GDPR-compliant AI: the checklist for generative AI in a company
Chatbots, retrieval-augmented generation, agents: what the GDPR requires, what the CNIL and the EDPB recommend, what the European AI Act adds and when. Every line points to its text, and obligation is distinguished from recommendation.
Does the GDPR apply to generative AI?
Yes, as soon as personal data enters a request, an indexed document or a log, and often to the model itself. The CNIL has written it since 22 July 2025: the GDPR applies to models trained on personal data because of their memorisation capacity.
The CNIL's exact sentence, in its communication finalising its recommendations, reads: "Le RGPD s'applique, dans de nombreux cas, aux modèles d'IA entraînés sur des données personnelles en raison de leurs capacités de mémorisation" (CNIL, 22 July 2025). The European Data Protection Board says the same in its Opinion 28/2024 of 17 December 2024: models trained with personal data "cannot, in all cases, be considered anonymous", and anonymity is assessed case by case (EDPB Opinion 28/2024).
Three levels of text apply, and they must be told apart before any checklist:
- the obligation, from Regulation 2016/679 itself and from Regulation 2024/1689 on AI;
- the recommendation, from the CNIL (AI practical sheets published from 8 April 2024 to 22 July 2025) and from the EDPB, which says how the authority will read the obligation;
- the good practice, which the authority points out without imposing it, such as on-premises deployment for retrieval-augmented generation.
Who is responsible for what: provider, deployer, processor?
The company deploying the AI is the controller for its uses. The model or API provider is, depending on the case, a processor or the controller of its own training. The AI Act adds a "deployer" role with its own obligations.
Under the GDPR, Article 28 sets the processor rule: the controller "shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures" (Regulation 2016/679, Article 28). The EDPB further asks the deployer of a third-party model to have checked that it was not developed through unlawful processing: authorities "should take into account whether the controller deploying the model conducted an appropriate assessment" (Opinion 28/2024). The CNIL sheet on the division of responsibilities between provider and deployer of a non-anonymous model has been announced since February 2025 and was not published as of 6 September 2026.
Under the AI Act, Article 26 requires deployers of high-risk systems to take "appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use", to assign "human oversight to natural persons who have the necessary competence, training and authority", and, for employers, to inform "workers' representatives and the affected workers" (Regulation 2024/1689, Article 26).
Which legal basis for a chatbot, retrieval-augmented generation or an agent?
Most often legitimate interest, under three cumulative conditions the CNIL spelled out on 19 June 2025: a legitimate interest, processing necessary to that interest, and no disproportionate harm to the persons' rights. Consent remains possible but can be withdrawn.
The CNIL sheet states the three conditions as follows: the interest pursued must be legitimate; the processing must be necessary to achieve it; and it must not disproportionately harm the rights and interests of the persons (CNIL, legitimate interest, 19 June 2025). It takes a very common case as an example: a conversational agent provider wishing to reuse users' future conversations to improve the model. Reusing conversations for retraining is therefore a separate processing, with its own legal basis and its own information.
The purpose is defined before the legal basis. For a general-purpose system, the CNIL accepts a purpose defined by the type of system and a list of the capabilities it can reasonably foresee (CNIL, defining a purpose, 8 April 2024), which covers an internal assistant, provided that list is written.
Which obligations before going live?
Ten points, each with its text and the evidence to produce. The first eight come from the GDPR, the last two from the AI Act. The "evidence" column is what an audit will ask to see, not what to say.
