Contents6
On 18 February 2026, the French Senate adopted the bill that designates the authorities in charge of enforcing the AI Act in France. As of 20 October 2026, eight months later, the National Assembly has still not adopted it, and no committee report has been published there. The European regulation itself already applies: it required Member States to name their authorities by 2 August 2025.
This article in our Business AI section takes stock from the legislative file and the text adopted by the Senate. It is not legal advice: for a sensitive use case, your DPO or a lawyer has the final say. What the AI Act requires from a business that uses AI is covered in our AI Act and GDPR guide for small businesses.
In short
France has not yet designated its AI Act enforcement authorities by law: the bill adapting French law to EU law is waiting for the National Assembly.
The Senate text makes the CNIL, the French data protection authority, the central regulator: most prohibited practices, recruitment, staff management, biometrics.
Arcom, the DGCCRF and the ACPR share the rest: transparency of generated content, consumers, finance and insurance.
The wait suspends nothing: obligations already apply, and the AI Office has supervised general-purpose models since 2 August 2026.
Why does France not have its AI Act authorities yet?
The AI Act is a regulation: it applies without transposition. But its Article 70 requires each Member State to designate at least one market surveillance authority and one notifying authority, and to publish their contact details by 2 August 2025. In France, that designation requires a law, and the law is late. According to the National Assembly’s legislative file, checked on 20 October 2026, this is where the text stands:
- 2 August 2025
Deadline set by the AI Act to designate national authorities and adopt penalties.
- 9 September 2025
The Ministry of the Economy presents its plan to split supervision among existing authorities.
- 10 November 2025
The government tables the bill adapting French law to EU law in the Senate, under the accelerated procedure.
- 18 February 2026
The Senate adopts the text, after a government amendment that strengthens the CNIL’s role.
- 20 February 2026
The text is sent to the National Assembly and referred to its economic affairs committee.
- 23 April 2026
Four other Assembly committees are asked for opinions.
- 2 August 2026
AI Act enforcement starts at EU and national level, according to the Commission’s timeline.
The September 2025 plan is the one Next described when it was presented; the February 2026 amendment, which moves part of it to the CNIL, was reported by Next on 13 February 2026. The European timeline is the one published by the AI Act Service Desk.
Who would supervise what under the Senate text?
The text adopted on 18 February 2026 does not create a single regulator: it splits supervision among existing authorities, by use of AI. Here is the split that matters to a business, as read in the text adopted by the Senate (Articles 24 to 24 terdecies). It is a text passed by one chamber, not a law: as of 20 October 2026, the National Assembly has not yet examined it and can change everything, authorities and amounts alike. With that reservation, here is what it provides:
- Recruitment, staff management, employee evaluation: the CNIL, which would supervise high-risk employment uses (Annex III, point 4).
- Biometrics and emotion recognition: the CNIL, including the duty to inform people exposed to these systems.
- Access to credit and insurance: the ACPR, the banking and insurance supervisor, for the institutions it already oversees; the CNIL for the others.
- Education: the CNIL, except vocational training, which goes to the DGCCRF, the consumer protection authority.
- Prohibited practices: the CNIL for most of them (social scoring, emotion recognition at work, facial recognition databases built from untargeted collection of online images), Arcom, the audiovisual and digital regulator, for manipulation and exploitation of vulnerabilities; the DGCCRF could also act on manipulation, exploitation of vulnerabilities and social scoring under consumer law.
- Chatbots, generated content and deepfakes (Article 50 transparency): Arcom, with the DGCCRF empowered on the consumer side.
- AI built into regulated products (toys, medical devices, lifts, pressure equipment): the authority that already supervises those products.
Overall coordination would go to the DGCCRF and the Directorate-General for Enterprise, according to the analysis by Banque des Territoires; PEReN, the State’s digital regulation expertise unit, and ANSSI, the national cybersecurity agency, would provide technical support to inspectors. The same article counts around fifteen competent authorities in total.
Watch out
This is the Senate’s plan. The National Assembly can amend it; if the two chambers disagree, a joint committee can be convened after a single reading, since the accelerated procedure applies. The final split will only be known when the law is enacted.
What the CNIL could sanction
The Senate text gives the CNIL’s sanctions committee powers specific to the AI Act, and refers to the European regulation’s ceilings for the amount of fines:
per day of delay at most: the penalty that could accompany an order to comply, according to the Senate text, an amount MPs can still change
of worldwide turnover, whichever is higher, for a prohibited practice, under Article 99 of the AI Act
for other breaches, including those of a deployer, under the same article
For a small or medium-sized enterprise, the lower of the two amounts is the ceiling; since July 2026, the same applies to a “small mid-cap” (fewer than 750 people), except for prohibited practices. What the July revision changed is explained in what the Digital Omnibus changed in the AI Act.
