Menu

Law

The legal framework for AI in business

The law that applies to your data depending on who runs the AI, what your profession requires of you, and the official sources. These pointers are not legal advice: check them with your professional body or your lawyer.

The law that applies to your data is the operator’s.

This is not about the quality of the tools: an AI is run by a company, and that company must comply with the laws of its country. In the United States, the CLOUD Act requires it to hand over the data that American courts request, wherever it is hosted, and FISA authorises the surveillance of foreigners’ data. In China, the National Intelligence Law requires every organisation to cooperate with the intelligence services, and the DeepSeek app stores conversations on servers in China.

A contract does not change the applicable law: an American service can be “GDPR compliant”, “hosted in Europe” and not train on your data, while still being subject to the CLOUD Act. These guarantees are real, but they do not cover such access. With an AI run in Europe, a single body of law applies to your data: French and European law.

Where the model comes from, on the other hand, matters little: an open Chinese model such as Qwen or DeepSeek, run in Europe by a sovereign platform, sends nothing to China.

A question put to the French Senate, 10 June 2025

Can Microsoft guarantee that French citizens’ data will never be passed to the American authorities without France’s consent?

Microsoft France’s answer, under oath (our translation)

“No, I cannot guarantee that, but, again, it has never happened so far.”

The highest level of trust: SecNumCloud

Since 2022, this qualification from ANSSI, the French cybersecurity agency, has required a provider whose head office and infrastructure are in Europe, which no non-European shareholder controls, and whose data no subcontractor outside the EU can access. It is not infallible, but it is the best protection available.

It covers hosting, not the AI itself: an AI running on a qualified cloud, such as those of OVHcloud, Outscale or Cloud Temple, counts as private. Mistral already offers its models on Outscale’s. In sensitive sectors (defence, operators of vital importance, classified data), even a qualified cloud is not enough: that data stays on your own servers.

Why it matters for your business

Even if no authority takes an interest in you, the choice of operator has concrete effects on your customers, your contracts and your business.

  • Your customers may require it

    France’s SREN Act now requires the State to protect its sensitive data from access by foreign authorities: if you work for it, these requirements apply to you. And contracts with large prime contractors often forbid entrusting their documents to a third party.

  • A service can be cut off overnight

    In August 2025, US sanctions targeted Nicolas Guillou, a French judge at the International Criminal Court: his Amazon, Airbnb and PayPal accounts were closed and his Visa and Mastercard cards disabled. If your business relies on American tools, it also depends on decisions made in Washington.

  • Some precautions apply to every AI

    Stolen accounts, conversations made public, data reused for training, professional secrecy: these precautions apply whatever the service’s nationality, French included. The test below still applies to you.

All companies

As soon as your teams use AI
  • As soon as personal data goes through an AI tool, the GDPR applies: inform the people concerned, sign a data processing agreement with the provider and put safeguards in place for any transfer outside the European Union (GDPR, Articles 13, 28 and 44 onwards).
  • Since 27 July 2026, the EU AI Act has required you to take measures to build your teams’ AI literacy, for example by training them on the tools they use (Article 4, as amended by Regulation 2026/1744).
  • Since 2 August 2026, a chatbot that talks to your customers must tell them they are dealing with an AI (EU AI Act, Article 50).

Healthcare

Doctors, allied health professionals, pharmacists, healthcare facilities
  • Before recording a consultation to have it transcribed by AI, tell the patient and respect any refusal: recording private conversations without consent is a criminal offence (French Criminal Code, Article 226-1: one year in prison and a €45,000 fine).
  • Patients must also be told how their health data is processed: purpose, tool used, retention period (GDPR, Articles 9 and 13).
  • Health data may only be stored by an HDS-certified host (French Public Health Code, Article L.1111-8): check this certification before choosing a transcription tool.
  • If you use an AI-based medical device for prevention, diagnosis or treatment, make sure the patient is informed (French Public Health Code, Article L.4001-3).
  • The French National Authority for Health (HAS) recommends discussing it with the patient, never sharing confidential information in a general-purpose tool and checking every piece of generated content (guide of October 2025).

Chartered accountants

Accounting firms, payroll providers
  • You are bound by professional secrecy (Ordinance of 19 September 1945, Article 21), and a breach is punishable by one year in prison and a €15,000 fine (French Criminal Code, Article 226-13). Your clients’ documents have no place in a consumer AI.
  • Payslips, payroll declarations, tax returns: these documents are hard to anonymise. The Paris Île-de-France Order of Chartered Accountants recommends professional solutions, hosted in Europe, that contractually commit not to use your data.
  • Name the tool and its provider in the GDPR information you give your clients (GDPR, Article 13).

Lawyers

Law firms
  • Professional secrecy also covers what you entrust to an AI (Law of 31 December 1971, Article 66-5).
  • In March 2026, the French National Bar Council (CNB) adopted a guide on professional ethics and AI: professional secrecy, GDPR, competence and caution.
  • Check every reference: lawyers have already been sanctioned, notably in the United States, for citing rulings made up by an AI.

Employers

Companies with 50 or more employees
  • The works council (CSE) must be informed and consulted before AI tools are introduced (French Labour Code, Article L.2312-8). In July 2025, the Créteil court suspended AI tools deployed without this consultation.
  • AI used to recruit or assess employees will fall under the “high-risk” rules from 2 December 2027 (EU AI Act, Annex III).

Sources

Are your teams already using AI?

Let’s take stock in 30 minutes: what can stay on consumer tools, what should move to a European or private AI, and the rules to give your teams.

Get in touch