Compliance teams in French public bodies can use AI agents to keep the inventory of algorithms used in individual decisions, draft the explanations citizens are entitled to, map corruption risks for the anti-corruption programme and assemble requests for administrative documents. Decisions about citizens, disclosure and sanctions stay with officials, under the GDPR, the CNIL and the EU AI Act.
What do public sector compliance teams in France spend their time on?
French ministries, local authorities, hospitals and public establishments carry compliance duties that are, in several respects, stricter than those on private firms.
Algorithmic transparency. French law requires administrations to tell people when an individual decision about them was taken on the basis of algorithmic processing, and to explain on request how the processing worked in their case. Larger administrations must also publish the main rules of algorithms used in individual decisions. Keeping an accurate inventory and producing clear explanations is a sustained effort.
Anti-corruption. Public bodies are expected to run anti-corruption programmes: risk mapping, codes of conduct, third-party checks, internal alerts and controls, under the oversight of the national anti-corruption agency.
Access to administrative documents. Citizens may request administrative documents, with an independent commission ruling on refusals.
Data protection. Public bodies process large volumes of personal data under the GDPR, supervised by the CNIL, often on the basis of a legal obligation or public task rather than consent.
Public procurement. Purchases must follow public procurement rules on competition, equal treatment and transparency.
Where can agents help?
Depth sets how far an agent may act: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.
- Algorithm inventory (depth 2). The agent reads system documentation and decision procedures, identifies where individual decisions rely on algorithmic processing, and drafts inventory entries with the rules applied, data used and the responsible service. This is the use most particular to France.
- Explanation drafts (depth 2). When a citizen asks how an algorithm contributed to a decision about them, the agent drafts an explanation from the inventory and the case file, in plain language, for the responsible official to review and send.
- Corruption risk mapping (depth 2). The agent gathers procurement data, grant files, internal alerts and audit findings by process, and drafts the risk map update for the compliance officer.
- Document access requests (depth 2). The agent locates requested documents, marks information that may be protected, and drafts the response.
- Procurement file checks (depth 1). The agent checks that each procurement file contains the required notices, evaluation records and declarations of interest.
What stays with officials?
Individual decisions about citizens. Grants, permits, benefits, sanctions and allocations are decided by officials with legal authority. Some of these decisions cannot be undone once acted upon, and the article on irreversibility in public services explains how to recognise those points.
The explanation sent to a citizen. The agent drafts; the responsible official checks the explanation is accurate and complete, because it is the administration's account of its own decision.
The risk map and its conclusions. The compliance officer decides which risks are significant and what controls follow.
Disclosure decisions. Whether a document may be released, in full or in part, is a legal judgement.
Whether to automate at all. Choosing which decisions may use algorithmic processing is a policy and legal question. Equally, the agent does not replace the compliance officer; can an AI agent replace a compliance officer explains why.
Which rules apply in France?
GDPR and the CNIL. Article 5 principles, Article 6 lawful basis (public task and legal obligation are common for public bodies), Article 30 records of processing and Article 35 impact assessments apply. Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects, and French law sets specific conditions for such decisions by administrations.
EU AI Act (Regulation (EU) 2024/1689). In force since 1 August 2024, with obligations phasing in. Some public uses are high-risk, particularly those affecting access to public services and benefits. Article 27 requires certain deployers, including bodies governed by public law, to carry out a fundamental rights impact assessment before using a high-risk system. Article 26 deployer duties, Article 14 human oversight, Article 4 AI literacy and Article 50 transparency all bear on public bodies.
NIS2. Many public administration entities fall within its scope for cybersecurity risk management and incident reporting.
National public law on algorithmic transparency, access to administrative documents, anti-corruption and public procurement applies to the work the agent supports.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How to start in the first 90 days
Month one. Record the agent in the register of processing and decide whether an impact assessment is needed. Start with the algorithm inventory, because it underpins every other transparency duty.
Month two. Test the agent on services whose algorithms are already documented. Compare its entries with the existing documentation and investigate every difference.
Month three. Extend the inventory across the administration, with each service confirming its entries. Pilot explanation drafts on past requests. Australian agencies face a different legal frame with similar aims; see compliance agents in Australia's public sector.
Where Pryme fits
In Pryme, an explanation drafter can only use the inventory and the case file as sources, each stamped with its provenance, so its draft can be traced back to the record. Drafts arrive held for the responsible official. Attest replays the agent against past requests before it reaches depth 2. Every verdict is filed. The guide to AI compliance agents explains the wider approach.
Questions people ask
Must French administrations tell citizens when an algorithm was used?
French law requires administrations to inform people when an individual decision was taken on the basis of algorithmic processing, and to explain it on request. The agent can help keep track and draft explanations.
Is a compliance agent in a public body high-risk under the EU AI Act?
An agent that drafts for compliance staff is not usually high-risk. Systems that affect access to public services or benefits may be, and public bodies deploying them face a fundamental rights impact assessment.
Can the agent publish the list of algorithms?
It can draft the publication. A responsible official should approve it, because it is the administration's public statement.