France AI Regulation & Governance

The AI Act's commencement is staged: it entered into force 1 August 2024, with prohibited practices from 2 February 2025, GPAI obligations from 2 August 2025, and the remainder from 2 August 2026 as originally drafted.

Derived: Probable The Digital Omnibus on AI, in force from 27 July 2026, pushed back the AI Act's high-risk application dates to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), leaving Art 50 transparency duties unaffected.

Derived: Probable As of 22 October 2026, no French authority has been legally designated under AI Act Arts 28 or 70, leaving the DGCCRF/CNIL/ACPR/Arcom designation scheme in the pending DDADUE bill rather than in force.

The AI Act entered into force on 1 August 2024 and applies in full from 2 August 2026, with earlier staggered application of prohibited-practices provisions from 2 February 2025 and GPAI/governance chapters from 2 August 2025.

France has not yet enacted the statute designating its AI Act national competent authorities, over a year past the Regulation's deadline.

The Digital Omnibus on AI deferred the Annex III high-risk application date to 2 December 2027 and the Annex I date to 2 August 2028, while leaving Art.50 transparency duties unaffected.

Member States must have at least one operational national AI regulatory sandbox by 2 August 2027, a date moved back from 2 August 2026.

The core high-risk-system obligations in AI Act Chapter III Sections 1-3 now apply from 2 December 2027 for Article 6(2)/Annex III systems and from 2 August 2028 for Article 6(1)/Annex I embedded systems, rather than from the AI Act's original 2 August 2026 date.

Derived: Probable The Digital Omnibus adds two new prohibited AI practices under Article 5 - non-consensual intimate-image generation and CSAM generation - applicable from 2 December 2026, alongside the eight practices prohibited since 2 February 2025.

Eight AI practices are prohibited under Art.5 since 2 February 2025, with two further prohibitions (intimate-image and CSAM generation) applying from 2 December 2026.

Breach of the AI Act's Art.5 prohibitions carries fines of up to EUR 35 million or 7% of global turnover, whichever is higher.

Derived: Probable The Digital Omnibus on AI, in force from 27 July 2026, pushed back the AI Act's high-risk application dates to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), leaving Art 50 transparency duties unaffected.

Regulation (EU) 2026/1744 (the Digital Omnibus on AI), in force from 27 July 2026, deferred the AI Act's high-risk application dates under Article 113 to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.

Annex III of the AI Act lists eight use-case areas that make an AI system high-risk, including biometrics, critical infrastructure, employment and essential public/private services.

Derived: Probable Deployer duties under Article 26 of the AI Act, including the fundamental rights impact assessment under Article 27, start on 2 December 2027 for Annex III high-risk systems.

Derived: Probable Providers of high-risk AI systems must operate a risk-management system across the lifecycle to minimise risks to deployers and affected persons, and ensure sufficient transparency for deployers to interpret the system's output.

The Digital Omnibus on AI deferred the Annex III high-risk application date to 2 December 2027 and the Annex I date to 2 August 2028, while leaving Art.50 transparency duties unaffected.

The core high-risk-system obligations in AI Act Chapter III Sections 1-3 now apply from 2 December 2027 for Article 6(2)/Annex III systems and from 2 August 2028 for Article 6(1)/Annex I embedded systems, rather than from the AI Act's original 2 August 2026 date.

GPAI model providers have, since 2 August 2025, been required under AI Act Art 53 to maintain technical documentation, provide it downstream, implement a copyright policy and publish a training-data summary.

Providers of general-purpose AI models in scope from 2 August 2025 must maintain technical documentation, provide it to downstream providers, maintain a copyright-compliance policy, and publish a training-data summary.

A GPAI model is presumed to pose systemic risk when cumulative training compute exceeds 10^25 FLOPs, triggering additional Art.55 obligations.

France's SREN law (Loi n° 2024-449 of 21 May 2024) imposes deepfake-labelling and related digital-content obligations, in force since 21 May 2024, pre-dating and distinct from the AI Act's own national designation.

Derived: Probable From 2 August 2026, Article 50 of the AI Act requires providers of AI systems in direct human interaction to disclose that fact (unless obvious), generative-AI providers to apply machine-readable marking to synthetic output, deployers of emotion-recognition/biometric-categorisation systems to inform exposed individuals, and deployers of deepfake-generating systems to disclose the artificial nature of the content.

Derived: Probable A transitional grace period until 2 December 2026 applies to the Art 50(2) machine-readable marking obligation for generative AI systems already placed on the market before 2 August 2026; content generated before that date need not be labelled retroactively.

Article 50 of the EU AI Act, imposing AI-interaction disclosure, synthetic-content marking, emotion-recognition/biometric notice and deepfake-disclosure duties, became applicable on 2 August 2026, directly binding in France.

A transitional grace period until 2 December 2026 applies to the Article 50(2) machine-readable marking obligation for generative AI systems already placed on the market before 2 August 2026, with no retroactive labelling required for content generated before that date.

France's text-and-data-mining copyright exception (CPI Art L.122-5-3) permits reproduction of lawfully accessed works for AI training unless the rightholder has validly opted out via a machine-readable reservation.

