Digital Transformation and Cybersecurity Grants for French SMEs in 2026: France Num, Cyber PME, Regional Aid, and ERDF Funding

French SMEs searching for support for digitalisation or cybersecurity often encounter references to France Num, Cyber PME, regional digital vouchers, Bpifrance loans and European Regional Development Fund programmes.

These instruments do not form one universal national grant.

In 2026, France does not provide a single subsidy that automatically reimburses every SME for websites, cloud services, cybersecurity software, automated equipment or electronic commerce. Direct financial support usually depends on the company’s region, municipality, intermunicipal authority, sector, size, project location and the type of expenditure proposed.

France Num mainly provides information, diagnostics, training resources and access to advisers. Cyber PME demonstrated how the French state could combine a cybersecurity assessment with investment support, but its previous application round is no longer open. Regional and local authorities continue to provide some of the most relevant direct grants, while ERDF funding reaches companies through regional programmes rather than one national application form.

French SMEs must therefore distinguish between free advice, subsidised diagnostics, direct investment grants, regional vouchers, loans, guarantees, European co-financing and ordinary tax treatment.

France Does Not Have One Universal Digital Grant

The French digital support system covers several different needs.

A company that does not yet understand its digital weaknesses may begin with a free self-assessment or consultation. An SME planning a larger transformation may require a professional diagnostic, a regional investment grant or a loan. A company exposed to cyber risk may need an audit, penetration testing, backup systems, access controls and an incident response plan.

These forms of support have different financial consequences. A free diagnostic provides knowledge but no investment budget. A partially subsidised consultancy service reduces the price paid by the company but does not necessarily transfer cash to it. A direct grant may reimburse part of accepted expenditure. A loan must be repaid. A guarantee protects part of the bank’s risk rather than paying for the company’s project.

Table 1. Main Forms of Digital Transformation and Cybersecurity Support

Form of support	What the company receives	Direct cash payment	Repayment requirement
Free self-assessment	An initial evaluation of digital or cybersecurity maturity	No	No
Free consultation or diagnostic	Analysis of weaknesses and priority recommendations	No	No
Subsidised professional diagnostic	A specialist assessment at a reduced price	Usually no, because public funding pays part of the provider’s fee	No
Direct investment grant	Reimbursement of part of approved eligible expenditure	Yes, or payment through an approved provider	Normally no if all conditions are respected
Regional digital voucher	A fixed contribution or percentage of defined digital costs	Yes	Normally no
Digital transformation loan	Financing for equipment, software, advice or working capital	Yes	Yes, in full
Bank guarantee	Public coverage of part of the lender’s risk	No	The company must repay the bank loan
ERDF co-financing	A regional grant, voucher or subsidised service	Depends on the programme	Normally no if conditions are met
Tax or accounting treatment	Deduction or depreciation of qualifying business expenditure	No	Not applicable

A company should identify which of these mechanisms it is applying for before comparing support rates. A grant covering fifty percent of eligible expenditure is fundamentally different from a guarantee covering fifty percent of a bank’s risk.

How France Num Supports French SMEs

France Num is the main public initiative supporting the digital transformation of very small businesses and SMEs in France. It is coordinated by the Directorate General for Enterprise and brings together regions, chambers of commerce, professional organisations, public institutions and digital specialists.

France Num is not a national grant fund. It operates primarily as an entry point into the support system.

The platform helps companies identify digital needs, find advisers, consult practical guidance, access webinars, complete self-assessments and search for national, regional and local financial assistance.

By the end of 2025, more than 5,000 digital specialists were listed through the France Num ecosystem. This represented an increase of approximately twenty-nine percent compared with the previous year. The initiative targets a potential population of around 2.6 million small businesses.

The France Num website recorded more than 2.5 million visits in 2025, nearly twenty percent more than in 2024. Since November 2020, more than 200,000 individual businesses had participated in activities delivered through France Num programmes.

These results demonstrate the scale of the network, but they should not be interpreted as the number of companies receiving direct investment grants.

Training and Advisory Support

France Num has previously financed large-scale training programmes. In 2025, approximately 21,600 training activities were delivered through Formations France Num. Participant satisfaction reached eighty-nine percent, while forty-six percent of participants reported being very satisfied.

However, the dedicated Formations France Num programme ended on 30 June 2025. It should not be presented as a continuing universal training grant in 2026.

Companies can still use free webinars, guides, regional workshops, self-learning materials and events provided through the France Num network. The exact availability depends on the organiser, location and annual programme.

France Num also began strengthening the verification of digital service providers. In 2025, thirty-seven percent of surveyed business owners reported difficulties finding an appropriate digital supplier. In April 2026, the French administration selected a provider to develop a more structured quality label for verified digital specialists.

