How do you frame an AI project so it survives GDPR review?

Framing (cadrage) is the phase everyone rushes and everyone regrets rushing. The CNIL's first batch of fiches, published on 8 April 2024, starts exactly here: define a purpose, determine the applicable legal regime, and qualify the actors before a single record is collected. Two positions matter in practice.

Which legal basis actually carries AI training and deployment?

The CNIL's position, aligned with the EDPB, is that consent is not the default for AI development: legitimate interest under Article 6(1)(f) is a workable basis provided the three-step test passes and safeguards are real. The CNIL dedicated two fiches to it after a consultation concluded in 2025, including one…

How do you run a DPIA for an AI use case with the CNIL method?

Article 35 GDPR makes a DPIA mandatory where processing is likely to create high risk, and explicitly for systematic automated evaluation with significant effects, large-scale special-category processing, and large-scale monitoring. The CNIL's fiche on impact assessments recommends a DPIA for AI development when at…

What must be locked in contracts and transfers?

The contract phase is where AI projects import risk wholesale. Article 28 requires a data processing agreement with any supplier processing personal data on your behalf: documented instructions, security, sub-processor control, deletion at exit. With AI vendors, three clauses deserve special attention: whether your…

What changes at go-live: information, rights, regurgitation?

Production is where the obligations rotate from datasets to people. The CNIL's February 2025 fiches address exactly this rotation: informing individuals and honoring their rights when their data sits inside a model. Two pragmatic positions stand out. On information, when data was scraped or obtained from third…

GDPR and AI in France: The CNIL method step by step

A project-lifecycle walkthrough of GDPR compliance for AI built on the CNIL method: framing, legal basis, DPIA, contracts, production, enforcement.

There are two ways to write about the GDPR and AI. The first is by friction point, which I did in the companion piece organized around six blockers. The second is the way a project actually unfolds: framing, legal basis, impact assessment, contracts, production, and eventually an audit. This article takes the second route, and it takes it through the French door, because the CNIL is the only European regulator that has published a full operational method for GDPR-compliant AI development: a numbered set of practical fiches, refined through three public consultations between 2024 and 2025, plus a regulatory sandbox that has now processed real AI projects end to end.