Until the law passes, what already applies?
The lack of a national authority does not put the AI Act on hold. Three forms of supervision exist today:
- The GDPR: the CNIL already supervises any personal data processed by an AI tool, and Article 22 governs fully automated decisions, as explained in our article on automated decisions.
- The AI Office: since 2 August 2026, the European Commission can supervise and fine providers of general-purpose AI models, without going through a national authority. Its powers are detailed in our article on the AI Office and general-purpose models.
- The obligations themselves: prohibitions since February 2025, transparency since August 2026. Once the authorities are in place, they will enforce obligations that were already running.
The next deadlines, from 2 December 2026 to 2 August 2028, are gathered in our AI regulation calendar.
What it changes for a team of 20 to 500 people
Knowing who will supervise what mainly tells you who to prepare your file for. If your AI touches recruitment or employee evaluation, your likely counterpart will be the CNIL, which already supervises your GDPR records: one inventory can serve both texts. If you publish generated content or run a chatbot, it will rather be Arcom or the DGCCRF. In finance and insurance, the ACPR, which is already there.
The useful step does not depend on the vote: list your AI uses, know which ones affect people, keep a record of who decided what. The method, access rights included, is in our AI governance guide, and the overall approach in our guide to integrating AI in a business.
From the field
This is how we run our own use. The SEO engine that prepares the articles on this blog has been running since 25 August 2026 (start date taken from our own repository, internal record as of 20 October 2026): it produces drafts, nothing is published without a human review, and the repository history keeps who generated, who reviewed and when. If an inspector asked tomorrow how AI is involved in what we publish, that record would be our answer.
Date to remember: none for now. The next step is the review of the text by the National Assembly’s economic affairs committee, with no date announced as of 20 October 2026. To find out which of your uses come close to high risk, our AI at the right cost offer starts from the tools you actually use.
Frequently asked questions
Which authority enforces the AI Act in France?
None has yet been designated by law as of 20 October 2026. The bill adopted by the Senate on 18 February 2026 gives the central role to the CNIL, assigns part of the supervision to Arcom, the DGCCRF and the ACPR, and coordination to the DGCCRF. It is waiting to be examined by the National Assembly.
Does the CNIL already supervise the use of AI in businesses?
Yes, under the GDPR: as soon as an AI tool processes personal data, the CNIL has jurisdiction, including over fully automated decisions under Article 22. Its powers specific to the AI Act, however, depend on the adaptation law being passed.
Are AI Act obligations suspended until the law is passed?
No. The regulation applies directly: prohibitions since February 2025, transparency since August 2026. The AI Office has supervised general-purpose models since 2 August 2026, independently of national authorities. The French delay concerns who enforces, not what is owed. Meanwhile, the CNIL keeps enforcing the GDPR, including on AI tools.
Who will supervise recruitment software that uses AI?
Under the Senate text, the CNIL, which would supervise high-risk employment uses such as filtering applications or evaluating candidates. High-risk rules only apply from 2 December 2027, but the GDPR already governs automated screening of job applications, and the CNIL already enforces it.
Sources
- Article 70 (new tab)ai-act-service-desk.ec.europa.eu
- The National Assembly’s legislative file (new tab)assemblee-nationale.fr
- Next described when it was presented (new tab)next.ink
- Next on 13 February 2026 (new tab)next.ink
- AI Act Service Desk (new tab)ai-act-service-desk.ec.europa.eu
- The text adopted by the Senate (new tab)senat.fr
- The analysis by Banque des Territoires (new tab)banquedesterritoires.fr
- Article 99 of the AI Act (new tab)ai-act-service-desk.ec.europa.eu
Jim · founder of Brain Plus AI
Also in business ai
Practical guide10 min
AI Act and GDPR: what an SME using AI must do
An SME that uses ChatGPT or a CRM with built-in AI already has obligations. This guide takes stock in October 2026: your role under the AI Act, the timetable revised in July 2026, what the GDPR requires and the steps to get compliant.
Understand9 min
AI Act and digital rules calendar: deadlines 2026 to 2028
AI Act, Data Act, Cyber Resilience Act, NIS2, e-invoicing in France and the first US state laws: every date that matters for a business, from autumn 2026 to August 2028, on one page kept up to date. For each deadline, who is covered and what to prepare.
Understand7 min
AI Office: Europe can now fine general-purpose AI models
Since 2 August 2026, the European Commission can demand documents from providers of general-purpose AI models, evaluate their models and fine them. What these powers change, and what a business that buys AI can ask its provider for.