Market abuse alerts, recorded communications, insider lists and product governance files are the work AI agents can take on for French capital markets compliance. The compliance officer keeps every decision to report suspicious orders or act against staff. France's markets authority and the ACPR supervise, under EU market abuse rules, GDPR, DORA and the EU AI Act.
What takes up a French capital markets compliance team's time?
Market abuse surveillance is the largest single task. Under EU rules, firms that arrange or execute transactions must detect and report suspicious orders and transactions. Surveillance systems generate alerts on unusual timing, size or price impact, and analysts reconstruct what happened, often across order data, news and recorded calls.
Communications review sits next to it. Firms record telephone conversations and electronic communications relating to client orders, and compliance samples and searches them for signs of insider dealing, collusion or mis-selling. Much of this content is in French, often mixed with English trading slang.
Insider lists, conflicts of interest, product governance for instruments sold to retail clients, personal transactions by staff, and the annual compliance report to management fill the rest of the calendar.
Where do agents fit in the work?
- Market abuse alert triage (depth 2). The agent reconstructs the order timeline, links it to public announcements and the client's history, and drafts a disposition. An analyst decides whether to escalate.
- Communications review (depth 1). The agent searches recorded calls and chats linked to escalated alerts, transcribes and translates where needed, and surfaces passages relevant to the alert with timestamps.
- Insider list upkeep (depth 2). The agent drafts updates to insider lists from deal-team access logs and project records, for the control room to approve.
- Product governance testing (depth 1). The agent compares sales data against each product's target market and flags sales outside it.
A second agent can check the first. Our analysis of whether one AI agent can check another agent's work for compliance concludes that it can catch some errors but does not replace a person, because both agents may share the same blind spots. In capital markets surveillance, use a second agent to test the first's grounding, not to decide.
Which decisions stay with a person?
The decision to send a suspicious transaction and order report to the markets authority stays with compliance, and so does the decision not to. Those calls depend on judgement about intent and context, and the firm must be able to explain them years later.
Staff matters stay human. A finding that a trader shared inside information leads to disciplinary action and possibly a report about the individual. Fairness to the employee and French employment law both require a person to weigh the evidence.
Communications review has a privacy dimension too. The agent reads employees' messages, so its scope must be limited to what compliance needs, and staff must be informed. This reinforces the position in AI compliance agents: second line, never the last word.
Which rules apply in France?
France's financial markets authority supervises market conduct and investment services, and the ACPR supervises the prudential side and banks' internal control. ESMA coordinates EU supervisory practice. EU market abuse rules require detection and reporting of suspicious orders and transactions, insider lists and controls on managers' dealings. EU investment services rules require recording of communications, suitability and appropriateness checks, and product governance.
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Market abuse surveillance is not among its listed high-risk uses, but tools that monitor or evaluate workers can be, so look carefully at how communications review data is used about individual staff. Deployer duties under Article 26 and AI literacy under Article 4 apply.
GDPR applies to staff and client data, with the CNIL as authority, which expects monitoring of employees to be proportionate and transparent. French labour law requires the staff representative body to be informed and consulted before tools that can monitor employees are introduced. DORA, applying from 17 January 2025, covers ICT risk and the agent's supplier as an ICT third-party provider.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should the first 90 days include?
In month one, consult the staff representative body and the data protection officer on communications review scope. Agree retention, access and what the agent may not search.
In month two, run market abuse alert triage at depth 1 on closed alerts, comparing the agent's reconstruction with the analysts'. Decide how you will measure it: our guide on how to measure a compliance agent's performance recommends tracking missed escalations separately from false alarms.
In month three, move triage to depth 2 if the results hold, with every disposition held for an analyst, and add insider list drafting.
Questions people ask
Can an AI agent send a suspicious order report?
No. It can draft the report and assemble the order data and communications, but sending it is a compliance decision that stays with a named person.
Does communications surveillance by an agent need staff consent?
Consent is rarely the right basis in employment. The firm normally relies on its legal obligations and legitimate interests, informs staff and consults their representatives. Confirm the basis with your data protection officer.
How does France compare with Australia for capital markets compliance?
Australia adds a strict breach reporting clock, while France works under EU market abuse rules. See our brief on compliance agents in Australian capital markets.