AI Act: France's Only Official FAQ Hasn't Moved Since July 2024
100 days from the high-risk deadline, France's only official AI Act guidance is 21 months old. A critical read of a document that has quietly become an archive piece.
A FAQ that didn't age, it froze
On July 12, 2024, France's data protection regulator CNIL published a page titled "Entry into force of the European AI Regulation: the CNIL's first questions and answers." Standard format: ten or so questions, brief answers, a measured institutional tone.
Twenty-one months later, the document hasn't moved. No public update, no erratum, no announced version 2. It still ranks first when a DPO or executive googles "CNIL AI Act."
The problem is that the context has shifted across four major dimensions since. The CNIL was officially designated as France's supervisory authority via a government amendment filed February 12, 2026. It published guidance on legitimate interest as a legal basis for AI in June 2025. The European text itself is being renegotiated through the Digital Omnibus. And on February 17, 2026, the Senate validated a French enforcement architecture involving roughly fifteen sectoral authorities.
102 days out from the high-risk provisions going live, this July 2024 document is what serves as the official reference. It deserves a critical read.
What the FAQ says, carefully
In its current form, the FAQ lays out the fundamentals. Four risk tiers: unacceptable, high-risk, specific transparency, minimal. A four-step calendar: prohibitions on February 2, 2025, general-purpose models on August 2, 2025, full provisions on August 2, 2026, Annex I systems on August 2, 2027.
On the GDPR articulation, the text is crystal clear: "The AI Regulation is very clear on this point: it does not replace GDPR requirements." Complementarity is established. A GDPR impact assessment is "presumed required" for high-risk AI systems. AI Regulation documentation can "draw on" existing impact analyses.
On the CNIL's own role, things turn cautious. "The CNIL plans to rely on these requirements to guide and support stakeholders." The conditional shows up everywhere. The CNIL "considers," the CNIL "actively contributes" to harmonized standards. No direct claim of official competence, because it had not yet been designated.
That tracks with the date. In July 2024, the European text had just entered into force. No French authority had been named. The Digital Ministry was hesitating between several setups. The CNIL did what it could: lay foundations, stake a claim, avoid overpromising.
Three silences that weigh at D-100
The first silence is on designation. The FAQ writes that "it is up to each Member State to organize the governance structure" within one year, meaning before August 2025. That European deadline was missed.
France finally filed its amendment on February 12, 2026, six months late. The Senate validated it five days later. The National Assembly still has to vote.
Three authorities competed for the mandate: the CNIL, the audiovisual regulator ARCOM, and a tandem of consumer-protection DGCCRF and economic-affairs DGE pushed by the finance ministry. The Conseil d'État rejected the government's initial proposal, flagging a risk of breaching the non bis in idem principle, meaning double sanction of the same actor by multiple authorities. The July 2024 FAQ mentions none of this. It couldn't, and it hasn't been updated since.
The second silence is on enforcement. The FAQ acknowledges the European fine schedule but describes no CNIL procedure. Yet the text adopted by the Senate explicitly grants the CNIL power to fine up to EUR 35 million for prohibited practices, or EUR 15 million for high-risk breaches. How a complaint will be processed, who can file it, within what timeframes, against whom: nobody knows. Doctrine will build out of the first cases.
The third silence is on the deliverables calendar. The FAQ promises that "the work has the vocation to bring further clarification." The CNIL's 2026 work programme announces sectoral guidance for health, education and labor.
No firm publication date. The public consultation on AI in healthcare ended on April 16, 2026. The programme itself notes it is "indicative and may evolve."
For high-risk businesses, the translation is simple: there will likely be no French sectoral guide available before the August 2 deadline.
The concrete French HR case at D-100
A French mid-market firm using AI scoring for recruitment falls into the high-risk category by default, via Annex III. It wants to be compliant today. What does it find in the official French corpus?
The July 2024 CNIL FAQ, which establishes principles but offers no practical case. The CNIL's June 19, 2025 guidance on legitimate interest, aligned with the EDPB's December 2024 opinion, which covers model training but not operational deployment. A 2026 work programme that announces guidance on AI at work, with no date.
For everything else, the firm has to assemble its own playbook from European sources: Brussels AI Office guidelines, EDPB opinions, CEN/CENELEC harmonized standards still being drafted, early feedback from other national authorities (Italy, Spain, Germany ahead of France).
It is feasible for a large group with a dedicated legal team. It is extremely difficult for an SMB or mid-cap discovering the topic.
The CNIL isn't at fault, but the gap is real
The CNIL's constraints deserve honesty. It hasn't been idle. It published guidance on legitimate interest, launched sectoral consultations, contributed to European EDPB work. The documentary lag is shared with most other European national authorities. And it inherited an AI Act mandate that piles onto GDPR with no clear visibility on associated headcount, a point French DPO analysts have raised publicly.
The open questions aren't its comfort zones. They are zones where the European text itself stays vague, where harmonized standards are pending, where the Digital Omnibus could rewrite everything by year-end. The CNIL can't publish firm guidance on a moving framework.
But the gap exists anyway. For a French company that has to decide in April 2026 whether such-and-such CV scoring tool is compliant or not, the absence of an official playbook is a direct operational cost. It pays for that vacuum in lawyer hours, outside counsel fees, and unquantified residual risk.
The July 2024 FAQ isn't a misleading document. It has become an archive piece. The French playbook for the AI Act, on the other hand, doesn't exist yet.
