Detailed overview
France is regulated by the EU AI Act. French businesses that provide or professionally use AI systems must classify those systems under the EU AI Act and comply with the relevant rules for prohibited AI, high-risk AI, transparency-risk AI and general-purpose AI.
France does not have a separate national horizontal AI Act equivalent to the EU AI Act, but French law contains important AI-specific provisions on synthetic content, impersonation and sexual deepfakes. French data-protection law and CNIL guidance are also central where AI processes personal data.
Criminal law on synthetic content
French criminal law punishes the publication of a montage using a person's image or words without consent where it is not obvious that the content is a montage or where this is not expressly stated. Since the 2024 digital-space law, the same rule applies to visual or audio content generated by algorithmic processing that represents a person's image or words without consent, unless it is obvious or expressly stated that the content is algorithmically generated. The basic penalty is one year of imprisonment and EUR 15,000. The penalty increases to two years of imprisonment and EUR 45,000 where the offence is committed using an online public communication service.
France also criminalises non-consensual sexual montages and algorithmically generated sexual visual or audio content reproducing a person's image or words. The basic penalty is two years of imprisonment and EUR 60,000. Where the publication is made using an online public communication service, the penalty increases to three years of imprisonment and EUR 75,000.
CNIL and personal data
For business AI systems, the French data-protection authority, CNIL, is highly relevant. CNIL states that, like any personal-data processing, the collection and use of personal data through an AI system must comply with the GDPR and the rights of individuals. CNIL's AI materials address legal basis, purpose limitation, data minimisation, training-data governance, retention, transparency, rights of individuals, security and the risk that certain AI models may contain or memorise personal data.
Business obligations
Where AI is high-risk under the EU AI Act, French companies must comply with EU high-risk AI requirements. Where AI creates synthetic media or deepfakes, French criminal-law disclosure and consent rules may apply. Where AI uses personal data, GDPR and CNIL expectations apply.
Penalties
Penalties may arise under the EU AI Act, French criminal law and data-protection law. The EU AI Act imposes large administrative fines for prohibited and high-risk AI breaches. French criminal penalties apply to certain non-consensual AI-generated impersonation, montage and sexual-content cases. GDPR penalties may apply where AI involves unlawful personal-data processing.