on how the policy is drafted. If the business declared in bad faith a measure that did not exist, the insurer may invoke nullity of the contract under the Insurance Code (Article L. 113-8), provided it proves intent and the link with a specific question. Without proven bad faith, Article L. 113-9 provides that an inaccuracy found after the loss reduces the indemnity in proportion to the premiums paid compared with those that would have been due. The position is different where the policy makes the backup a condition of cover. The Versailles Court of Appeal states that “It is for the policyholder to show that the conditions for application of the cover are met, bearing in mind that the burden of proof rests on the insurer when it intends to set up an exclusion clause against the policyholder.” (CA Versailles, ch. com. 3-1, 10 December 2025, No. 24/02259) (our translation). In that case, which had nothing to do with cyber risk, it dismissed the policyholder's claim for lack of prior physical damage. The clause must therefore be characterised before replying to the insurer: condition, exclusion or mere declaration of the risk. A measure in place, even an imperfect one, should be documented precisely, and the firm distinguishes what was promised from what existed.

An exclusion is first challenged on its form: the Insurance Code validates an exclusion clause only if it appears in very conspicuous characters (Insurance Code, Article L. 112-4). The Court of Cassation quashed a judgment that had not examined, as it had been asked to do, “whether the clause in dispute appeared in very conspicuous characters so as to draw the policyholder's attention specifically to the exclusion it laid down” (Cass. 2e civ., 24 May 2018, No. 17-16.431) (our translation). It is then challenged on substance, because Article L. 113-1 requires a clause that is formal, understood without interpretation, and limited. A clause that requires interpretation is not formal, and a clause that leaves only a derisory cover in place is not limited. The outcome of the dispute is not decided in advance: in Cass. 2e civ., 1 December 2022, No. 21-15.392, the Court of Cassation held the exclusion in dispute to be valid, on the ground that it left other situations within the scope of the cover. In case of doubt, a standard-form contract is interpreted against the party who proposed it (French Civil Code (Code civil), Article 1190), but a clear and precise clause is not interpreted, on pain of distortion (Civil Code, Article 1192). The firm re-reads the clause within the complete policy, checks its physical presentation and measures what the cover still includes once it is applied.

Not necessarily, and this should be checked before an incident. A multi-risk policy often protects physical property and the business interruption losses that follow physical damage, which a cyber attack does not always cause. The Versailles Court of Appeal held, for a business interruption cover subject to prior physical damage to the insured property, that this condition had to be proved by the policyholder, and dismissed its claim (CA Versailles, ch. com. 3-1, 10 December 2025, No. 24/02259). Professional liability cover may also rule out IT risk. The Lyon judicial court, known as the tribunal judiciaire, examined the policy of software publishers hacked by a third party and found that “the risk of a cyber attack by a third party, in all its forms, is clearly excluded from the cover taken out” (TJ Lyon, 20 August 2026, No. 22/10048) (our translation). The policyholders' claims were rejected, and the court added that the contract was not devoid of purpose, since it covered many other professional risks. An SME that believes it is protected by its general contracts must therefore look for the exact words: data breach, IT fraud, reconstitution costs, service interruption. The firm draws up this map of existing covers and of risks left uncovered.

No. The business interruption cover of a cyber policy generally compensates the loss of gross margin linked to a fall in turnover, and the costs incurred to limit it. A real loss may fall outside that definition. The Bobigny commercial court, known as the tribunal de commerce, ruled on the hacking of a telecommunications company's telephony platform: the hackers had made numerous calls abroad, re-invoiced by the operator for more than €214,000. The court noted that the attack had neither stopped nor disrupted the business, that no fall in turnover had been shown and that “the only costs covered by the contract must have the aim of reducing the policyholder's fall in turnover” (T. com. Bobigny, 25 February 2025, No. 2023F01983) (our translation). The company's claims were dismissed and it was ordered to pay the costs. This first-instance decision shows that each head of loss must be tied to a specific cover: loss of margin, additional costs, reconstitution costs, liability to third parties. Before quantifying the claim, the firm compares the business's accounts, the chronology of the attack and the policy's definitions, so as to present a claim that matches what the insurer undertook to pay.

