[et_pb_section fb_built=”1″ _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.8″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n
The GDPR does not stop at the gateway to an AI system. As soon as a model is trained, fine-tuned<\/em>, or used with data relating to an identified or identifiable individual, all the principles of Article 5 apply\u2014including during the training phase itself\u2014a fact that many technical teams discover too late. In light of this reality, the CNIL has published, since 2024, a collection of practical guides<\/u><\/a> that specifies, point by point, what the GDPR actually entails for the development and use of AI systems\u2014a framework that was significantly refined in 2025 and 2026, to the point where it now serves as a nearly operational reference rather than a text setting out general principles. <\/p>\n <\/p>\n The CNIL itself felt it necessary to state this explicitly: the notion that the GDPR would hinder innovation in artificial intelligence in Europe is false. The regulation does not prohibit the use of personal data for AI; rather, it sets out the conditions under which such use remains lawful. The question, therefore, is never \u201cDoes the GDPR allow this AI project?\u201d but rather \u201cWhat legal basis and safeguards ensure it can be carried out in compliance with the law?\u201d <\/p>\n <\/p>\n Published on June 19, 2025, and finalized in May 2026 following a public consultation, the CNIL\u2019s recommendations on legitimate interest<\/u><\/a> resolve an issue that had stalled many projects: consent, which is difficult or even impossible to obtain for massive and heterogeneous datasets, is not the only available option. Legitimate interest, as provided for inArticle 6(1)(f)<\/u><\/a> of the GDPR, constitutes the most commonly applicable legal basis for the development of AI systems, provided that the requirements formalized by the CNIL as a three-part test are met. <\/p>\n <\/p>\n This test requires demonstrating three cumulative elements<\/u><\/a>, each of which must be documented in writing and retained for audit purposes<\/p>\n <\/p>\n <\/p>\n <\/p>\n The second part, published at the same time, addresses the conditions under which the collection of publicly available data on the web remains compliant. Web scraping<\/em> is not prohibited in principle, but it must comply with the terms of use of the source sites and robots.txt files, exclude categories of data that are clearly sensitive, and ensure that data subjects have a right to object that is truly accessible. The CNIL provides a concrete example of the line that must not be crossed: creating a database of images collected indiscriminately from numerous websites\u2014without excluding sensitive content or providing safeguards against the model storing such data\u2014for a purpose as vague as \u201cthe provision of new services\u201d would not satisfy the balancing requirement of the three-part test. <\/p>\n <\/p>\n Sensitive data as defined inArticle 9 of the GDPR<\/a> (health, political opinions, biometric data) generally cannot be used to train an AI system without a specific legal basis; legitimate interest alone is insufficient for these categories.<\/p>\n <\/p>\n A Data Protection Impact Assessment (DPIA) becomes mandatory whenever an AI system poses a high risk to data subjects, which is often the case for HR, healthcare, or scoring applications. The CNIL therefore considers that, for the development of high-risk systems covered by the European AI Act<\/a> and involving personal data, conducting a Data Protection Impact Assessment (DPIA) is, in principle, necessary. <\/p>\n The CNIL has explicitly identified AI as one of its priority areas for oversight in 2026, with a particular focus on AI processing operations that combine high risks and sensitive data, especially in the labor and healthcare sectors. In this context, inspections focus in particular on the processing register, data processing agreements entered into with AI providers (subcontractors), and the actual existence of the required data protection agreements, in accordance with standard GDPR obligations applicable to high-risk processing. <\/p>\n \u2192 See<\/em> our guide to<\/em> corporate AI governance<\/em><\/u><\/a> for an overview of the compliance process.