This development is important because the quality of the supplier can influence whether a regional authority accepts a proposed digital project.

National Digital Support Instruments in 2026

France offers several national tools, but only some provide money directly to companies.

Table 2. Main National Digital Support Instruments and Their 2026 Status

Instrument	Type of support	Main conditions or amounts	Status in 2026
France Num	Information, advisers, webinars, tools and financial assistance search	Most information and initial resources are free	Active
Cyberdépart	Free initial cybersecurity diagnostic	Specialist assessment and six priority recommendations	Active
Cyber PME	Cybersecurity diagnostic and investment grant	Diagnostic cost of €8,800 excluding VAT, previously subsidised by fifty percent; investment aid from €30,000 to €80,000	Previous application round closed
Diagnostic Data IA	Subsidised professional consultancy	Total cost of €13,000 excluding VAT, half financed by Bpifrance	Active
Prêt Boost Transformation numérique	Digital transformation loan	€5,000 to €75,000, repayment over three to five years	Active through Bpifrance
Prêt Boost Facturation électronique	Loan for electronic invoicing preparation	€5,000 to €75,000, repayment over three to five years	Active
Garantie Développement	Guarantee for bank financing	Bpifrance may cover fifty percent of the defined bank risk	Active
France Num and Bpifrance self-assessments	Free digital maturity tools	Digital maturity, data, artificial intelligence and online presence	Active

Prêt Boost Transformation numérique

The Prêt Boost Transformation numérique is intended for companies with 2 to 49 employees that have normally been operating for more than three years.

It can finance digital equipment, software, technical assistance, professional advice, training, organisational changes and additional working capital associated with a digital project.

The loan ranges from €5,000 to €75,000. The repayment period is between three and five years, with a possible repayment deferral of approximately 9 to 12 months. A personal guarantee from the company director is not normally required.

Eligible uses can include electronic commerce, customer relationship management systems, electronic document management, production automation, cybersecurity, backup solutions, data tools, artificial intelligence and preparation for electronic invoicing.

This is a loan, not a subsidy. The company must repay the borrowed amount and interest under the financing agreement.

Electronic Invoicing Support

From 1 September 2026, all French businesses must be technically able to receive electronic invoices.

The obligation to issue electronic invoices for very small businesses and SMEs begins on 1 September 2027. Companies therefore need to adapt accounting systems, invoicing software, data formats and internal procedures in advance.

The Prêt Boost Facturation électronique can help finance this transition. It does not remove the repayment obligation and should not be presented as reimbursement of the entire compliance cost.

Diagnostic Data IA

Diagnostic Data IA supports SMEs and mid-sized companies that want to develop a practical data or artificial intelligence project.

The service costs €13,000 excluding VAT. Bpifrance finances half of this amount, leaving the company to pay the remaining share.

The diagnostic can evaluate available data, technical architecture, business opportunities, internal skills and the expected return from a proposed project. The company receives a subsidised expert service rather than a direct investment grant.

Cyber PME: Results and Availability in 2026

Cyber PME was launched under France 2030 with a total programme budget of €12.5 million. It represented one of the most substantial recent French initiatives combining a cybersecurity assessment with financial support for implementation.

The programme consisted of two stages.

The first stage involved an eight-day professional cybersecurity diagnostic delivered over approximately three to five months. The full cost was €8,800 excluding VAT. Public support covered fifty percent, while the participating company paid €4,400.

The second stage supported implementation of the cybersecurity plan over approximately 12 to 18 months. The investment grant could range from €30,000 to €80,000 and cover up to seventy percent of accepted expenditure.

Eligible measures could include protection of information systems, access control, network security, backup, incident management, compliance preparation and technical improvements recommended during the diagnostic.

In 2025, Bpifrance completed more than 320 cybersecurity diagnostics under Cyber PME. Around 80 involved companies in the defence sector with support from the French Directorate General of Armaments.

These are completed programme results, not the number of places available in 2026.

The deadline for the previous investment phase was 26 November 2025. In 2026, the Bpifrance offer is marked as unavailable. Cyber PME must therefore be described as a recently completed or suspended programme rather than an open national grant.

Companies should check whether a new round, replacement measure or sector-specific version has been introduced before planning an application.

Free Cybersecurity Diagnostics and Public Services

French SMEs can still access several free cybersecurity tools in 2026.

Cyberdépart, delivered through the public MesServicesCyber system, provides an initial diagnostic for businesses, associations and other organisations. It is generally intended for organisations with at least two employees and a basic information system.