| Checkpoint | Text | Nature | Evidence to produce |
|---|---|---|---|
| Specified and explicit purpose | GDPR Art. 5(1)(b); CNIL, purpose sheet | obligation | written list of uses and foreseen capabilities |
| Legal basis chosen and documented | GDPR Art. 6; CNIL, legitimate interest sheet | obligation | three-condition test, balancing |
| Minimisation | GDPR Art. 5(1)(c): "adequate, relevant and limited to what is necessary" | obligation | fields collected, masking before sending to the model |
| Retention period | GDPR Art. 5(1)(e); CNIL: personal data cannot be kept indefinitely | obligation | periods per category, purge of logs and memory |
| Information of the persons | GDPR Art. 13 and 14; CNIL, 7 February 2025 | obligation | privacy notice, publication if indirect collection is disproportionate |
| Record of processing | GDPR Art. 30 | obligation | record entry per AI use |
| Impact assessment | GDPR Art. 35; CNIL: presumed necessary for every AI Act high-risk system | obligation if high risk | dated DPIA, measures adopted |
| Security and memorisation | GDPR Art. 32; CNIL, 22 July 2025: risks of memorisation, reconstruction and membership inference | obligation | access log, extraction tests, segregation |
| AI literacy of users | AI Act Art. 4, since 2 February 2025 | obligation of means | training records |
| AI disclosure | AI Act Art. 50, since 2 August 2026 | obligation | on-screen notice, marking of generated content |
Two points deserve a careful reading. The impact assessment first: the CNIL writes that for the development of all high-risk systems under the AI Act, a DPIA will be presumed necessary (CNIL, DPIA, 8 April 2024), which covers recruitment, access to benefits and creditworthiness. The persons' rights next: when memorisation in the model is established, the controller must confirm it to the person (CNIL, rights of the persons, 7 February 2025), which assumes knowing how to test one's model.
Where may the data go? Transfers and hosting
Outside the Union, only under Chapter V of the GDPR. To the United States, the 2023 adequacy decision is valid and the action against it was dismissed on 3 September 2025, but an appeal is pending. For health data, hosting on behalf of third parties requires HDS certification, with storage in the European Economic Area.
Article 44 sets the principle: a transfer to a third country shall take place only if the conditions of the chapter are complied with (Regulation 2016/679, Article 44). Implementing Decision (EU) 2023/1795 of 10 July 2023 finds that the United States ensures an adequate level of protection (Decision 2023/1795); the General Court dismissed the action for annulment on 3 September 2025 (case T-553/23, press release 106/25) and an appeal, C-703/25 P, was pending as of 6 September 2026. A transfer based on that decision is therefore lawful today, and fragile.
For health data, the order of 26 April 2024 published version 2 of the HDS certification framework, in force six months after publication (order of 26 April 2024); its requirement 28 obliges the host and its subcontractors to store this data exclusively within the European Economic Area (HDS framework v2, ANS), and earlier certificates had to be renewed by 16 May 2026 at the latest (ANS timeline). The obligation targets hosting on behalf of a third party (Article L. 1111-8 of the French Public Health Code): on your own servers you do not become a host, you answer for security under Article 32.
Finally, on retrieval-augmented generation, the CNIL wrote as early as 18 July 2024 that it generally seems more appropriate and more secure to favour on-premises deployment (CNIL, Q&A on generative AI). It is a recommendation, not an obligation, and the most concrete of all.
What does the European AI Act change, and when?
Two obligations bind every deployer right now: AI literacy since 2 February 2025 and AI disclosure since 2 August 2026. The high-risk obligations of Annex III start on 2 December 2027, those of Annex I on 2 August 2028.
This timeline is that of Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal of 24 July, which rewrites Article 113: Chapter III applies from 2 December 2027 for Annex III and from 2 August 2028 for Annex I (Regulation 2026/1744, published text). The CNIL updated its Q&A on 17 August 2026 (CNIL, entry into force of the regulation). Many materials still announce 2 August 2026 for high risk: they are outdated.
What already applies, article by article:
- Article 4, AI literacy: deployers take measures to foster AI literacy, and the rewritten text specifies that this obligation does not require providers or deployers to guarantee a specific level; training records are enough;
- Article 50, transparency: persons must be informed that they are interacting with an AI system, unless this is obvious; for generative systems placed on the market before 2 August 2026, content marking is due by 2 December 2026 (Article 111(4));
- Annex III, to prepare for 2 December 2027: recruitment and decisions on the employment relationship (point 4), access to essential public services including healthcare (point 5(a)), creditworthiness and credit scoring except fraud detection (point 5(b)).
What is actually at stake?
In France, the CNIL's 2025 record counts 83 sanctions for 486.8 million euros, with no decision specific to generative AI. In Italy, the Garante sanctioned two chatbot publishers: 5 million euros on 10 April 2025, 158,000 euros on 3 July 2026.