<\/em><\/p>\n <\/p>\n <\/p>\n [\/et_pb_text][et_pb_accordion _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_accordion_item title=”Does my AI system require an AIPD, and how do I create one?” open=”on” _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n Yes, if the processing poses a high risk<\/strong> to individuals\u2019 rights and freedoms. For AI, the CNIL recommends an AIPD as soon as two criteria<\/strong> are met (sensitive data, large-scale collection, vulnerable individuals, data cross-referencing, innovative use, or new technologies) or if significant risks exist (discrimination, misuse, etc.). For high-risk systems as defined by the AI Act, a DPIA is generally required<\/strong>. The DPIA must be conducted prior to implementation and updated on an iterative basis. It must identify risks specific to AI (memorization\/regurgitation, bias, poisoning attacks, loss of control over data, etc.) and define a plan of action to reduce them to an acceptable level. <\/p>\n [\/et_pb_accordion_item][et_pb_accordion_item title=”Can I use legitimate interest to train my model?” _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content” open=”off”]<\/p>\n Yes, this is often the most appropriate legal basis for AI development by private entities. However, the three-part test<\/strong> must be met: (1) a legitimate and precisely defined interest; (2) necessity (no less intrusive alternative); (3) a benefits-versus-risks assessment (memorization, regurgitation, bias, opacity). This analysis must be documented<\/strong>. <\/p>\n [\/et_pb_accordion_item][et_pb_accordion_item title=”What security measures should be implemented for an AI system?” _builder_version=”4.27.8″ _module_preset=”default” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” open=”off” sticky_enabled=”0″]<\/p>\n For AI, the CNIL (French Data Protection Authority) recommends combining “traditional” security (access, encryption, backups, DevSecOps) with an analysis of AI-specific risks: verification of data sources, versioning<\/em> of datasets, anonymization\/pseudonymization, output control (filters, watermarking<\/em> )<\/em> , audits\/ red teaming<\/em> , and a rollback<\/em> plan. The CNIL refers to frameworks such as EBIOS-RM<\/a> , OWASP AI Security<\/a> , ENISA, MITRE ATLAS, etc. <\/p>\n [\/et_pb_accordion_item][et_pb_accordion_item title=”Am I the project lead, co-lead, or subcontractor on an AI project?” _builder_version=”4.27.8″ _module_preset=”default” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” open=”off” sticky_enabled=”0″]<\/p>\n It depends on who determines the \u201cwhy\u201d<\/strong> (purpose) and the \u201chow\u201d<\/strong> (means) of processing personal data. If you decide these elements on your own , <\/strong> you are the data controller; <\/strong> if you do so with other organizations, you are joint controllers<\/strong> (contract required); and if you act on behalf of a data controller, you are a data processor<\/strong> (contract, security, notification). In the context of AI, the CNIL specifies that a provider may be the data controller if it builds its own training dataset, or a data processor if it follows your specific instructions. <\/p>\n [\/et_pb_accordion_item][\/et_pb_accordion][et_pb_text _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n <\/p>\n Our experts will help you ensure that your AI processing practices comply with CNIL recommendations.<\/p>\n <\/p>\n Would you like to discuss your project or assess your needs? Contact our experts.<\/u><\/a><\/p>\n [\/et_pb_text][et_pb_code _builder_version=”4.27.8″ _module_preset=”default” theme_builder_area=”post_content” hover_enabled=”0″ sticky_enabled=”0″]Myth vs. Reality: Does the GDPR Really Hinder AI Innovation?<\/h2>\n
AI Training and the GDPR: Legitimate Interest as a Legal Basis<\/h2>\n
The CNIL\u2019s Three-Part Test: The Three Mandatory Criteria for Establishing Legitimate Interest<\/h3>\n
\n
\n
<\/ul>\n<\/ul>\n<\/ul>\n
\n
\n
Web Scraping and Data Collection: What Limits Has the CNIL Set?<\/h2>\n
Sensitive Data (Article 9) and AIPD: The CNIL\u2019s Enforcement Priorities<\/h2>\n
Which uses of AI trigger a mandatory Impact Assessment (AIPD)?<\/h2>\n
FAQ: GDPR Compliance as It Applies to AI<\/h2>\n
Ensure Your Use of AI Complies with the GDPR<\/strong><\/h2>\n