Most of the business owners we audit discover they are not compliant on a point they thought had been settled for years. Rarely out of negligence: the obligations have piled up, each one coming from a different text, and nobody ever made the list.

Here it is. Sixteen rules, three families. None of them is optional.

Family 1: what energy renovation requires in its own right

Seven obligations come from the sector itself.

The France Rénov' mention on every promotional medium, from 1 October 2026. It is the most recent, and the costliest to ignore.

Proof of RGE qualification, now required in the contract and on a durable medium. Displaying a logo on your website is no longer enough.

Ten-year liability insurance (assurance décennale): the insurer's name and the geographical coverage must appear on quotes and invoices. It is a frequent oversight and an easy one to spot.

The ban on unsolicited canvassing by phone, email and text message. It has applied to energy renovation since July 2025, and was extended to all sectors on 11 August 2026.

Every announcement of financial aid must state its conditions. A "€1" or "free" offer presented without any income condition is a misleading commercial practice, even when the offer genuinely exists for some households.

Prices are displayed including all taxes, with the VAT rate applied.

The fourteen-day right of withdrawal and its standard form, for any distance or off-premises sale.

Family 2: the notices on your website

Four obligations, and these are the ones an inspector opens first, because they can be checked without asking anyone for anything.

Complete legal notices: company name, legal form, share capital, registered office, registration number, intra-community VAT number, publication director, contact details. And the host, with its name, address and phone number. This is the part forgotten nine times out of ten.

The consumer mediator, named and reachable, mandatory as soon as you sell to individuals.

Terms and conditions of sale and use.

If your site displays a rating or a number of reviews, you must say whether those reviews are verified, and how. Without that sentence, the display becomes open to challenge.

Customer reviews, specifically. An average rating highlighted on a homepage with no indication of how the reviews are checked is a breach, and it is visible to everyone.

Family 3: personal data

Five obligations. A form that collects a name and a phone number triggers all of them.

A privacy policy stating the legal basis, the recipients, the retention periods, people's rights and the option to lodge a complaint with the CNIL (the French data protection authority).

A cookie banner where refusing is as easy as accepting, and where nothing is placed before the user makes a choice.

A record of processing activities, and a contract with every provider that touches your data.

A controlled retention period for your prospects.

Regulated prospecting: prior consent, an identified sender, an unsubscribe link in every message.

Where to start

With the assessment, not the fixes. Open your website and check three things in five minutes: does your legal notices page name your host? Does your cookie banner let people refuse in one click, on the same level as accepting? Do you display a review rating without saying how the reviews are collected?

If any of those three answers makes you hesitate, the other thirteen deserve the same scrutiny.