France: GDPR, CNIL and AI

Which law applies to AI in France?

The GDPR, called “Règlement général sur la protection des données” (RGPD) in France, applies directly. Act No. 78-17 “Informatique et Libertés” supplements it, among other things for health data. Supervision lies with the Commission nationale de l’informatique et des libertés (CNIL). For AI systems, the European AI Act also applies.

In two areas, France has its own rules that go beyond the GDPR:

Area	Rule	For whom
Health data	Anyone hosting it for others needs HDS certification	Hospitals, practices, care providers and their service providers
Sensitive state data	Cloud services must be protected against access from outside the EU, under the SecNumCloud framework	Ministries, authorities and state bodies

HDS certification → · SecNumCloud →

What does the CNIL recommend for using AI?

In July 2024, the CNIL published questions and answers on the use of generative AI in organisations. The key points:

• Start with a need: introduce AI for a specific task, not without a goal.
• Choose the operating model according to the data: for personal data or confidential documents, the CNIL generally prefers in-house operation, because it lowers the risk of data reaching third parties. A cloud service is possible but requires a data processing agreement that sets out responsibilities and access; outside the EU, additional safeguards for the transfer are needed.
• Clarify roles: whether the provider is a processor or a joint controller belongs in the contract. Anyone who connects their own documents containing personal data to the AI is the controller for that processing.
• Assess risks in advance: involve the data protection officer early and, where needed, carry out a data protection impact assessment (called “AIPD” in France).
• Rules and training: define permitted and prohibited uses, for example in an internal charter. Train staff and always have answers checked.
• No training on your data: where possible, object to the provider reusing your inputs.

Since April 2024, the CNIL has published a series of “fiches pratiques IA” for developers of AI systems, with recommendations on topics such as the legal basis, informing data subjects and security.

What applies to the public sector in France?

As in Germany, public authorities need a statutory task as their legal basis (Art. 6(1)(e) GDPR). For particularly sensitive data held by administrations and state bodies, Art. 31 of the SREN Act requires protected cloud services; a decree of 14 April 2026 implements this. Art. 31 does not mention local authorities; for them, the GDPR and the CNIL’s recommendations apply. SecNumCloud →

How does this work with basebox?

In France, basebox offers only the server, operated by your own IT. HDS certification is planned; until then, neither the cloud nor operation of the server by basebox is available in France, because remote operation with access to health data would be an activity that requires HDS certification (HDS certification). This matches the route the CNIL generally prefers for personal and confidential data: the AI runs on hardware on your premises, without an internet connection on request, with the AI model, documents, apps, permissions and logs. Our hardware partner FAST LTA delivers the server to France.

For your review, the data processing agreement, TOMs and templates for the record of processing activities and the data protection impact assessment are available for download on /sicherheit. The interface and support are available in German and English, not in French.

Not legal advice: This article summarises recommendations from the CNIL; they are not laws, but they show what the supervisory authority expects. As of October 2026, responsibilities for the AI Act in France had not yet been set down in law. Research as of 11 October 2026.