The assessment can be completed online or with a trained adviser. The organisation receives six priority recommendations and may complete another assessment after six months.

MesServicesCyber also provides a short anonymous cybersecurity maturity test, ANSSI guidance, information about public financing, preparation resources for NIS2 and access to incident response contacts.

These services help an organisation identify its weaknesses, but they do not pay for firewalls, backup infrastructure, security software, access management or penetration testing.

Cybermalveillance.gouv.fr and the 17Cyber service provide assistance following cyber incidents. In 2025, more than 500,000 victims used the online assistance systems. Requests from businesses, associations and other professional users increased by sixty-three percent compared with 2024.

Eligible Digital Transformation Costs

The definition of eligible expenditure varies significantly between programmes. A regional scheme supporting local shops may finance different items from an industrial digital transformation programme.

Commonly supported digital investments can include:

• electronic commerce websites and online payment systems;

• customer relationship management and enterprise management software;

• electronic document management and invoicing systems;

• cloud infrastructure, data tools and system integration;

• production automation, robotics, sensors and connected equipment;

• artificial intelligence, advisory services and staff training linked to the investment.

Some regional programmes also support hardware when it is an essential part of a wider transformation project. Ordinary replacement of computers or telephones may be excluded if it does not create a measurable change in the company’s operations.

Subscription costs are treated differently across programmes. Some schemes accept the initial implementation cost but exclude recurring monthly or annual fees.

Eligible Cybersecurity Costs

Cybersecurity support can cover technical, organisational and regulatory improvements.

Commonly eligible expenditure can include:

• security audits and reviews of information system architecture;

• penetration testing of networks, websites and applications;

• firewalls, intrusion detection and access management tools;

• secure backup and data recovery systems;

• vulnerability assessment, updates and system hardening;

• security policies, business continuity plans and incident response procedures.

A programme may exclude routine operating expenditure, stand-alone training, ordinary software subscriptions or costs incurred before the application date.

For example, some regional cybersecurity schemes do not accept recurring subscriptions unless they are inseparable from a newly acquired eligible security solution.

The company should obtain written confirmation of eligibility before signing a supplier contract.

Regional and Local Digital Grants

Regional and local authorities provide some of the most practical direct funding available to SMEs.

The conditions are highly territorial. A company in Centre-Val de Loire may have access to a different programme from a similar company in Grand Est, Hauts-de-France, Guadeloupe or Île-de-France.

Municipalities and intermunicipal authorities can also offer small digital vouchers to local shops, crafts businesses and service providers.

Table 3. Examples of Regional and Local Digital Support in 2026

Territory and programme	Form and maximum support	Main eligible activities	Important restrictions
Centre-Val de Loire, CAP’TN consultancy	Up to fifty percent, from €3,000 to €20,000	External advice for digital transformation and cyber risk	Regional companies with fewer than 500 employees and eligible business activities
Centre-Val de Loire, CAP’TN investment	Up to thirty percent, from €10,000 to €200,000	Artificial intelligence, data protection, robotics, connected systems and advanced digital technologies	A recent publicly supported diagnostic may be required
Île-de-France, Pack IA	Region finances fifty percent	Diagnostic, specialist support, secure technology platform and investment preparation	Programme capacity and selection criteria apply
Île-de-France, CYBIAH	Support may reach full coverage for defined services	Diagnostic, training, remediation plan and implementation assistance	Amount depends on identified needs and project approval
Val de l’Oise intermunicipal digital aid	€1,000 for investments between €1,500 and €10,000; ten percent for larger projects up to €30,000	Online shops, connected cash registers and software training	Turnover below €2 million and at least one completed financial year
Hauts-de-France, Pass Cyber Conseil	Fifty percent, up to €10,000 per service	Network audit, architecture review, penetration testing and security policy	Combined public support can be limited to eighty percent
Grand Est, Diagnostic cybersécurité	Up to fifty percent, maximum €5,000	Ten-day professional diagnostic costing €10,000	Available to SMEs and some mid-sized companies
Région Sud, Mon bouclier cyber expert	€2,000 to €5,000, up to fifty percent	Networks, applications, websites, NIS2 preparation, GDPR and security equipment	Minimum project cost of €4,000; subscriptions excluded
Guadeloupe, Chèque TIC	Up to €10,000 and up to eighty percent	Websites, electronic commerce, equipment, software, audits, backup and antivirus	Company must normally have operated for at least one year; ERDF co-financing applies

The table shows why national summaries can be misleading. A maximum rate of eighty percent in one region does not mean that eighty percent support is available throughout France.

Regional programmes may be limited to industrial companies, local retail businesses, tourism operators, companies with a minimum operating history or applicants that have already completed a recognised diagnostic.

