72-hour prior complaint requirement (France, LOPMI)

Article L. 12-10-1 of the French Insurance Code, created by the January 24, 2023 law on the orientation and programming of the Interior Ministry, known as LOPMI, provides that an insurer's payment in compensation for a loss or damage caused by an attack on an automated data processing system is conditional on the victim filing a complaint with the competent authorities no later than 72 hours after becoming aware of the attack. The rule applies to legal persons and to natural persons acting in the course of their business, and has been in force since April 24, 2023. The text does not prohibit ransom insurance: it makes it possible by framing it, after a public debate in which a ban had been considered. Its purpose is twofold. It gives investigators prompt information on attacks, which victims often kept quiet. And it prevents payments from being made in the dark, since the judicial authority is informed before the insurer steps in. For the underwriter, the condition is a formality to restate in the policy and in the response plan, because forgetting it deprives the insured of its indemnity, whichever cover is involved.