Is It Safe for French Bailiffs (Commissaires de Justice) to Use AI?

The answer fits in one line. AI can help you draft or summarise, but never hand it your case data. A debtor's identity. The detail of an official record. A financial situation. Pasted into a consumer AI, these details leave your office. That is exposure to a third party. Yet a bailiff is a public and ministerial officer, bound by professional secrecy. And under the GDPR, your office remains the data controller. There is a clean method: anonymise before any prompt, then restore the values locally.

The problem: case data pasted into AI

The habit spreads fast in offices. You ask an AI to summarise a debt-recovery file. You have it rewrite a formal service document. You submit the draft of an official record. To save time, you paste the raw text. That text often holds the parties' real data. This is where the risk begins, not in the tool itself.

An office file concentrates some of the most sensitive data there is. Here is what a poorly prepared prompt can expose.

• The identity and contact details of the debtor, and of third parties named.
• The financial situation: debts, seizures, accounts, income, assets.
• The content of official records and reports.
• The file references, the served documents and attachments.

The stake: public officer, secrecy and the GDPR

A bailiff is not an ordinary provider. It is a public and ministerial officer, entrusted with a public-service mission. The bailiff serves documents, draws up official records and enforces court decisions. Since 1 July 2022, this single profession replaces the former bailiffs (huissiers de justice) and judicial auctioneers. This merger stems from Ordinance No. 2016-728 of 2 June 2016. Professional conduct is overseen by the Chambre nationale des commissaires de justice.

On that basis, the bailiff is bound by professional secrecy. It must not disclose the information obtained on duty. The office staff is bound too. The sanction is not theoretical. Article 226-13 of the Criminal Code punishes disclosing secret information by a person entrusted with it. The penalty runs up to one year in prison and a 15,000-euro fine.

Secrecy is not absolute. The law sets out cases where disclosure is required or allowed. But a consumer AI provider does not fall within those cases. It is an unauthorised third party. So pasting case data into an AI means exposing secret-covered information to that third party. The content can be retained, reviewed or reused to train the model. Exposure alone is enough to be a problem, even without a public leak.

The GDPR adds to the secrecy duty. The office is the data controller for its case data. The CNIL, France's data protection authority, puts minimisation at the heart of compliance. A processing of personal data must be strictly necessary for its purpose. And when anonymised data allows a comparable result, it should be preferred.

Is AI banned for bailiffs?

No. No rule forbids a bailiff from using AI. The tool can structure an argument, rewrite a document or suggest an outline. What causes trouble is exposing the data, not using AI itself. So the question is not “should we give up AI?”. The question is “how do we use it without exposing case data?”. The answer holds in one word: minimisation.

The fix: anonymise before the prompt

The fix matches what the CNIL says. When personal data is not needed for the processing, you strip it upstream. This is minimisation applied to AI. The bailiff keeps the tool and saves time. The AI never sees the file's real values. You stay in control of the secret, on your own machine.

In practice, you proceed step by step. You spot each identifying element. You replace it with a token before sending. The AI reasons about the shape of the file, without ever reading identities or amounts. You then restore the real values, locally. Here is the order to follow.

1. 1Spot the case data: debtor identity, financial situation, official records, references.
2. 2Replace them with reversible tokens, in the browser.
3. 3Send only the anonymized text to the AI.
4. 4Restore the real values in the reply, locally, then re-read the result.

That's what ONYRI Sanitize is for. The engine detects sensitive data — identities, contact details, amounts, references — and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymized text reaches the model. The AI finds only tokens, never your case data. You get AI's help, while reducing the exposure that professional secrecy and the GDPR ask you to control.