France's data protection authority, the CNIL, expects any team using AI agents on personal data to process it lawfully, minimally and transparently, with real human involvement in decisions that matter. It sets no AI training syllabus, but its expectations assume trained people: staff who know what data an agent may use, can spot misuse, and can explain decisions.
What does the CNIL expect, in plain words?
The CNIL enforces the GDPR in France, together with French data protection law. For teams using agents, the core expectations follow the GDPR's Article 5 principles: process personal data lawfully, fairly and transparently; for specified purposes; limited to what is necessary; accurate; kept no longer than needed; and secure. Every processing needs a lawful basis under Article 6. Where an agent's output feeds a decision based solely on automated processing with legal or similarly significant effect, Article 22 gives people rights, including to obtain human intervention. High-risk processing needs an impact assessment under Article 35, and Article 30 requires records of processing.
The CNIL has also published practical recommendations on AI and the GDPR. Their common thread is that the controller must understand its system: what data goes in, why, what comes out, and who checks it. That understanding lives in people, which is where training comes in. The data protection officer's role includes raising awareness and training staff involved in processing, and an agent is now part of that processing.
Who does this reach?
Every organisation processing personal data in France, public or private, of any size. That is much wider than financial services: a hospital administration using an agent to draft appointment letters, a retailer answering customers, a law firm reviewing documents and a city council handling permit queries all fall under the CNIL. Financial firms also face the ACPR, the French banking and insurance supervisor, for prudential and conduct questions.
Inside the organisation, training should reach four groups:
- Users and reviewers who instruct agents, read their output and approve held actions.
- Process owners who choose which sources an agent may read and for what purpose.
- The DPO and privacy team, who assess processing and handle requests from individuals.
- Managers and executives, who decide where agents are used.
Two French working practices should shape the plan. Introducing technology that changes working conditions or allows monitoring of staff usually involves consulting staff representatives, so bring them in with the training plan. And work instructions given to employees in France are generally expected in French, so training and guidance need French versions.
What does it mean when the agent acts?
An agent that only reads (depth 1) is already processing personal data, so purpose and minimisation apply from its first task. At depth 2 it drafts, and the person who sends the draft is the last check on what personal data leaves the organisation. At depth 3 it executes routine work within bounds, so the bounds must carry the privacy rules, and someone must have set them knowingly.
Teams therefore need practical skills, not just principles:
- Purpose checking. Noticing when a draft reuses data collected for one purpose to serve another, such as citing a health detail in a billing reply.
- Minimisation in prompts. Not pasting whole files into an agent's request when a reference would do.
- Reading provenance. Knowing that a fact marked external, such as a forwarded email, is the weakest class and should not drive a decision about a person on its own.
- Handling refusals. When an agent refuses a request because it falls outside its bounds, routing it rather than rewording it until the agent complies.
- Explaining a decision. Being able to tell a person what the agent did, what the reviewer checked and why the outcome follows.
The legal sector shows how specific this gets; see what AI literacy means for law firms using AI agents.
How do you meet the CNIL's expectations?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Lawful basis and purpose limitation | Each agent's sources tied to a documented purpose; reviewers trained to check purpose | Records of processing naming the agent; decline reasons citing purpose |
| Data minimisation | Training on what not to give an agent; sources scoped by role | Source configuration history; training records dated before access |
| Human intervention for significant decisions | Held actions reviewed by trained staff with authority to decide otherwise | Approvals and declines in the agent's record, with reasons |
| Impact assessment | DPIA describes the agent, its depth and the human review step | DPIA versions updated when depth or sources change |
| Security | Staff trained to report misdirected agent output as a possible breach | Incident log and notification decisions |
| Rights of individuals | Privacy team trained to retrieve what an agent read and produced about a person | Request files showing the agent's record was searched |
For the broader French training picture, see what AI agent training organisations in France need; for a regulated example, AI agents for compliance teams in payments in France. The general model of literacy by role is in AI literacy and certification for people who work with agents.
What will the CNIL ask?
CNIL inspections, whether on site, online or after a complaint, ask practical questions. What personal data does the agent process, and on what basis? Where is it in your records of processing? Who reviews its output, and how were they trained? Show a decision about the complainant and explain it. Was a DPIA done, and does it match how the agent actually works today? If the answers depend on one person who understands the agent, that is a weakness the CNIL will notice.
What do the CNIL's expectations not cover?
They do not decide whether an agent's output is commercially sound or accurate except as it affects personal data. They do not regulate prudential or conduct risk; for financial firms that is the ACPR. They do not set a training format, hours or accreditation. And they do not cover processing outside the GDPR's scope, such as fully anonymised data, though teams often mistake pseudonymised data for anonymous. Sector rules can add duties, as health rules do; the American parallel is in HIPAA workforce training for teams using AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does the CNIL require AI-specific training?
Not as a stand-alone rule. The duty to process lawfully and securely, and the DPO's awareness and training role, make training on any new processing tool, including agents, part of compliance.
Is pseudonymised data outside the CNIL's reach?
No. Pseudonymised data is still personal data under the GDPR. Staff who believe otherwise may give an agent more than it should have, which is a common training gap.
Who should train first?
The people who approve agent output that reaches individuals, because they are the last check before data leaves the organisation. Managers and the DPO should follow closely, since they decide where agents are used and how.