#
Strong biometric and AI Act interface evidence; genetic-data-specific regime remains an evidenced gap.
Sub-modules (6)
Profiling RestrictionsAmber
CNIL and EU peer DPAs called for prohibiting AI systems categorising individuals by inferred protected characteristics (ethnicity, sex, political/sexual orientation).
Claims (1):
- CLM-FR-a10025x1 (claim on file)
Automated Decision Making TransparencyAmber
EU AI Act transparency-risk obligations (chatbots, generative content) apply from 2 August 2026, layered on GDPR transparency duties.
Claims (1):
- CLM-FR-a10026y2 (claim on file)
Ai Risk AssessmentsAmber
AI Act's four-tier risk classification (unacceptable/high/transparency/minimal) imposes conformity-assessment and risk-management duties on high-risk systems (Annex III), interfacing with but not replacing GDPR DPIA.
Claims (1):
- CLM-FR-a10027z3 (claim on file)
Biometric RegimeGreen
CNIL has sanctioned scraped facial-recognition-database creation as unlawful Article 9 GDPR biometric processing, and excludes biometric-identification cameras from its general smart-camera guidance given the distinct, in-principle-prohibited regime.
Claims (2):
- CLM-FR-a10028a4 (claim on file)
- CLM-FR-a10029b5 (claim on file)
Genetic DataRed
No FR-specific genetic-data regime findings surfaced this cycle.
Absence provenance: unavailable. Searched: unavailable.
State Surveillance CarveoutsAmber
Loi Informatique et Libertés remains the exclusive framework for penal-sphere and national-security/intelligence processing, carved out of GDPR's material scope.
Claims (1):
- CLM-FR-a10030c6 (claim on file)
Algorithmic, Biometric & Surveillance Governance
The most forward-looking signal in France's data protection environment concerns the CNIL's anticipated role under the European Union's AI Act. Secondary reporting on the regulator's 2026 programme of controls describes the CNIL preparing to be designated as market-surveillance authority for a subset of high-risk artificial intelligence systems. This designation, as reported, is understood to be contingent on the French law implementing the AI Act domestically, meaning the CNIL's formal authority in this space has not yet crystallised and remains dependent on a legislative step that has not been independently confirmed as complete.
The claim is carried at probable rather than confirmed confidence, reflecting that it rests on commentary describing the regulator's work programme rather than on the CNIL's own primary programme document, which was not independently re-verified. This distinction matters for how the development should be read: it describes a regulator positioning itself for an anticipated role, not a regulator that has already assumed formal market-surveillance powers over high-risk artificial intelligence systems.
If and when this designation takes effect, it would place the CNIL in a position with direct relevance to the governance of algorithmic systems more broadly, extending the regulator's institutional reach from its traditional personal-data protection mandate into supervision of a subset of high-risk artificial intelligence systems as defined under the EU framework. The scope of that subset, and the precise boundary between the CNIL's prospective market-surveillance role and the roles of other French and European authorities with overlapping competence in artificial intelligence oversight, was not detailed in the material available.
No related finding on biometric data processing or surveillance-specific instruments was identified in France beyond this preparatory AI Act posture. The signal here is institutional and anticipatory rather than a concrete new rule or enforcement action.
Outlook
The CNIL's path toward a formal AI Act market-surveillance designation depends on the French implementing law, and confirmation of that designation, once the implementing legislation is in place, would be a more concrete development than the preparatory posture recorded. Readers tracking the interaction between data protection and artificial intelligence oversight in France should expect the precise boundaries of the CNIL's prospective role to become clearer once the implementing law and the regulator's own published programme can be independently reviewed.