Skip to main content

    AI by country · Western Europe

    AI in France: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in France know before starting with AI?

    In France, AI that uses personal data falls under the GDPR and the loi Informatique et Libertés, supervised by the CNIL. The EU AI Act applies in stages, but the French bill that names the authorities to enforce it was still before the National Assembly on 29 October 2026. The CNIL's practical AI guidance is the best place to start.

    At a glance

    France at a glance

    Key facts about France
    Data protection lawGDPR and the loi Informatique et Libertés (Law No. 78-17 of 6 January 1978, as amended)
    RegulatorCommission nationale de l'informatique et des libertés (CNIL)
    AI policyEU AI Act applies; the national law naming AI Act authorities (DDADUE bill) was not yet passed as of 29 October 2026
    Time zoneCET, UTC+1 in winter; CEST, UTC+2 in summer (India is 4.5 or 3.5 hours ahead)
    CurrencyEUR (euro)
    Business languageFrench; English is used in international business

    Why now

    Why France is worth watching

    Each point links to the document it comes from.

    • INSEE reports that 18% of French companies with 10 or more employees used at least one AI technology in 2025, 8 points more than in 2024, and 58% of those with 250 or more.[9]

    • The CNIL finalised its recommendations on developing AI systems in July 2025, adding sheets on when the GDPR applies to models, data annotation and security, plus a checklist.[6]

    • The Senate adopted the DDADUE bill on 18 February 2026, including a government amendment that would make the CNIL the main AI Act authority; it went to the National Assembly on 20 February 2026.[4]

    • The Haute Autorité de Santé, working with the CNIL, published a guide in February 2026 on the proper use of AI systems in care settings.[8]

    • Most of the EU AI Act applies from 2 August 2026, and the AI Omnibus moved high-risk rules for Annex III uses to 2 December 2027.[2]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    GDPR and the loi Informatique et Libertés (Law No. 78-17)

    In force1978The French law works within the GDPR and makes the CNIL the national supervisory authority. The CNIL says an AI system needs a defined purpose and a legal basis chosen before processing starts, with training and production kept separate. People affected by automated decisions must be able to understand the logic, get human review and contest the decision.[1]

    EU AI Act, Regulation (EU) 2024/1689, as amended by the AI Omnibus

    Phased2024Banned practices and AI literacy have applied since 2 February 2025, general-purpose AI rules since 2 August 2025, and most other rules, such as chatbot transparency, from 2 August 2026. The AI Omnibus, in force since 27 July 2026, moved high-risk rules to 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products.[2]

    DDADUE bill (projet de loi n° 118, EU law adaptation), AI Act provisions

    Draft2026As adopted by the Senate, it would make the CNIL the authority for banned practices and for high-risk uses such as biometrics and employment. The DGCCRF would share social scoring cases, and the ACPR would cover credit and insurance pricing AI at financial institutions. The text is not law yet, and the Commission lists the DGCCRF as France's contact point with designation pending.[5]

    Where AI fits first

    Where AI fits first

    Health care

    Drafting clinical documents and decision support, with clinicians keeping the decision.

    The HAS guide covers governance, buying AI systems, checking fit with local practice, staff training and monitoring during use.[8]

    Employment and HR

    Sorting applications and planning schedules, with a person deciding.

    Employment AI is high-risk under Annex III from 2 December 2027. Under the Senate text, the CNIL would supervise it.[5]

    Banking and insurance

    Document processing, fraud checks and support for credit decisions.

    Under the Senate text, the ACPR would supervise AI used to assess creditworthiness, risk or pricing for individuals.[5]

    Companies building their own models

    Fine-tuning a language model on internal or collected data.

    The CNIL's recommendations cover legitimate interest as a legal basis, web scraping, informing people, rights, annotation and security.[6]

    Your first steps

    Your first steps

    1. Read the CNIL's AI recommendations and work through its checklist before building or buying an AI system.
    2. Set the purpose and legal basis of each AI use before processing starts, and keep training data separate from production data.
    3. Sort each AI use into an AI Act risk category, and train staff in AI literacy, required since 2 February 2025.
    4. Make sure people can get human review and contest any automated decision with a significant effect.
    5. If you work in health, use the HAS guide when you buy and roll out AI tools.
    6. If personal data will be accessed from India or another non-EU country, put a GDPR transfer mechanism in place first.
    7. Follow the DDADUE bill in the National Assembly to see which authority will supervise your sector.

