Tell job candidates before using AI to assess them
Before using any recruitment method or technique on candidates, including AI tools, tell them which ones you will use. Methods must be relevant to the job, results stay confidential, and no data may be collected through a tool they were not told about.
Who must do it
All employers and recruiters in France, of any size.
Tell the works council before AI hiring or tracking tools
Inform your works council before you use recruitment-assistance methods or automated staff-management systems, and before changing them. Inform and consult it before deciding to deploy any tool that can monitor employees’ activity.
Who must do it
Employers in France with at least 50 employees and a works council.
The law
Labour Code, article L2312-38
Who enforces it
Obstructing the works council is a crime, with a fine of up to €7,500 (article L2317-1).
Do not let AI alone make big decisions about people
People have the right not to be subject to decisions made solely by automated processing, including profiling, with legal or similarly significant effects, such as automatically rejecting a job application. Such decisions are allowed only when needed for a contract, authorised by law or with explicit consent, and then people get human intervention, a way to contest and meaningful information about the logic.
Who must do it
Any organisation processing personal data in the EU, or of people in the EU, including employers and schools.
The law
GDPR (Regulation (EU) 2016/679), Article 22, with Articles 13 to 15
Who enforces it
National data protection authorities; fines up to €20 million or 4% of worldwide turnover, whichever is higher.
It applies in France because France is part of the European Union.
FranceIn force
Explain your automated decision rules when asked
A decision with legal or similarly significant effects on someone may rest solely on automated processing only in the GDPR’s contract and explicit-consent cases. Then, if the person asks, you must tell them the rules that define the processing and its main characteristics, except secrets protected by law.
Who must do it
Any organisation in France that takes solely automated decisions about people. Public bodies have stricter duties.
The law
Data Protection Act (Loi Informatique et Libertés, law no. 78-17), article 47
Who enforces it
The data protection authority (CNIL); fines up to €20 million or 4% of worldwide turnover, whichever is higher.
Take steps to support the AI literacy of staff and others who operate or use AI for you, suited to their knowledge and to how the AI is used. Since July 27, 2026 you no longer have to guarantee a particular skill level.
Who must do it
Providers and deployers of AI systems in the EU, which includes any business using AI at work.
The law
AI Act, Article 4, as replaced by Regulation (EU) 2026/1744
Who enforces it
National authorities; the AI Act sets no EU-wide fine for this duty, so penalties come from national law.
It applies in France because France is part of the European Union.
European UnionIn force
Do not use biometrics to guess race, religion or union ties
AI that sorts individual people by biometric data, such as face or voice, to infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is banned.
Who must do it
Anyone who provides or uses such AI in the EU, including employers.
The law
AI Act, Article 5(1)(g)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in France because France is part of the European Union.
European UnionIn force
Explain decisions made with high-risk AI when asked
Some AI counts as high-risk, such as AI for hiring, managing staff, education, credit or essential services. If a decision based on it seriously affects someone, they can ask you to explain the AI’s role and the main reasons for the decision, and you must answer clearly. The AI Act’s other duties for this AI start on December 2, 2027.
Who must do it
Businesses and organisations in the EU that use such AI to decide about people. It applies where other EU law, such as the GDPR, does not already give this right.
The law
AI Act, Article 86, with Annex III
Who enforces it
National authorities; the AI Act sets no EU-wide fine for this right, so penalties come from national law (in Germany, up to €50,000).
It applies in France because France is part of the European Union.
European UnionFrom December 2, 2026
Platforms: keep humans in charge of algorithmic management
Gig-work platforms must explain their automated monitoring and decision systems to the people working through them, keep them under human oversight, and not use them to process data such as emotional state, private conversations or union activity. Only a human may decide to restrict, suspend or close a worker’s account. EU countries must put this into national law by December 2, 2026.
Who must do it
Digital labour platforms, such as ride-hailing or delivery apps, organising work in the EU. The data and human-review rules also protect self-employed platform workers.
The law
Platform Work Directive (EU) 2024/2831, Articles 7 to 15 (deadline for national laws)
Who enforces it
Under each country’s national law; data protection authorities can fine breaches of the data rules at GDPR levels.
It applies in France because France is part of the European Union.
European UnionFrom December 2, 2027
AI for hiring and managing staff becomes “high-risk”
Employers using AI to recruit, manage or evaluate workers must follow its instructions, have trained people oversee it and keep its logs for at least six months. They must inform workers and their representatives before using it, and tell candidates and staff when it is used in decisions about them. AI types already on the market before then are covered only after a significant design change.
