What the CNIL Says About AI in France

The CNIL is clear: the GDPR fully applies to artificial intelligence. The CNIL (Commission nationale de l'informatique et des libertés) is France's data protection authority. To it, AI is not a legal grey zone. The existing rules already govern it. The CNIL has published concrete recommendations for building AI systems that comply with the GDPR. One principle keeps coming back: data minimisation. In plain terms, feed a model only the minimum personal data it needs. That reading leads to a simple habit: anonymise your text before you send it to the AI.

The GDPR applies to AI, the CNIL states

Start with the foundation. The GDPR (General Data Protection Regulation) is the reference legal framework. The CNIL applies and enforces it in France. Its position on AI is firm. The GDPR fully applies to artificial intelligence systems. AI does not escape data protection law.

The CNIL goes further. It calls a common belief false. No, the GDPR does not block AI innovation in Europe. For the CNIL, innovating and respecting people's rights go together. The framework already exists. You apply it, you don't work around it.

The CNIL's recommendations on AI

The CNIL does not stop at principles. It has published concrete recommendations on developing AI systems. This work, finalised and expanded in 2025, comes with practical fact sheets and checklists. The audience: professionals who design or deploy AI.

These recommendations cover several clear areas.

• Purpose: a defined objective that frames and limits the data used.
• The lawful basis for processing personal data.
• Data minimisation, kept to what is strictly necessary.
• The split of roles: controller, joint controller, processor.
• Security and data protection by design (privacy by design).

The CNIL also aligns its recommendations with the European AI Act, adopted in 2024. The two texts complement each other. One protects the data, the other frames the systems.

Data minimisation, the key principle

One principle deserves its own place: data minimisation. It sits at the core of the GDPR. The CNIL repeats it consistently. The idea is simple. Processing must use only the personal data its purpose requires. No more, no data kept "just in case".

Generative AI: what the CNIL and the EDPB recall

And generative AI, like large language models? The CNIL has not published a ban. It handles the topic in its AI action plan. Its message stays the same: the GDPR applies.

The European Data Protection Board (EDPB, or CEPD in French) clarified a key point. In an opinion adopted in December 2024, it recalls one thing. The GDPR often applies to AI models trained on personal data. The reason: these models can memorise that data. The CNIL offers a method to assess whether a model is concerned.

The fix: anonymise before the prompt

What should you take away as a user? Minimisation points the way. You should feed an AI the least personal data possible. That is exactly what anonymising upstream achieves. You replace each sensitive value with a token before sending. The model reasons about the shape, not your real values. This link is our reading of the principle, not a word-for-word CNIL instruction.

When you really must include a real case, anonymise it first. Replace each piece of personal data with a token. The AI reasons about your situation without ever seeing the real values. You restore those values afterwards, locally.

1. 1Spot the personal data in your text: names, emails, identifiers, amounts.
2. 2Replace it with reversible tokens, in the browser.
3. 3Send only the anonymised text to the model.
4. 4Restore the real values in the reply, locally.

That's what ONYRI Sanitize is for. The engine detects sensitive data — names, emails, identifiers, amounts — and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymised text reaches the model. In practice, you apply the data minimisation the CNIL places at the heart of the GDPR.