Is It Safe for French Journalists to Use AI?

The answer fits in one line. AI can help you summarise, translate or structure, but never hand it what identifies a source. A name. A number. A meeting place. A document shared in trust. Pasted into a consumer AI, these details leave the newsroom. That is exposure to a third party. Yet source protection is set by law. And the newsroom remains the data controller under the GDPR. There is a clean method: anonymise before any prompt, then restore the values locally.

The problem: identifying details pasted into AI

The habit spreads fast in newsrooms. You ask an AI to summarise a long interview. You have it translate an exchange with a foreign contact. You submit raw notes to draw up an outline. To save time, you paste the text as is. That text often holds enough to trace a source. This is where the risk begins, not in the tool itself.

A source is not betrayed only by a name. Here is what a poorly prepared prompt can expose.

• The name, alias, number or address of a contact.
• A place, date or time of meeting that narrows the circle of suspects.
• A role or a rare detail that points to a single person.
• An internal document whose formatting betrays its origin.

The stake: source protection and the GDPR

Source protection is not a mere ethics rule. It has a legal basis. Article 2 of the Law of 29 July 1881 on freedom of the press protects it in the exercise of the mission to inform the public. That protection was reinforced by Law No. 2010-1 of 4 January 2010. The principle is clear: a journalist must be able to promise contacts that they will not be identified.

This protection is strong, but it is not absolute. Article 2 says so itself. It can be set aside only if an overriding requirement of public interest justifies it. And the measures must stay strictly necessary and proportionate to the aim pursued. In other words, secrecy yields in framed cases, never through simple carelessness. That is one more reason not to expose it yourself.

One point is often forgotten. The law also covers indirect breaches. Trying to identify a source by investigating the journalist's usual circle is already a breach of source protection. This reasoning applies to any trace left outside the newsroom. A prompt handed to an outside service is one such trace. The content can be retained, reviewed or reused to train the model. Exposure alone is enough to be a problem, even without a public leak.

The GDPR adds to the secrecy duty. The newsroom is the data controller for the personal data it handles. The CNIL, France's data protection authority, states that AI gets no exemption. As soon as an AI system processes personal data, the regulation applies fully. That also covers the data contained in prompts. Responsibility is not transferred to the model provider.

Should AI be banned in the newsroom?

No. No rule forbids a journalist from using AI. The tool can summarise, translate or produce an outline in seconds. What causes trouble is exposing the identifying details, not using AI itself. So the question is not “should we give up AI?”. The question is “how do we use it without exposing a source?”. The answer holds in one word: minimisation.

The fix: anonymise before the prompt

The fix matches what the CNIL says. When personal data is not needed for the processing, you strip it upstream. This is minimisation applied to AI. The journalist keeps the tool and saves time. The AI never sees what identifies the source. You stay in control of the secret, on your own machine.

In practice, you proceed step by step. You spot each identifying element. You replace it with a token before sending. The AI reasons about the shape of the text, without ever reading the name or the place. You then restore the real values, locally. Here is the order to follow.

1. 1Spot the identifying details: names, contact details, places, dates, rare details.
2. 2Replace them with reversible tokens, in the browser.
3. 3Send only the anonymized text to the AI.
4. 4Restore the real values in the reply, locally, then re-read the result.

That's what ONYRI Sanitize is for. The engine detects sensitive details — names, contact details, places, rare facts — and replaces them with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymized text reaches the model. The AI finds only tokens, never what identifies your source. You get AI's help, while reducing the exposure that source protection and the GDPR ask you to control.