Funding is also subject to annual budgets. A programme can stop accepting applications before the published final date if its allocation is exhausted.

How ERDF Funding Reaches French SMEs

The European Regional Development Fund, known as ERDF in English and FEDER in France, does not offer one national digital grant application for all French SMEs.

ERDF works through regional programmes managed by French regional councils and designated public authorities.

France received approximately €9.1 billion in ERDF funding for the 2021 to 2027 programming period across all policy areas. This is not a digitalisation budget and not a sum reserved exclusively for businesses.

Approximately €685 million in ERDF resources was programmed for different digital priorities. When related European Social Fund Plus and Just Transition Fund allocations are included, the combined amount for digital priorities exceeds €750 million.

Around €126 million in ERDF and Just Transition Fund resources was programmed for the digital transformation of companies across 16 programmes. Approximately €93 million of this amount was intended specifically for SMEs.

These are multiannual programme allocations. They are not the annual 2026 budget of one open grant scheme.

Table 4. European Funding Allocations for Digital Priorities in France

Indicator	Period or scope	Amount
Total ERDF allocation for France	2021 to 2027, all policy areas	€9.1 billion
ERDF programmed for digital priorities	Multiple digital policy areas	Approximately €685 million
Combined European funds for digital priorities	ERDF, ESF+ and Just Transition Fund	More than €750 million
Digital transformation of companies	ERDF and Just Transition Fund across 16 programmes	Approximately €126 million
Amount intended exclusively for SMEs	Within company digital transformation priorities	Approximately €93 million
DEDIHCATED BFC digital innovation project	ERDF contribution	€1,357,796
Guadeloupe Chèque TIC	Maximum support per company	Up to €10,000

Direct and Indirect ERDF Support

ERDF can reach a company directly through a regional investment grant or voucher.

It can also support an intermediary organisation, such as a European Digital Innovation Hub, technology centre, university or regional agency. The intermediary then provides subsidised diagnostics, testing facilities, advice, training or access to specialist equipment.

For example, the DEDIHCATED BFC initiative in Bourgogne-Franche-Comté received more than €1.35 million in ERDF funding. It supports industrial SMEs in areas such as data, artificial intelligence, connected devices, sensors and extended reality.

A participating company does not necessarily receive a cash payment from the project. It may instead receive expert services at a reduced price.

Loans, Guarantees and Grants Must Be Separated

A direct regional grant may reimburse part of approved digital expenditure and normally does not have to be repaid if the project is completed correctly.

A Prêt Boost provides cash to the company, but the company must repay the loan in full.

Garantie Développement does not reimburse fifty percent of the company’s investment. Bpifrance may cover fifty percent of the bank’s defined risk on eligible loans or leasing arrangements. The company remains responsible for repaying the financing.

A subsidised diagnostic reduces the company’s consultancy cost. It does not automatically provide a second budget for implementing the recommendations.

This distinction is particularly important for SMEs that receive a diagnostic recommending €100,000 of improvements. The diagnostic subsidy does not mean the implementation budget has been approved.

Tax and Accounting Treatment of Digital Investment

Normal accounting treatment of software, equipment and cybersecurity expenditure is not a grant.

Digital assets expected to be used over several years are generally recorded as fixed assets and depreciated over their useful life.

Certain software, computer equipment and office equipment with a unit value not exceeding €500 excluding VAT may, subject to general accounting and tax conditions, be treated as an immediate expense rather than a depreciable asset.

The former twelve-month accelerated depreciation regime for acquired software was abolished for financial years beginning on or after 1 January 2017. It must not be presented as an active digital tax incentive in 2026.

VAT on digital goods and services may be deductible under ordinary VAT rules when the company carries out taxable activities and holds valid supporting documentation. This is a general tax mechanism rather than a special digitalisation subsidy.

No universal tax credit was identified in 2026 that automatically reimburses all French SMEs for ordinary websites, cloud systems, antivirus software, backup services or management software.

Recent Digitalisation and Cybersecurity Statistics

France Num surveyed 11,021 businesses in 2025, including 7,878 very small businesses.

Seventy-eight percent of business leaders considered digital technology beneficial to their company. At the same time, fifty-two percent expressed concern about data theft or unauthorised access.