    AI services for France

    AI consulting and development for teams in France

    We work remotely with companies in France, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India (UTC+5:30) works 9:30 to 18:30, which is 04:00 to 13:00 UTC. In French winter (UTC+1) that gives about 5 hours of overlap, 09:00 to 14:00 Paris time; in summer (UTC+2) about 6 hours, 09:00 to 15:00. India has no EU adequacy decision, so any personal data we access from India needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in France

    Who enforces the AI Act in France?

    It is not settled by law yet. The DDADUE bill, adopted by the Senate in February 2026, would give the CNIL the main role, with the DGCCRF, ACPR and Arcom in specific areas. It was still at the National Assembly as of 29 October 2026.

    Can we use legitimate interest to train an AI model?

    It can be. The CNIL says legitimate interest is a possible legal basis for developing AI systems, subject to strong safeguards, and that consent is not always required. Document your balancing test.

    Is a trained AI model personal data?

    Not automatically, says the CNIL. But models can memorise training data, so a successful extraction attack may count as a data breach that must be notified.

    When do the high-risk AI rules start?

    On 2 December 2027 for Annex III uses such as hiring and credit scoring, and 2 August 2028 for AI in regulated products, after the EU AI Omnibus changed the dates.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] CNIL, 2024-11-15. La loi Informatique et Libertés(cnil.fr)
      Full title and what we used it for

      La loi Informatique et Libertés. Primary (consolidated text published by the CNIL). Used for the link to the GDPR and the CNIL's role as supervisory authority.

    2. [2] European Commission, 2026-10-19. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the AI Act timeline and the AI Omnibus, which the page says entered into force on 27 July 2026. We could not open EUR-Lex directly.

    3. [3] European Commission, 2026-09-07. Market Surveillance Authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market Surveillance Authorities under the AI Act. Primary. Used for the DGCCRF being listed as France's single point of contact with the national designation still pending.

    4. [4] Sénat, 2026-09-04. Projet de loi portant diverses dispositions d'adaptation au droit de l'…(senat.fr)
      Full title and what we used it for

      Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne (dossier législatif pjl25-118). Primary. Used for the bill's stages: tabled 10 November 2025, adopted by the Senate 18 February 2026, sent to the National Assembly 20 February 2026 as text n° 2518. No later stage was shown.

    5. [5] Sénat, 2026-02-12. Amendement n° 442 (Gouvernement), projet de loi Adaptation au droit de…(senat.fr)
      Full title and what we used it for

      Amendement n° 442 (Gouvernement), projet de loi Adaptation au droit de l'Union européenne. Primary. Adopted government amendment. Used for the proposed split of AI Act roles between the CNIL, DGCCRF, ACPR and Arcom.

    6. [6] CNIL, 2025-07-22. IA : la CNIL finalise ses recommandations sur le développement des syst…(cnil.fr)
      Full title and what we used it for

      IA : la CNIL finalise ses recommandations sur le développement des systèmes d'IA et annonce ses futurs travaux. Primary. Used for the final recommendations, checklist and planned sector work. The legitimate interest point comes from the CNIL's page 'Développement des systèmes d'IA : la CNIL publie ses recommandations sur l'intérêt légitime' (19 June 2025).

    7. [7] CNIL, 2022-04-05. IA : comment être en conformité avec le RGPD ?(cnil.fr)
      Full title and what we used it for

      IA : comment être en conformité avec le RGPD ?. Primary. Used for purpose, legal basis, model memorisation and breach risk, and rights around automated decisions.

    8. [8] Haute Autorité de Santé, with the CNIL, 2026-02-16. Accompagner le bon usage des systèmes d'intelligence artificielle en co…(cnil.fr)
      Full title and what we used it for

      Accompagner le bon usage des systèmes d'intelligence artificielle en contexte de soins. Primary. Version dated 16 February 2026. Used for the guide's audience and chapter topics.

    9. [9] INSEE, 2026-07-21. Les technologies de l'information et de la communication dans les entre…(insee.fr)
      Full title and what we used it for

      Les technologies de l'information et de la communication dans les entreprises en 2025 (Insee Première n° 2120). Primary. Used for AI use by 18% of companies with 10 or more employees in 2025 and 58% of those with 250 or more.

    10. [10] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary, accessed on this date. Used to confirm India has no EU adequacy decision.

    This is general information, not legal advice. The French law naming AI Act authorities was still being debated when we checked, and the final split of roles may change. Check with a qualified French lawyer (avocat) before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in France?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score