Who must do it
Employers and other organisations that use such AI in the EU.
The law
AI Act, Article 26 and Annex III (date moved by the 2026 Digital Omnibus)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in France because France is part of the European Union.
European UnionFrom December 2, 2027
Check HR AI against the high-risk rules before you sell it
If you sell AI for recruiting, promotion, firing, task allocation or monitoring workers, it must meet the high-risk requirements: risk management, data quality, documentation, logging, human oversight and accuracy. It must also pass a conformity assessment, carry the CE mark and be registered in the EU database.
Who must do it
Providers placing such AI on the EU market, including companies that sell it under their own name or substantially change it.
The law
AI Act, Articles 6(2), 8 to 17, 43 and 47 to 49, and Annex III point 4 (date moved by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in France because France is part of the European Union.
FranceIn force
Tell staff before any AI tool collects data about them
No information about an individual employee may be collected by a device or tool they were not told about beforehand, including AI monitoring and analytics tools.
Consult the works council before rolling out AI at work
Inform and consult your works council (CSE) before introducing new technologies such as AI tools, and on changes that affect staff numbers, organisation or working conditions.
Who must do it
Employers in France with at least 50 employees and a works council (comité social et économique).
The law
Labour Code (Code du travail), article L2312-8
Who enforces it
Obstructing the works council is a crime, with a fine of up to €7,500 (article L2317-1).
AI systems that infer people’s emotions are banned in workplaces and in schools and universities, except for medical or safety reasons.
Who must do it
Anyone who provides or uses such AI in the EU, including employers and schools.
The law
AI Act, Article 5(1)(f)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in France because France is part of the European Union.
European UnionIn force
Do not use AI social scores to treat people unfairly
AI that scores people over time on their social behaviour or personal traits is banned when the score leads to unjustified or disproportionate harm, or to harm in a context unrelated to where the data came from. Ordinary performance reviews are usually not social scoring.
Who must do it
Anyone who provides or uses such AI in the EU, including private companies.
The law
AI Act, Article 5(1)(c)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in France because France is part of the European Union.
European UnionIn force
Do not use AI to predict crime from profiling alone
AI that assesses or predicts the risk that a person will commit a crime based solely on profiling, or on their personality traits, is banned. AI that supports a human assessment already based on objective, verifiable facts is allowed.
Who must do it
Anyone who provides or uses such AI in the EU, including private companies.
The law
AI Act, Article 5(1)(d)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in France because France is part of the European Union.
European UnionIn force
Tell people when you use emotion or biometric AI on them
If you use AI that recognises emotions or sorts people into categories from biometric data, inform the people exposed to it and handle their data under the GDPR. Emotion recognition at work or school is banned anyway, except for medical or safety reasons.
Who must do it
Businesses and organisations that use such systems in the EU.
The law
AI Act, Article 50(3)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in France because France is part of the European Union.
European UnionFrom December 2, 2027
Treat face recognition and emotion AI as high-risk
This covers AI that identifies people remotely from their face or other biometrics, sorts them by sensitive or protected traits, or recognises emotions, where such uses are not banned. If you use it, follow the maker’s instructions, have trained staff oversee it, keep its logs and tell the people exposed to it. Simple ID checks that only confirm a person is who they claim to be are excluded.
Who must do it
Businesses and organisations using such AI in the EU, such as shops, venues and security firms; the makers must pass a conformity assessment before selling it. AI on the market before then is covered only after a significant design change.
The law
AI Act, Annex III point 1 and Article 26 (date set by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in France because France is part of the European Union.
European UnionFrom December 2, 2027
Treat AI credit scoring and insurance pricing as high-risk
If you use AI to judge people’s creditworthiness or set their credit score, or to assess risk and set prices for life or health insurance, first assess its impact on people’s rights. Then follow the maker’s instructions, have trained staff oversee it, keep its logs for at least six months and tell people it is used in decisions about them. AI used only to detect fraud is excluded.
Who must do it
Banks, lenders, insurers and other businesses using such AI in the EU; the makers must pass a conformity assessment before selling it. AI on the market before then is covered only after a significant design change.
The law
AI Act, Annex III point 5(b) and (c) and Articles 26 and 27 (date set by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in France because France is part of the European Union.
