The EU AI Act and Technology Regulation for Businesses in France

Businesses using or developing AI in France must comply with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). The AI Act classifies AI systems according to four risk levels (unacceptable, high, limited and minimal), subjects general-purpose AI models to a dedicated regime, and applies alongside the GDPR and French digital regulations.

Businesses that deploy AI, and not only those that develop it, are subject to obligations. This guide explains the risk-based framework, its implementation timeline (revised in summer 2026 by the “Digital Omnibus” Regulation) and its practical implications for businesses operating in France. It is up to date as of 2 November 2026.

AI Act risk levels at a glance

Outside the pyramid: general-purpose AI. General-purpose AI (GPAI) models, such as GPT, Claude, Gemini or Mistral, do not constitute a fifth risk level. They are governed by a cross-cutting regime (Chapter V of the AI Act) that applies to the model itself, regardless of how it is used. The same model may therefore power systems at any risk level.

Who does the AI Act apply to?

The AI Act applies to providers that develop AI systems and to deployers that use them in a professional context. It also covers providers and deployers established outside the European Union where the output produced by the system is used in the Union.

A French company using a third-party AI tool is therefore a deployer subject to the AI Act, not just the developer of the tool. Roles and responsibilities must be mapped across the entire supply chain.

How does the risk-based approach work?

The AI Act classifies AI systems according to the risk they pose.

• Unacceptable risk: prohibited practices, such as social scoring, certain forms of manipulation or exploitation of vulnerabilities, or emotion recognition in the workplace. From 2 December 2026, the Omnibus adds systems generating non-consensual intimate content or child sexual abuse material.
• High risk: AI used in areas such as recruitment, credit, life and health insurance, biometrics, education or critical infrastructure, subject to strict controls.
• Limited risk: transparency obligations, for example informing users that they are interacting with an AI system or labelling artificially generated content.
• Minimal risk: the majority of everyday AI uses, with little or no additional regulation.

General-purpose AI models follow their own regime, independent of this classification.

What obligations apply to high-risk systems and general-purpose AI?

Providers of high-risk systems. They must implement risk management, data governance, technical documentation, human oversight, and safeguards for accuracy and robustness, as well as registration and conformity assessment procedures.

Providers of general-purpose AI models. They are subject to transparency and documentation obligations, including publishing a sufficiently detailed summary of the training data. Models presenting systemic risk (presumed above a training compute threshold of 10²⁵ FLOPs) are subject to enhanced obligations regarding evaluation, cybersecurity and risk management.

Deployers of high-risk systems. They must use systems in accordance with the instructions for use, assign human oversight to trained individuals, retain the logs generated and, in the case of employers, inform workers’ representatives and employees before putting the system into service (Article 26).

The fundamental rights impact assessment (FRIA)

Article 27 requires certain deployers of high-risk systems to carry out a fundamental rights impact assessment (FRIA) before first use. It is the most significant deployer-specific obligation in the AI Act.

Who is concerned?

• bodies governed by public law;
• private entities providing public services;
• deployers of systems used to assess the creditworthiness or establish the credit score of natural persons (Annex III, point 5(b));
• deployers of systems used for risk assessment and pricing in life and health insurance (Annex III, point 5(c)).

Banks, credit institutions and insurers are therefore directly concerned, even when they use a tool developed by a third party.

What does it contain? A description of the processes in which the system is used, the period and frequency of use, the categories of persons affected, the specific risks of harm, the human oversight measures, and the measures to be taken if those risks materialise, including internal governance and complaint mechanisms. The deployer notifies the results to the market surveillance authority.

FRIA and DPIA. The FRIA is distinct from the data protection impact assessment (DPIA, Article 35 GDPR): the DPIA addresses risks relating to personal data, whereas the FRIA covers all fundamental rights, including non-discrimination and access to essential services. Where a DPIA already covers certain elements, the FRIA complements it (Article 27(4)).

When? The FRIA follows the Annex III timeline and applies from 2 December 2027. The Commission is to provide a template questionnaire to facilitate the exercise (Article 27(5)); its publication date is not yet known.

Implementation timeline

The AI Act entered into force on 1 August 2024, but its obligations apply according to a staggered timeline. This timeline was revised by the “Digital Omnibus” Regulation (EU) 2026/1744, which entered into force on 27 July 2026 and, among other things, postponed the entire high-risk regime.

Key takeaway: businesses have gained time on the high-risk regime, but the prohibitions, AI literacy, GPAI obligations and transparency requirements are already enforceable. Since the Omnibus, the AI literacy obligation consists of taking measures to support its development, without guaranteeing a set level for each individual. Each obligation must be matched to its deadline.

Which supervisory authorities in France?

The allocation of responsibilities between French authorities has not yet been set by law. The framework announced by the French Government on 9 September 2025 is to be enshrined in the bill on various provisions adapting French law to European Union law (projet de loi DDADUE). Adopted by the Senate on 18 February 2026, the bill is still under examination by the National Assembly at the date of this article.

Deep fakes therefore involve three authorities: the DGCCRF and Arcom for the disclosure obligation, and the CNIL where personal data is involved.

As the AI Act is directly applicable, its obligations are binding on businesses regardless of whether the DDADUE bill is adopted. However, the national penalties regime remains dependent on that bill.

How does the AI Act interact with the GDPR and French regulations?

• The GDPR continues to apply: any personal data processed by AI must have a legal basis and respect data subjects’ rights.
• CNIL oversight: the French regulator closely scrutinises AI systems processing personal data, and a DPIA remains required where processing presents a high risk.
• Intellectual property and confidentiality: training data and generated outputs raise questions of ownership.
• Sector-specific rules: finance, healthcare and other sectors add their own requirements.

Provider vs deployer under the AI Act