CNIL AI how-to sheets: requirements, deadlines and compliance actions
CNIL recommendations on the development of AI systems and the GDPR (AI how-to sheets)
What is CNIL AI how-to sheets?
A series of practical guidance sheets, first published in 2024 and extended since, explaining how organisations can develop and train AI systems in compliance with the GDPR: defining a purpose, choosing a legal basis (including legitimate interest for web-scraped training data), data minimisation, retention, data-protection impact assessments, informing people and honouring their rights, and security of training datasets and models.
Who does it apply to?
Applies to any controller or processor developing or training AI systems with personal data under French and EU data-protection law.
- Sectors
- Cross-sector / all sectors
- AI use cases
- Generative AI and foundation models
- AI system types
- General-purpose AI modelGenerative AI system
When do the requirements apply?
First set published 8 April 2024; further sheets in 2024–2025.
Official sources
-
AI how-to sheets
CNIL · 8 Apr 2024 · Tier 1 source
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.