The French record is public (CNIL, 2025 sanctions record, 9 February 2026); its first two decisions of 2026 concern security, not AI. The Italian Garante fined Luka Inc., publisher of Replika, 5 million euros by decision no. 232 of 10 April 2025, on Articles 5, 6, 12, 13, 24 and 25 of the GDPR (Garante, decision no. 232), then Character Technologies 158,000 euros by decision no. 487 of 3 July 2026, for insufficient information, a late impact assessment and a late EU representative (Garante, press release of 9 July 2026). The grounds are exactly the rows of the table above.
What an on-premises architecture settles, and what it does not
Running the model on your hardware removes the transfer and the inference processor, and it makes security observable. It waives no substantive obligation: purpose, legal basis, information, register, impact assessment and the persons' rights remain due.
| Obligation | With an API outside the Union | On-premises, open-weight model |
|---|---|---|
| Transfers (Art. 44 to 49) | to be framed, fragile adequacy decision | not applicable, nothing leaves |
| Processor (Art. 28) | contract and guarantees to obtain | no processor for inference |
| Security (Art. 32) | contractual, not observable | observable on traffic and logs, still to be demonstrated |
| Retention, logs, memory | depends on the provider | under your control, to be purged |
| Purpose, legal basis, information | due | due, identically |
| Impact assessment | due if high risk | due if high risk, identically |
| Rights on the model (memorisation) | to obtain from the provider | testable in-house, to document |
| AI Act, Art. 4 and 50 | due | due, identically |
Our analysis of local AI platforms details what on-premises delivers; the article on zero-retention policies shows why the contractual clause does not replace the architecture; the one on chatbots and the GDPR covers the four obligations settled in the architecture.
Frequently asked questions
Can an AI be GDPR-compliant by default?
No. Compliance qualifies a processing, not a piece of software. The same model is compliant in a documented use with a legal basis, information of the persons and retention periods, and non-compliant in another. That is why the checklist bears on your use and your evidence, not on the product.
Can an AI agent that executes actions comply with the GDPR?
Yes, under the same conditions as a chatbot, with two more points: its data access must be limited to its purpose, and any decision producing legal effects on a person falls under Article 22, which requires human intervention. The AI Act further requires, for high risk, human oversight by trained persons with the necessary authority.
Is an impact assessment required for an internal assistant?
Not systematically. Article 35 requires it when the processing is likely to result in a high risk, and the CNIL presumes it necessary for every high-risk system under the AI Act. A document assistant with no sensitive data and no decision about persons can do without, provided the reasons are written down.
May personal data be sent to a US API?
Lawfully yes, as of 6 September 2026, on the basis of the 2023 adequacy decision, whose action for annulment was dismissed on 3 September 2025; an appeal remains pending. A processor contract compliant with Article 28 and information of the persons mentioning the transfer are also needed. The CNIL recommends on-premises for retrieval-augmented generation.
Does the GDPR apply to the model itself?
Often. The CNIL writes that models trained on personal data fall under the GDPR because of their memorisation capacity, and the EDPB asks anonymity to be demonstrated case by case. The deployer of a third-party model must have checked that it was not developed through unlawful processing.
Further reading on the blog
This checklist gives the framework; the blog articles below each cover one case, from chatbots to contract translation.
- Generative AI and GDPR: what the CNIL recommends and the extraterritorial risk.
- AI chatbots and GDPR: the four obligations settled in the architecture.
- Sensitive data and zero retention: what a clause really guarantees.
- Legal translation and AI: translating a contract without publishing it.
- Enterprise RAG: connecting the model to your documents without exposing them.
- What is a sovereign AI platform: definition, options and legal framework.
Sources
Texts: Regulation (EU) 2016/679; Regulation (EU) 2024/1689; Regulation (EU) 2026/1744; Implementing Decision (EU) 2023/1795; General Court, T-553/23, press release 106/25; order of 26 April 2024; HDS framework v2; ANS timeline; Article L. 1111-8 of the French Public Health Code. Recommendations: CNIL, finalisation of recommendations, 22 July 2025; legitimate interest, 19 June 2025; purpose; collection and retention; information of the persons, 7 February 2025; impact assessment; rights of the persons; status of a model; security of development; Q&A on generative AI, 18 July 2024; Q&A on the AI Act, 17 August 2026; EDPB, Opinion 28/2024. Sanctions: CNIL, 2025 record; Garante, Replika; Garante, Character.AI. All pages re-read on 6 September 2026.