Table 5. Recent Digitalisation and Cybersecurity Indicators

Indicator	Period	Result
Very small businesses and SMEs using artificial intelligence	2025	Twenty-six percent
Businesses using invoicing software	2025	Sixty-nine percent
Businesses using at least one cybersecurity measure	2025	Eighty-four percent
Businesses reporting a cyber incident in the France Num survey	2025	Approximately thirty-six percent
Businesses affected by an incident during the previous 12 months in a separate survey	2025	Sixteen percent
Businesses that did not consider themselves prepared or could not assess preparedness	2025	Eighty percent
Businesses with a cybersecurity budget below €2,000	2025	Approximately three quarters
Bpifrance cybersecurity diagnostics	2025	More than 320
Bpifrance data and artificial intelligence diagnostics	2025	More than 630
Ransomware incidents known to ANSSI	2025	128
Online assistance requests through Cybermalveillance and 17Cyber	2025	More than 500,000
Increase in requests from professional users	2025 compared with 2024	Sixty-three percent

The results come from different surveys and administrative sources. They should not be added together or treated as directly comparable measures of the total number of cyberattacks.

For example, the sixteen percent incident rate came from a separate cybersecurity maturity survey of 588 companies. In that survey, sixty-three percent of respondents identified lack of knowledge and expertise as a barrier, sixty-one percent identified budget constraints and fifty-nine percent identified lack of time.

Only fifteen percent planned to increase their cybersecurity budget.

ANSSI recorded 128 known ransomware incidents in 2025. Very small businesses, SMEs and mid-sized companies remained the most affected category of organisations. This figure includes only incidents known to ANSSI and therefore does not represent every ransomware attack in France.

Among professional users seeking assistance in 2025, the most frequently reported problems included account takeover, phishing, fraudulent changes to bank details or payment instructions, and ransomware.

Outdated Programmes That Should Not Be Presented as 2026 Aid

Older online articles frequently refer to a national €500 digital voucher.

This voucher was a temporary France Relance measure. More than 112,000 very small businesses received the €500 contribution in 2021, with total expenditure approaching €60 million.

It is not an open universal national digital voucher in 2026.

The former Garantie de prêt France Num was also extended only until 2023. Current Bpifrance products, including Prêt Boost and Garantie Développement, should be examined instead.

Cyber PME also requires a date warning. Its previous application round closed in 2025, even though implementation activities and programme reporting continued into 2026.

Combining Different Funding Sources

A French SME may combine several forms of support if each instrument finances clearly separated expenditure.

For example, a company could use a free Cyberdépart assessment, purchase a subsidised professional diagnostic, apply for a regional grant for security equipment and use a Bpifrance loan for software integration and working capital.

It may also benefit from an ERDF-supported digital innovation hub for testing or technical expertise.

However, the same invoice cannot normally be reimbursed twice. The company must declare all public assistance received or requested for the project.

Regional grants may be subject to the European de minimis framework. Under the general rule applicable in 2026, a single undertaking can receive up to €300,000 in de minimis aid over a rolling three-year period.

Not every digital support measure is classified as de minimis aid, so the legal basis of each programme must be checked individually.

Practical Application Strategy for French SMEs

Before committing to a digital transformation or cybersecurity investment, an SME should follow six steps:

1. Complete a free digital and cybersecurity self-assessment.

2. Decide whether the project requires an independent professional diagnostic.

3. Search for support from the region, department, municipality and intermunicipal authority where the project will be implemented.

4. Separate one-off investment, recurring subscriptions, consultancy, training and working capital in the budget.

5. Submit the application before ordering equipment, signing a contract or paying the first invoice.

6. Check de minimis limits, combined public support rates and double-financing rules.

Applications may require supplier quotations, a completed financial year, proof of tax and social compliance, evidence of financial stability and a description of the expected economic results.

A strong application should explain how the investment will improve productivity, sales, data protection, production control, business continuity, customer requirements or regulatory compliance.

A list of software products is usually not sufficient.

Final Assessment

France provides a broad digital support system for SMEs, but it is fragmented across national initiatives, regions, local authorities, public lenders and European funds.

France Num is the main entry point for information, diagnostics and access to advisers. It is not a universal investment grant.

Cyber PME showed how a substantial cybersecurity programme could combine diagnosis and implementation support. Its previous round is closed, so companies must verify whether a successor programme is available.

Regional authorities provide many of the most relevant direct grants for digital transformation, electronic commerce, advanced technologies and cybersecurity. Their conditions vary significantly by territory.

ERDF funding supports regional grants, digital innovation hubs, technical services and business transformation programmes. The published European allocations are multiannual programming amounts rather than budgets that individual SMEs can automatically claim.

Loans and guarantees can finance larger projects but must not be confused with grants. Free diagnostics and subsidised advice can improve project quality, but they do not automatically fund implementation.

The most effective approach for a French SME is therefore to begin with an assessment, define a measurable investment project, verify territorial eligibility and combine advice, regional aid, European co-financing and repayable finance without charging the same cost to more than one programme.