AI Act and GDPR: preparing an AI project in France

A one-sentence definition

The AI Act governs artificial intelligence systems according to their use and risk level, while GDPR governs personal-data processing, including when an AI system uses that data.

The two frameworks are complementary. A tool that is not classified as high-risk may still process personal data and require a legal basis, a specific purpose and appropriate safeguards.

Start with the use, not the model

Document who provides the system, who deploys it, which people are affected and which decision it influences. This map clarifies responsibilities and prevents a prototype from becoming permanent processing without a new review.

The European Commission publishes the AI Act implementation timeline and supporting resources. The authoritative text remains Regulation (EU) 2024/1689.

Examine the data

For every source, record its purpose, origin, retention period, access rights and possible transfers. Minimize data sent to the model and separate testing from production.

The French data-protection authority states that personal-data use in AI systems must respect GDPR and individual rights. Its practical guidance covers purposes, legal bases and dataset creation.

Design transparency and control

People should know when they are interacting with an automated system where required. Sensitive decisions need escalation paths, competent human oversight and understandable logs.

Teams also need to understand the system’s limits: available sources, prohibited cases, confidence level and the procedure to follow when something goes wrong.

Maintain a living record

Governance does not end at launch. Keep evaluations, versions, incidents, supplier changes and approval decisions. Reassess the system whenever a model, source or intended use changes.

This article provides technical guidance and does not replace legal advice tailored to a specific situation.