Can You Put a French Kbis Extract in an AI Tool?

Yes, you can technically paste a French Kbis extract into an AI tool like ChatGPT. And no, it isn't the disaster people imagine. A Kbis is a public record: anyone can order it from the commercial court registry (le greffe du tribunal de commerce), via Infogreffe. So the information it holds isn't secret. The real risk isn't the Kbis itself. It's what you add around it: the director's name, a home address, and above all the context of your request.

The myth: “a Kbis is confidential”

Many company directors believe they should never show their Kbis. That's false. The Kbis is the official record proving a company's registration in the Trade and Companies Register (le Registre du commerce et des sociétés, or RCS). It is issued and authenticated by the commercial court registry, via Infogreffe. Above all, it is public.

In practice, anyone can obtain one. The director gets it online for their company. A third party can also order it from Infogreffe or the registry. One aside worth noting: since 1 January 2023, the French administration no longer systematically asks for it in official procedures. The National Business Register extract (the RNE), with equivalent content, now replaces it as proof.

What a Kbis actually contains

A Kbis gathers a company's identifying information. You'll typically find:

• The company name and legal form (SARL, SAS, SA…).
• The SIREN number (the company's nine-digit identifier).
• The share capital and the registered office address.
• The company's declared line of business.
• The identity of the director or directors (the legal representatives).

A small vocabulary note. For a company (SAS, SARL, SA…), it's called an extrait Kbis. For an individual — a sole trader or micro-entreprise — it's an extrait K. In everyday speech, people say “Kbis” for both.

The real issue: the director's data and the context

If the document is public, where's the risk? It rests on three very real things. None of them concerns the confidentiality of the Kbis as such.

First, a Kbis contains personal data. According to the CNIL, personal data is any information relating to an identified or identifiable natural person. A director's name is such data, even in a professional setting. For a micro-entreprise registered at the owner's home, the office address may also be the home address. That piece of data is more sensitive than the company name alone.

Second, the risk comes mainly from the context you add. A Kbis on its own is neutral. But people rarely paste a Kbis “for nothing.” They pair it with a situation: a dispute with that director, a loan application, a negotiation, a judgment about a person. It's that context that becomes sensitive, not the Kbis.

Third, there's combination. The CNIL points out that a person can be identified indirectly, by cross-referencing several pieces of data. Pairing a Kbis with other information already amounts to processing personal data under the GDPR. And everything you paste enters the AI provider's processing.

The fix: anonymize the director and the context

Good news: you can work on a Kbis with AI. You just need to sort what's public from what isn't. Here's how to go about it:

1. 1Keep what's useful and neutral: the legal form, the line of business, the structure's logic.
2. 2Anonymize the director's name, and their home address if the office is at their home.
3. 3Above all, neutralize the sensitive context you attach: the dispute, the loan amount, the negotiation, the judgment about a person.
4. 4Send the anonymized prompt, then restore the real values in the answer, on your side.

“A Kbis is public, so there's no risk” — really?

That's the classic objection, and it's half true. Yes, the document is public: no one will blame you for “disclosing” a Kbis. But your situation around it isn't public. The dispute you describe, the loan you're negotiating, the judgment you make about that director: none of that is on file at the registry. That's the content that deserves your caution, not the nine digits of the SIREN.

That's exactly what ONYRI Sanitize does. The engine spots the director's name, a home address and the sensitive context, then replaces them with reversible tokens before sending. Detection and the token↔value mapping stay in your browser — only anonymized text reaches the AI. The model answers, and you restore the real values on your side. You keep using the tool, while reducing the exposure of the director's personal data and your context.