The text is drafted as a condition of payment. Any indemnity provided by a clause covering the consequences of an IT intrusion is due only if the victim filed a criminal complaint within seventy-two hours of the time it became aware of the breach (Insurance Code, Article L. 12-10-1). The intrusions concerned are those punished in particular by the Criminal Code (Criminal Code, Article 323-1), and the rule applies to companies as well as to professionals acting in the course of their activity. The time limit runs from awareness of the breach, not from the day the attackers entered the system. The date of discovery must therefore be established by objective evidence: antivirus alert, ransom message, report from a customer or report from the provider. A late complaint is not a mere missed formality: the insurer may rely on it to refuse payment. If the business is unsure of the exact date of awareness, it is better to file a complaint without waiting for the end of the technical investigations, and then supplement it. The firm helps to fix that date and to draft a precise complaint, which will also serve before the insurer and the court.

Only within a narrow framework. The Code requires the insurer to be notified as soon as the loss is known, within the time limit set by the contract, which cannot be shorter than five business days, apart from the shorter minimums the text provides for, including two business days in the case of theft (Insurance Code, Article L. 113-2, 4°). The penalty for lateness must appear in a clause of the policy, and the insurer must prove that the delay actually prejudiced it. A fortuitous event (cas fortuit) or force majeure event that caused the delay also prevents the insurer from relying on it. The Court of Cassation draws from this that “the insurer cannot set up against the policyholder a forfeiture for late notification where the applicable contract contains no clause providing for it or where the clause providing for it does not comply with these provisions” (Cass. 2e civ., 21 January 2021, No. 19-13.347) (our translation). In that case, the clause provided for a time limit shorter than the statutory minimum, and the judgment that had dismissed the policyholder's claim was quashed. This rule does not dispense with the complaint within 72 hours, which is governed by its own provision. Faced with a refusal based on delay, the firm checks the clause, the starting point used by the insurer and the reality of the prejudice it alleges.

It may be, but the business must prove a fault, a loss and a link between the two. The insurance distributor specifies in writing the policyholder's requirements and needs and advises a contract consistent with them (Insurance Code, Article L. 521-4). The Rennes Court of Appeal recalls that the broker is bound by a duty to inform and advise: “It must thus give its client all the objective elements for choosing cover appropriate to its risk and ensure that the cover is suited to the risks presented.” (CA Rennes, 5e ch., 10 December 2025, No. 22/06509) (our translation). It nevertheless upheld the dismissal of the claim, for lack of a demonstrated loss of chance, the loss being capable of analysis only as a loss of the chance to take out suitable cover. The Lyon judicial court likewise recalled that the duty to advise rested on the broker involved at underwriting, and not on the insurer, while rejecting the complaint made against the latter (TJ Lyon, 20 August 2026, No. 22/10048). To act effectively, it is therefore necessary to reconstruct what the business had expressed as its needs, what the broker proposed to it and what suitable cover would have paid. The firm gathers these elements before assessing whether an action is worthwhile.

Not automatically. The policy covers the company that took it out and the persons it defines as insured, and insurance may also be taken out on behalf of another (Insurance Code, Article L. 112-1). Another company run by the same manager is therefore covered only if the contract includes it. The Rennes Court of Appeal ruled on a fake-executive fraud: an assistant, deceived by emails imitating the manager's address, had made two transfers from the accounts of a group company. Only another company in the group had taken out the cyber policy, which included a liability cover for breach of privacy or data confidentiality. The court noted that breach of the privacy of a legal entity could not be conceived in that case, that breach of confidentiality had not been shown and that the liability of the insured company towards the victim company was apparent from no document. It upheld the rejection of all the claims, including those against the broker (CA Rennes, 5e ch., 10 December 2025, No. 22/06509). Where several companies share the same email system, the same equipment and the same administrative staff, it must be checked that the policy includes them all, by name or through a clause covering group companies. The firm checks the list of insureds, any fraud cover and the company that actually suffered the loss.

