EU AI Act in France

France's EU AI Act implementation builds on existing sectoral regulatory architecture. No single dedicated national AI authority has been created, instead, the CNIL plays a de facto leading role on AI-general matters (particularly biometric, employment, and law-enforcement AI where personal data is central), while sector regulators handle their respective Annex III domains.

The CNIL's AI position is unusual in the EU: since 2022 it has published detailed guidance on AI and GDPR, conducted compliance audits of AI deployments, and issued sanctions for AI-related violations. Its technical maturity gives it outsized influence on the operational interpretation of the AI Act in France. The Autorité de Régulation de la Communication Audiovisuelle et Numérique (Arcom) handles AI-generated content and disinformation aspects overlapping with DSA. ACPR (Autorité de Contrôle Prudentiel et de Résolution) handles AI in financial services. HAS (Haute Autorité de Santé) handles medical AI alongside ANSM.

CNIL's De Facto Leadership

Although the AI Act designates market surveillance authorities, France's allocation leverages the CNIL's existing remit under GDPR and the national data-protection law (Loi Informatique et Libertés). The CNIL has published:

• Multiple recommendations on AI and GDPR (2022–2025), including specific guidance on biometric systems, emotion recognition, and facial recognition.
• Its référentiel IA, a practical reference framework for AI compliance that materially anticipated many AI Act requirements.
• Audit reports on public-sector AI deployments at CAF, Pôle Emploi, and tax authorities, establishing enforcement patterns that inform AI Act interpretation.

For any AI system processing personal data, which includes most Annex III deployments, CNIL engagement is the operational reality, regardless of formal market-surveillance designation.

Sector-Regulator Allocation

France's sectoral allocation (subject to ongoing transposition refinement):

• CNIL, biometric, employment, law-enforcement AI; general data-related aspects; coordinating role on biometric (Annex III Point 1) and law-enforcement (Point 6) systems.
• ACPR + AMF, AI in financial services (Point 5(b), 5(c)); capital markets AI.
• HAS + ANSM, medical device AI (Annex I).
• Arcom, AI-generated content, disinformation, platform accountability (DSA overlap).
• DGCCRF, consumer-facing AI and unfair commercial practices.
• CNRS / INRIA, technical standards and sandbox hosting (Article 57 regulatory sandboxes).
• Inspection du travail + CSE consultation for Annex III Point 4 workplace AI.

National Strategy and Sandbox Programme

France has positioned AI Act compliance as part of a broader sovereignty-and-competitiveness strategy under the Stratégie Nationale pour l'Intelligence Artificielle (SNIA), coordinated through the Secrétariat général pour l'investissement (SGPI). In practice this has translated into:

• Early establishment of regulatory sandboxes under Article 57, with CNIL-hosted sandboxes for data-heavy AI and sector-regulator sandboxes in MedTech and FinServ.
• Public-sector AI service account, a standardised disclosure framework for public deployments of AI, anticipating Article 49 registration.
• CSE consultation protocols, French labour law requires Comité Social et Économique consultation on significant changes affecting working conditions; this interlocks with AI Act Article 26(7) worker-information duties.