AI model developers may rely on the French TDM copyright exception to reproduce lawfully-accessed works for training, subject to a machine-readable opt-out.

Derived: Probable The AI Act applies directly in France, entered into force on 1 August 2024 and is applied in waves until 2 August 2028, but no French market-surveillance or notifying authority has been legally designated under Articles 28 or 70 as of 22 October 2026.

Derived: Probable France's DDADUE bill, which would designate the DGCCRF, CNIL, ACPR, Arcom and other sectoral regulators as AI Act competent authorities, was adopted at first reading by the Senate on 18 February 2026 and transmitted to the Assemblée nationale, where it remains in committee and has not been examined in plenary as at late October 2026 - more than a year past the Regulation's 2 August 2025 designation deadline.

Derived: Probable The proposed French AI Act governance scheme allocates sectoral competence: DGCCRF for consumer affairs, Arcom for audiovisual, ACPR for banking and insurance, AMF for financial markets, and ANSM/HAS for health; none of this is yet binding.

Derived: Probable A private member's bill registered at the Assemblée nationale on 15 September 2026 would create a new 'Autorité nationale de l'intelligence artificielle' with power to require prior authorisation before an AI system is placed on the market, operating without prejudice to the AI Act's own designated authorities; the bill is not in force.

The CNIL's first (July 2025) and second (6 February 2025) recommendations explain that AI models trained on personal data can fall within GDPR scope and set out a methodology for documenting the analysis, together with practical guidance on informing data subjects.

Derived: Probable Biometric processing used to control identity or access, including AI-driven biometric systems, is subject to a prior-authorisation regime under Loi 78-17: for State bodies, a décret en Conseil d'État taken after a reasoned, published CNIL opinion; unauthorised deployment can attract criminal liability of up to 5 years' imprisonment and a EUR 300,000 fine for individuals.

Derived: Probable The CNIL's constant doctrine treats biometric processing, including facial recognition, as disproportionate wherever a less intrusive alternative achieves the same purpose; it found facial-recognition access control in schools contrary to GDPR proportionality and minimisation principles, and fined a facial-recognition database operator EUR 20 million for building a database without a legal basis.

Under the CRPA, where an administration takes an individual decision founded on an algorithmic treatment, it must carry an explicit mention of that fact and, on request, communicate in intelligible form the degree and mode of the algorithm's contribution, the data processed and their sources, and the processing parameters applied, subject to protected secrets.

Administrations using an algorithmic treatment as the basis for individual decisions must publish online the rules defining the principal algorithmic treatments used in carrying out their missions, as an open-data/accountability obligation distinct from the individual explanation right.

French public administrations must disclose and explain algorithm-based individual decisions on request, subject to protected secrets.

Where a French public administration takes an individual decision based on algorithmic processing, the decision must carry an explicit statement of this, and on request the administration must explain the processing's degree of contribution, data used, parameters and weighting applied.

Derived: Probable Providers of high-risk AI systems must operate a risk-management system across the lifecycle to minimise risks to deployers and affected persons, and ensure sufficient transparency for deployers to interpret the system's output.

Derived: Probable Providers of high-risk AI systems must operate a risk-management system across the lifecycle to minimise risks to deployers and affected persons, and ensure sufficient transparency for deployers to interpret the system's output.

Derived: Probable As of 22 October 2026, no French authority has been legally designated under AI Act Arts 28 or 70, leaving the DGCCRF/CNIL/ACPR/Arcom designation scheme in the pending DDADUE bill rather than in force.

Derived: Probable CNIL imposed a EUR 20 million fine on an operator for building a facial-recognition database without a legal basis, cited as the reference sanction in this area.

Derived: Probable The Digital Omnibus extends the AI Act's SME penalty-calculation and documentation simplifications to small mid-cap companies (SMCs) under Article 99(6) and (6a).

Derived: Probable The CNIL's constant doctrine treats biometric processing, including facial recognition, as disproportionate wherever a less intrusive alternative achieves the same purpose; it found facial-recognition access control in schools contrary to GDPR proportionality and minimisation principles, and fined a facial-recognition database operator EUR 20 million for building a database without a legal basis.

France has not yet enacted the statute designating its AI Act national competent authorities, over a year past the Regulation's deadline.

Breach of the AI Act's Art.5 prohibitions carries fines of up to EUR 35 million or 7% of global turnover, whichever is higher.

Derived: Probable The AI Act applies directly in France, entered into force on 1 August 2024 and is applied in waves until 2 August 2028, but no French market-surveillance or notifying authority has been legally designated under Articles 28 or 70 as of 22 October 2026.

Article 57 of the AI Act requires each Member State to establish at least one national AI regulatory sandbox giving fee-free priority access to SMEs; the original 2 August 2026 deadline was extended to 2 August 2027 by the Digital Omnibus.

Derived: Probable France has not confirmed an operational Article 57 AI regulatory sandbox; the authority responsible for France's sandbox has not yet been designated because the DDADUE bill remains pending.

France has not confirmed an operational Art.57 AI regulatory sandbox; the deadline for establishing one was extended to 2 August 2027.

Member States must have at least one operational national AI regulatory sandbox by 2 August 2027, a date moved back from 2 August 2026.