Recommandations de la CNIL sur l'IA et le RGPD
Recommended action
Review your AI systems to ensure GDPR compliance by conducting a compliance audit, documenting your purposes and lawful bases, and setting up procedures to handle individuals' rights. Refer to the CNIL’s practical sheets for detailed guidance.
The CNIL has issued guidance to help businesses ensure GDPR compliance for their AI systems. It covers defining purposes, selecting a lawful basis, minimizing data collection, informing individuals, and managing training data—including web-scraped data. The CNIL emphasizes that GDPR applies to both training and using AI models.
What it changes
Your AI projects must incorporate a thorough GDPR compliance analysis from the design stage. You need to clearly justify the purpose of your processing, choose an appropriate lawful basis, and limit data collection to what is strictly necessary. Training data, even from public sources, must be handled with the same rigor as other personal data.