Yes. The insurer that has paid the indemnity is subrogated, up to the amount paid, to the policyholder's rights and actions against third parties whose act caused the loss (Insurance Code, Article L. 121-12). The provider will then have to answer as it would have done to its client, on the basis of contractual liability (Civil Code, Article 1231-1). The Paris economic activities court, known as the tribunal des activités économiques, ruled on a dispute of this type, between a retail chain's cyber insurer and the managed IT provider held to account after a ransomware attack. The reports produced did not clearly show the causes of the intrusion or the managed provider's share, and the court held that “A technical explanation is therefore necessary for the court to be able to rule.” (TAE Paris, 3 March 2025, No. J2025000100) (our translation). It ordered the insurer to produce its expert reports, the underwriting questionnaire and its annexes, the complaint and the notification to the CNIL, then adjourned the case. For the business, the consequence is practical: its declarations to the insurer may be read by the provider. The limitation-of-liability clause in the IT contract remains subject to the Civil Code, which deems unwritten a clause that deprives the essential obligation of its substance (Civil Code, Article 1170). The firm coordinates the position of the business, the insurer and the provider.

Yes, where the contractual fault, the loss and the causal link are proved. A provider that breaches its contractual undertaking compensates its client, unless it justifies a case of force majeure (Civil Code, Article 1231-1). The Paris economic activities court ruled on the case of a subcontractor responsible for securing a hosted platform, which had installed a telephony server in a test phase without filtering one of the two exposed protocols. Hackers had used this opening to make nearly ten thousand calls, invoiced at more than €84,000 by the operator. The court noted that the provider had acknowledged this defect, holding that “FABRIQUE IT acknowledged that it had not properly secured the server it installed on 6 April 2023” (TAE Paris, 8 October 2025, No. 2024005541) (our translation), and ordered it to compensate its client for the amount of the fraudulent calls, excluding VAT. The evidence rested on an incident report drawn up jointly after the attack and on the provider's own written statements to its insurer. It is therefore in an SME's interest to obtain a dated technical report quickly, keep the exchanges and check the scope of security entrusted by contract. If the provider disputes the matter, a measure of inquiry can be requested before any trial (Code of Civil Procedure, Article 145).

A business's size does not exempt it from the GDPR rules as soon as it processes personal data of customers, employees or suppliers. Article 32 of the GDPR requires technical and organisational measures appropriate to the risk, taking into account the state of the art and the costs. Article 28 requires that processing entrusted to a processor be governed by a contract or other binding legal act. Article 33 requires a data breach to be notified to the CNIL without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless there is no risk, any delay having to be justified; the processor alerts the controller without undue delay. Article 34 provides for informing the individuals concerned where the risk is high. The Council of State upheld a fine of €400,000 against a company whose website exposed supporting documents and which kept that data for too long, noting that the failings could have been prevented by simple security measures, such as user authentication, and by archiving measures, and taking into account the company's resources and the time taken to correct them (CE, 10th and 9th chambers combined, 4 November 2020, No. 433311). The Criminal Code also penalises processing carried out without the measures that Article 32 requires (Criminal Code, Article 226-17). As for NIS 2, Directive (EU) 2022/2555, its French transposition is not complete: according to the legislative file consulted on 1 November 2026, the Senate voted the bill in March 2025 and the special committee of the National Assembly settled its text in September 2025, without final adoption. For an SME, the main issues today therefore concern the GDPR, contracts and the insurance policy.

Actions arising from an insurance contract are, as a rule, subject to a two-year limitation period running from the event giving rise to them (Insurance Code, Article L. 114-1). This period, much shorter than the ordinary-law period, means that an amicable discussion with no outcome must not be left to drag on. The text provides for some exceptions: in the case of a loss, the period runs only from the day the persons concerned became aware of it, if they prove they were unaware of it until then. Where the policyholder's action against the insurer stems from a claim by a third party, for example a customer whose data was exposed, the period runs only from the day that third party brought proceedings against the policyholder or was compensated by it. These rules combine with the obligations of the crisis: complaint within 72 hours, notification of the loss within the policy's time limit, preservation of technical evidence. A refusal of cover received by letter does not, on its own, fix the relevant date: it is necessary to go back to the event on which the claim is based. The firm reconstructs this chronology, checks the grounds of interruption that can be relied on and decides whether a writ of summons must be issued before the period expires.