Generative AI and the CNIL: what companies in France must do

In many French companies, ChatGPT, Copilot and Gemini arrived without any official announcement. A sales rep rewrites a proposal, a lawyer summarises a contract, a recruiter sorts CVs. The time saved is real. One question remains: what does the CNIL say when these tools receive personal data?

The CNIL, France's data protection authority, has already written a lot on the subject, and part of its guidance is aimed directly at organisations that use these tools every day. Here is what it expects, and how to turn it into concrete action.

What the CNIL has published on AI

The CNIL presented an action plan on artificial intelligence in 2023, then released a series of practical guides on developing AI systems. In July 2025 it finalised this work with new recommendations, two additional guides (data annotation and secure development) and a checklist of points to verify.

For companies that simply use AI, the most useful text dates from 18 July 2024. On that day the CNIL published its questions and answers on using a generative AI system, along with its first guidance on deployment. They answer the question every CIO and DPO is asking: can staff use ChatGPT, and under what conditions?

Start from a need, not a tool

The CNIL's first piece of advice is simple: start from a concrete need. Rolling out an AI assistant just to see what happens is not a compliant approach. You need to identify the use cases, weigh the risks of each one and choose the tool accordingly.

This ties in with the GDPR purpose limitation principle. A company must know why it processes data. If HR wants AI to draft job ads, that is one use. If it wants AI to rank candidates, that is a different and far more sensitive use, which calls for its own analysis.

Employees and personal data

On employee use, the CNIL is clear. The organisation generally remains responsible for misuse by its staff. It therefore recommends writing down which uses are allowed and which are banned. Its examples include not entering personal data into the tool and not handing decisions over to it.

It goes further for consumer services. Personal data, company data and above all data covered by a secrecy obligation should not be entered there. It also advises accessing these services through dedicated work email addresses rather than personal accounts.

• Only enter information you are authorised to share.

• Offer approved prompt templates that steer users away from sensitive data.

• Turn off provider reuse of your data and, where possible, chat history.

• Read and check every answer before reusing it.

These rules are often bypassed with no bad intent. That is the core issue of shadow AI, the tools used outside the framework the company has set.

Choosing the tool and how to deploy it

The CNIL asks organisations to look at the security and robustness of each solution and to request its documentation. For personal or sensitive data, it favours systems deployed on premises. If the tool runs in the cloud, you need a processing agreement that meets Article 28 GDPR and proper safeguards for transfers outside the European Union.

A point that is often missed: a company that connects AI to its own document base (RAG) or fine-tunes it with personal data becomes the controller for that processing. On security, the CNIL refers to the recommendations of ANSSI, the French national cybersecurity agency, on generative AI systems.

The DPIA: when is it needed?

A data protection impact assessment (DPIA) is mandatory when processing is likely to result in a high risk to individuals. The CNIL recommends involving the DPO from the start and carrying out a DPIA where relevant. It has also published a dedicated guide on impact assessments for AI systems.

A DPIA is rarely needed to draft a marketing email. It becomes very likely as soon as AI touches health data, HR data or children's data, or is used to assess people. The EU AI Act adds its own requirements for high-risk uses. Our EU AI Act and GDPR compliance checklist helps you take stock.

Governance: policy, training, controls

The CNIL recommends governance that brings in the DPO, the CISO, the head of IT and business teams early on. Three workstreams come up again and again in its texts:

1. An internal policy or charter listing permitted and prohibited uses, written in language everyone can follow.

2. User training on how the tools work, their limits and their risks.

3. Regular checks to make sure the rules are actually followed.

The third point is the hardest. A policy and a training session will not stop a rushed copy and paste on a Friday evening. We explain why in our article on why AI security training falls short.

Putting it into practice

To make these recommendations work, you need a control placed where the risk appears: the moment an employee pastes text or drops a file into an AI assistant. That is the job of an AI DLP solution. It spots personal or confidential data before it is sent, then anonymises it, warns the user or blocks it, depending on the rule you choose.

This control also leaves a record. During an audit or a CNIL inspection, the company can show that its policy did not stay on paper. Format preserving anonymisation also keeps answers useful without exposing the real data.

Key takeaways

The CNIL does not ask companies to ban generative AI. It asks them to use it with method: a clear need, clearly allowed uses, a carefully chosen tool, a DPIA when the risk calls for one, trained staff and real controls. Companies that document these steps will be ready the day the question is put to them.

Want to see how ZeusLock applies these rules directly in your teams' browsers? Book a demo.