EU AI Act in France
France is the member state where public reporting diverges most sharply. Some sources describe the CNIL as designated with an AI oversight division; a May 2026 readiness assessment describes France as the largest economy without designated national AI Act authorities. If you need certainty here, this page will not give it to you, but it will tell you where to get it.
High-volatility page, verify before relying on it
National implementation is moving and public sources disagree about the status of several member states. Everything below is dated to our last review. Before relying on any statement about which authority supervises you, check the Commission’s published list of notified national competent authorities and the authority’s own website. We would rather tell you a fact is contested than present it cleanly and be wrong. Our standards →
Status as at our last review
| Reported position A | The CNIL designated as national competent authority with an AI oversight division, alongside sector regulators. |
| Reported position B | France has not notified national competent authorities or a single point of contact to the Commission. Designation provisions in the DDADUE bill reported as stalled or withdrawn in the Assemblée nationale, with the CNIL and others acting de facto without formal AI Act status. |
| Sector regulators active in practice | Depending on sector: CNIL (data protection), HAS (health), ARCOM (audiovisual and digital), DGCCRF (consumer protection). |
| What is not in doubt | The Regulation applies in France directly and in full. Article 50, Article 49 and Article 4 obligations bind French deployers and providers regardless of designation status. |
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Where the sources disagree
These two reported positions are not reconcilable and we have not established which is current. The practical answer for a business is the same either way: your obligations do not depend on whether France has completed designation. Classification, Article 50 disclosure, Article 4 literacy records and an AI inventory are all independent of it.
How to get a definitive answer
- The European Commission’s published list of national competent authorities notified under Article 70 is the authoritative record of who has been designated.
- The authority’s own website, which will usually say whether it has AI Act competence.
- Your sector regulator, which in several member states retains competence for high-risk AI in its field regardless of who the lead authority is.
What to do in France specifically
- Engage the sector regulator, not a single AI authority. Depending on what you do that is the CNIL, HAS, ARCOM or DGCCRF. In the absence of settled formal designation, these are the bodies acting in practice.
- Do not read the CNIL’s data protection competence as AI Act competence. They are different mandates and reporting on whether the CNIL holds the second is exactly what conflicts.
- Documented good faith matters more here than elsewhere. Where supervisory arrangements are unsettled, a dated inventory, a recorded classification and a compliance plan are the strongest position available to you. Expert analysis.
- Track the DDADUE bill. Designation provisions have been reported as stalled or withdrawn; that file is where the answer will come from.
What does not depend on designation
The AI Act is a regulation. It applies directly and in full without national transposition. Member states designate authorities and set national penalty procedures: they do not create the obligations.
So none of this is waiting on a designation:
Article 50 disclosure, Article 4 literacy, Article 49 registration, classification and the Article 6(4) assessment are all live or actionable and none waits on a designation. Full checklist →
Status labels on this page
Verified fact: The Regulation applies directly without transposition; the Article 70 designation duty applied from 2 August 2025; the obligations listed above are independent of national designation.
Expert analysis: The assessment of what matters practically in an early enforcement conversation.
Unsettled: The current designation status in this member state. Sources conflict; verify against the Commission's published list.
Work on what does not depend on a regulator
Inventory, classification, Article 50 and Article 4 are all actionable today and none of them waits on a national designation. That is the work with no excuse attached to it.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Frequently asked
Who enforces the EU AI Act in France?
This is contested in public reporting. Some sources describe the CNIL as France's designated national competent authority with an AI oversight division.
A May 2026 readiness assessment reports that France had not notified national competent authorities or a single point of contact to the Commission, with designation provisions stalled, and that the CNIL and sector regulators act de facto without formal AI Act status. In practice, depending on sector, the CNIL, HAS, ARCOM or DGCCRF are the bodies most likely to be involved. Verify against the Commission's published list of notified authorities.
Do French companies have to comply if authorities are not designated?
Yes. The EU AI Act is a regulation and applies directly in all member states. Obligations on providers and deployers, including Article 50 transparency since 2 August 2026 and Article 4 AI literacy since 2 February 2025, do not depend on a member state completing its designation of supervisory authorities.