CNIL AI how-to sheets: requirements, deadlines and compliance actions
CNIL recommendations on the development of AI systems and the GDPR (AI how-to sheets)
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 7 sections
In brief
CNIL AI how-to sheets is a non-binding guidance of France, issued by the Commission nationale de l'informatique et des libertés (CNIL). Its current status is guidance. Applies to any controller or processor developing or training AI systems with personal data under French and EU data-protection law.
- Jurisdiction
- France
- Instrument type
- Guidance
- Status
- Guidance
- Legal force
- Non-binding (guidance, strategy or standard)
- Issuing body
- Commission nationale de l'informatique et des libertés (CNIL)
- Adopted
- 8 April 2024
- Official source
- AI how-to sheets
- Verification
- Verified against the official source 26 Sep 2026
What is CNIL AI how-to sheets?
A series of practical guidance sheets, first published in 2024 and extended since, explaining how organisations can develop and train AI systems in compliance with the GDPR: defining a purpose, choosing a legal basis (including legitimate interest for web-scraped training data), data minimisation, retention, data-protection impact assessments, informing people and honouring their rights, and security of training datasets and models.
Who does it apply to?
Applies to any controller or processor developing or training AI systems with personal data under French and EU data-protection law.
- Sectors
- Cross-sector / all sectors
- AI use cases
- Generative AI and foundation models
- AI system types
- General-purpose AI modelGenerative AI system
When do the requirements apply?
First set published 8 April 2024; further sheets in 2024–2025.
Official sources
-
AI how-to sheets
CNIL · 8 Apr 2024 · Tier 1 source
Cite this record
AIPolicyTracker (2026). “CNIL AI how-to sheets” [AIPT-POL-0076, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0076 (accessed 27 October 2026). Data licensed CC BY 4.0.
Permanent id AIPT-POL-0076: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: AI how-to sheets, CNIL, https://www.cnil.fr/en/ai-how-sheets.
BibTeX
@misc{aipolicytracker2026_cnilaihowtosheets,
author = {{AIPolicyTracker}},
title = {{CNIL AI how-to sheets}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/policies/france-cnil-ai-how-to-sheets}},
url = {https://aipolicytracker.org/policies/france-cnil-ai-how-to-sheets},
urldate = {2026-10-27},
note = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
Add a status badge to your site or README
It shows the status and review state as recorded here and updates when the record does.
Markdown
[](https://aipolicytracker.org/id/AIPT-POL-0076)HTML
<a href="https://aipolicytracker.org/id/AIPT-POL-0076"><img src="https://aipolicytracker.org/badges/france-cnil-ai-how-to-sheets.svg" alt="AIPolicyTracker: CNIL recommendations on the development of AI systems and the GDPR (AI how-to sheets), Guidance · verified 26 Sep 2026" height="20"></a>Change history
Record history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Record version 1: Added in the September 2026 global coverage expansion from the official source listed; reviewer to confirm dates, status and scope against the source text. Every earlier wording is in the GitHub repository.
Frequently asked questions
Is CNIL AI how-to sheets in force?
CNIL AI how-to sheets has the status "guidance"; it is not a binding law in force.
Is CNIL AI how-to sheets legally binding?
No. CNIL AI how-to sheets is a guidance; it sets expectations rather than legal requirements, unless another instrument gives it force.
Who does CNIL AI how-to sheets apply to?
Applies to any controller or processor developing or training AI systems with personal data under French and EU data-protection law.
Where is the official text of CNIL AI how-to sheets?
The official text is published by CNIL at https://www.cnil.fr/en/ai-how-sheets (AI how-to sheets). This record links to it and is checked against it.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.