Artificial Intelligence · France
AI regulation in France: laws & policy (2026)
France shaded by its artificial intelligence status
AI in France: comprehensive law.
FrameworkEU AI Act (Regulation (EU) 2024/1689), directly applicable in France; national implementation via the pending DDADUE bill (Feb 2026) designating CNIL, DGCCRF, ANSSI and sectoral regulators. Complemented by France's national AI strategy and INESIA (National Institute for AI Evaluation and Security).
As an EU Member State, France is governed by the EU AI Act, whose prohibited-practices provisions have applied since 2 February 2025 and whose high-risk obligations phase in through 2026–2027. France has not yet formally designated its national competent authorities in domestic law; a February 2026 DDADUE bill before Parliament will assign CNIL as lead supervisor with DGCCRF acting as the single point of contact under Article 70, alongside ANSSI, Arcom, ACPR and PEReN. France also runs an active national AI strategy and created INESIA in January 2025 to centralise AI evaluation and safety expertise.
The EU AI Act in France
In France, artificial intelligence is governed by the EU AI Act, the first comprehensive AI law, which applies directly as an EU regulation.
- Framework
- the EU AI Act (Regulation (EU) 2024/1689)
- Approach
- risk-based: unacceptable-risk AI is banned, high-risk AI faces strict duties, limited-risk AI has transparency rules
- General-purpose AI
- transparency duties for all GPAI models; systemic-risk models add safety and evaluation obligations
- Timeline
- phased: prohibitions from Feb 2025, GPAI rules from Aug 2025, most high-risk obligations from Aug 2026
- Maximum fine
- €35 million or 7% of global annual turnover for prohibited-AI breaches
- Oversight
- national market-surveillance authorities, coordinated by the EU AI Office
The AI Act is an EU regulation applied directly in France; national market-surveillance authorities handle enforcement.
The EU AI Act in France: FAQ
Yes. As an EU member, France is covered by the EU AI Act (Regulation (EU) 2024/1689), which applies directly.
It uses a risk-based approach: unacceptable-risk AI is banned, high-risk AI faces strict obligations, and general-purpose AI models carry transparency duties.
It is phased: prohibitions applied from February 2025, general-purpose-AI rules from August 2025, and most high-risk obligations from August 2026.
Up to €35 million or 7% of global annual turnover for breaching the prohibited-AI rules, with lower tiers for other breaches.
Key points
Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies directly in France. Bans on unacceptable-risk AI (e.g., social scoring, untargeted facial-image scraping) took effect on 2 February 2025; GPAI obligations from 2 August 2025; high-risk system obligations phase in through 2 August 2026 and 2 August 2027.
The French data-protection authority CNIL has been positioned as the reference authority for AI Act application in France; a government amendment tabled on 12 February 2026 formally seeks to designate CNIL as national supervisory authority. CNIL has issued successive AI recommendations under its 2023 AI Action Plan and 2025–2028 strategic plan, including fiches pratiques on training-data annotation, AI-system security and the GDPR status of AI models (July 2025).
Rather than a single AI regulator, France proposes to spread AI Act competences across existing bodies: DGCCRF as coordinating single point of contact under Article 70(2), CNIL for personal-data/biometric AI use cases, ANSSI for AI cybersecurity, Arcom for content/DSA-adjacent issues, ACPR for financial services, and PEReN for technical expertise. The governance scheme was published by DGE/DGCCRF on 9 September 2025 and codified in the DDADUE bill of 18 February 2026 still before Parliament.
Inaugurated on 31 January 2025 and jointly steered by the Prime Minister's SGDSN and the Directorate General for Enterprises (DGE), INESIA federates ANSSI, LNE, PEReN and Inria to analyse systemic AI risks, support AI-regulation implementation, and evaluate model performance and reliability. INESIA is France's node in the international AI Safety Institutes network and is expressly not a regulator.
France launched a third phase of its national AI strategy at the interministerial AI committee of 6 February 2025 and hosted the Paris AI Action Summit on 10–11 February 2025, producing the Statement on Inclusive and Sustainable AI. Public investment continues via France 2030 (initial €1.5bn AI envelope) with additional private-sector commitments announced at the Summit.
Once national designation is completed, French supervisors will apply AI Act penalties of up to €35 million or 7% of worldwide annual turnover for prohibited-practice breaches, €15 million/3% for most other obligations, and €7.5 million/1% for supplying incorrect information. CNIL retains parallel GDPR powers where AI systems process personal data.
Timeline - major decisions & events
The Ministry of the Economy's Directorate-General for Enterprises (DGE) released a draft scheme designating ~17 national authorities (with CNIL, DGCCRF as single point of contact, and DGE on the European AI Board) to enforce the EU AI Act in France. It establishes how the country will supervise AI systems but still awaits parliamentary approval.
MIAI / ai-regulation.com ↗The CNIL published guidance on using the GDPR 'legitimate interest' legal basis to develop AI models and on collecting personal data via web scraping, clarifying how French/EU data-protection law applies to AI training.
CNIL ↗Hosted by France, the summit produced a joint declaration signed by 58 countries on inclusive, sustainable and trustworthy AI (notably not signed by the US and UK), positioning France as a convener of global AI governance.
Élysée ↗The CNIL released guidance on informing data subjects whose data trains AI models and on facilitating individuals' GDPR rights (access, erasure), giving practical compliance rules for AI developers in France.
CNIL ↗After public consultation, the CNIL finalised its first set of practical recommendations on building AI systems in compliance with the GDPR, establishing the French regulator's baseline guidance for lawful AI development.
CNIL ↗The French data-protection authority published a four-pillar action plan to regulate AI, especially generative AI and chatbots, and created a dedicated AI department, signalling proactive supervision ahead of the EU AI Act.
CNIL ↗The CNIL imposed its maximum fine on Clearview AI for unlawfully scraping facial images and processing biometric data without a legal basis, ordering deletion of French residents' data, a landmark French AI enforcement action.
CNIL ↗Following Cédric Villani's mission report, President Macron unveiled France's national AI strategy with €1.5bn in planned investment and an ethics-focused framework, laying the foundations of French AI policy.
European Commission AI Watch ↗Law No. 2016-1321 created a right for citizens to know the rules and main features of algorithms used by public administrations to make individual decisions, an early French legal foundation for algorithmic accountability.
Légifrance ↗France - other topics
Artificial Intelligence in other countries
Last verified 9/7/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →