AI agents for compliance teams in telecoms in France

French telecoms compliance is dominated by data: tracker consent on websites and apps, traffic and location data, and cold-calling restrictions. AI agents can audit consent banners against actual tracker behaviour, test call lists against opposition records and review device insurance sales. People decide findings and answers to the CNIL. GDPR, NIS2 and the EU AI Act apply.

What do telecoms compliance teams in France spend their time on?

Tracker and cookie consent consumes more effort in France than in many markets. The CNIL enforces the rules on reading and storing information on a user's device, and expects refusing to be as easy as accepting. A telco's website, customer app and partner tags must all behave as the banner says, and each release can break that.

Telephone marketing is the second load. French rules restrict unsolicited sales calls, give consumers a national list to opt out of cold calling, and limit when and how often calls may be made. Telcos both make such calls and carry them, so they face scrutiny on two sides.

The third strand is distribution. Many operators sell device insurance and financing at the point of sale. Insurance distribution is supervised by the ACPR, so the telco's shop staff are selling a regulated product and compliance must test whether it was suitable and properly explained. Contract information, termination rights and the telecoms mediator's cases fill the rest of the week.

Where can AI agents help?

• Tracker audits (depth 1). The agent loads each page and app screen in a test environment, records which trackers fire before and after consent, and compares the result with the consent banner and the register of tags. It reports trackers firing without consent, with the page and the time.
• Call list testing (depth 1). Before a telemarketing campaign, the agent checks the list against the opposition register extract, existing-customer status and internal objections, and confirms call windows fit the rules. After the campaign, it samples call logs.
• Insurance sale review (depth 1). The agent reads the sale record, the needs questionnaire and the pre-contract documents for device insurance, and flags sales where the questionnaire was skipped, the customer already had cover, or documents were given after signature.
• Risk assessment inputs (depth 2). The agent drafts parts of the compliance risk assessment from incident, audit and complaint data. Our answer on whether an AI agent can do a compliance risk assessment explains why a person must challenge the draft.

The checking agent must not be the agent that runs marketing or sales. If one agent builds a campaign list and another tests it, the test means something. Our second-line separation checklist for compliance agents sets out what separation requires, and the guide to AI compliance agents explains the principle.

What stays with people?

The data protection officer's judgements stay human: whether a processing activity is lawful, whether a breach must be notified to the CNIL within the required time, and how to answer a data subject. These are personal duties under GDPR and the agent informs them only.

Decisions on mis-sold insurance stay with named staff, including refunds and any report to the ACPR. Whether a sales practice is misleading is a legal judgement with consequences for the whole network of shops.

Any finding that leads to disciplining a shop or a call partner is human too. The agent shows the pattern; a person hears the explanation.

Which rules apply in France?

GDPR applies to all personal data, and the CNIL is the supervisory authority. Article 6 requires a lawful basis for each use, Article 30 a record of processing that should list the agent, and Article 35 a data protection impact assessment where processing is likely to be high-risk, which large-scale analysis of traffic or location data may be. EU rules on the confidentiality of communications add stricter limits on traffic and location data and on device trackers.

NIS2 makes electronic communications providers subject to cybersecurity risk management and incident reporting; an agent with access to customer or network systems is part of that perimeter. The ACPR supervises insurance distribution where the telco sells cover.

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and phases in. Most compliance-testing agents will be minimal risk, but Article 50 transparency duties apply to customer-facing chat, and Article 4 requires AI literacy among staff who use these systems. Providers and deployers have different obligations, so map which you are.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How to start in the first 90 days

First month: begin with tracker audits on the public website. Results are objective, the CNIL takes the subject seriously, and the agent touches no customer data. Name the DPO as the owner of findings.

Second month: compare the agent's results with your last manual audit and investigate every difference. Extend to the customer app and partner tags.

Third month: add insurance sale review on a sample of shop sales, with a person reviewing every flag. Plan call list testing for the next campaign. Australian operators focus on hardship and identity checks instead; see our brief on compliance agents in Australian telecoms.

Where Pryme fits

Pryme keeps the tracker audit agent and the marketing agents apart by role scope: the auditor reads, the marketing agent drafts, and neither can approve the other's work. Every audit finding is filed with the page, the tag and the time, so the DPO can show the CNIL exactly what was tested.