# CNIL recommendations on the development of AI systems and the GDPR (AI how-to sheets)

- **Record type**: Policy instrument
- **Jurisdiction**: France
- **Instrument type**: Guidance
- **Status**: Guidance
- **Binding**: No — guidance, strategy or standard
- **Issuing body**: Commission nationale de l'informatique et des libertés (CNIL)
- **Adopted**: 2024-04-08

## In brief

CNIL AI how-to sheets is a non-binding guidance of France, issued by the Commission nationale de l'informatique et des libertés (CNIL). Its current status is guidance. Applies to any controller or processor developing or training AI systems with personal data under French and EU data-protection law.

## Summary

A series of practical guidance sheets, first published in 2024 and extended since, explaining how organisations can develop and train AI systems in compliance with the GDPR: defining a purpose, choosing a legal basis (including legitimate interest for web-scraped training data), data minimisation, retention, data-protection impact assessments, informing people and honouring their rights, and security of training datasets and models.

## Scope

Applies to any controller or processor developing or training AI systems with personal data under French and EU data-protection law.

## Notes on dates

First set published 8 April 2024; further sheets in 2024–2025.

## Provenance

- **Permanent id**: AIPT-POL-0076 (https://aipolicytracker.org/id/AIPT-POL-0076; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/policies/france-cnil-ai-how-to-sheets
- **Official source**: https://www.cnil.fr/en/ai-how-sheets
- **Source document**: AI how-to sheets
- **Published by**: CNIL
- **Review status**: verified
- **Confidence**: medium
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "CNIL recommendations on the development of AI systems and the GDPR (AI how-to sheets)" [AIPT-POL-0076, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0076 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.