European UnionIn force
Do not build AI that manipulates or exploits people
AI that uses subliminal, manipulative or deceptive techniques, or exploits people’s age, disability or social or economic situation, to distort their decisions in a way that causes or is likely to cause significant harm is banned.
Who must do it
Anyone who provides or uses such AI in the EU.
The law
AI Act, Article 5(1)(a) and (b)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in France because France is part of the European Union.
European UnionIn force
Tell people when they are talking to an AI
If you provide an AI system that talks directly with people, design it so they are told they are interacting with AI, unless that is obvious.
Who must do it
Providers of AI systems used in the EU.
The law
AI Act, Article 50(1)
Who enforces it
National authorities, or the EU AI Office for chatbots built on the provider’s own general-purpose AI model or in very large online platforms; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in France because France is part of the European Union.
FranceIn force
Label AI faces or bodies in paid posts “Images virtuelles”
If you are paid to promote something online and your post includes an AI-made image of a face or body, add the words “Images virtuelles”, clear and easy to read on every format. Retouched faces or bodies need “Images retouchées” instead.
Who must do it
Commercial influencers: people or companies paid to promote goods, services or causes online to a French audience, including those based abroad.
The law
Law no. 2023-451 of June 9, 2023 on commercial influence, article 5, as amended in 2024
Who enforces it
Criminal courts; up to one year in prison and a €4,500 fine.
If your online platform recommends content, explain in your terms, in plain language, the main factors your recommender systems use and how users can change them. Very large platforms and search engines must also offer at least one feed option not based on profiling.
Who must do it
Online platforms serving people in the EU, except micro and small companies; the extra option applies to services with more than 45 million monthly users in the EU.
The law
Digital Services Act (Regulation (EU) 2022/2065), Articles 27 and 38
Who enforces it
National Digital Services Coordinators, or the European Commission for very large platforms; fines up to 6% of worldwide turnover.
It applies in France because France is part of the European Union.
FranceIn force
Get consent or clearly label AI fakes of real people
Do not publish or share AI-made images, video or audio that reproduce a real person’s image or words without their consent, unless it is obvious, or clearly stated, that the content was made by AI.
Who must do it
Anyone in France, including businesses, publishers and influencers.
The law
Criminal Code (Code pénal), article 226-8, as amended by Law no. 2024-449 of May 21, 2024 (SREN)
Who enforces it
Criminal courts; up to one year in prison and €15,000, or two years and €45,000 if shared online.
Never share sexual deepfakes of a person without consent
Sharing AI-made sexual images, video or audio that reproduce a real person’s image or voice without their consent is a crime, even if it is labelled as fake.
Who must do it
Anyone in France.
The law
Criminal Code, article 226-8-1, added by Law no. 2024-449 of May 21, 2024 (SREN)
Who enforces it
Criminal courts; up to two years in prison and €60,000, or three years and €75,000 if shared online.
Mark AI-generated content so machines can detect it
Providers of AI that generates audio, images, video or text must mark the output in a machine-readable way as AI-made. Systems already on the market before August 2, 2026 have until December 2, 2026. Tools that only assist standard editing are exempt.
Who must do it
Providers of generative AI systems in the EU, including general-purpose AI.
The law
AI Act, Article 50(2)
Who enforces it
National authorities, or the EU AI Office for generative AI built on the provider’s own general-purpose AI model or in very large online platforms; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in France because France is part of the European Union.
European UnionIn force
Label deepfakes and AI-written news-style text
If you use AI to create or alter a deepfake image, audio or video, disclose that it is AI-made or manipulated; for obvious art, satire or fiction a light disclosure is enough. If you use AI to write or alter text published to inform the public on matters of public interest, disclose it, unless it went through human review or editorial control and someone holds editorial responsibility.
Who must do it
Businesses and organisations that use AI to make such content in the EU; purely personal, non-professional use is exempt.
The law
AI Act, Article 50(4)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in France because France is part of the European Union.
European UnionFrom December 2, 2026
Do not offer or use AI that makes sexual deepfakes
AI systems that create or alter realistic sexual or intimate images, video or audio of an identifiable person without their explicit consent, or child sexual abuse material, are banned. Providers are covered when this is the intended purpose or a foreseeable result their safeguards do not reliably prevent; users are covered when they use AI for this.
Who must do it
Anyone who provides or uses such AI systems in the EU.
The law
AI Act, Article 5(1)(ba) and (bb) and 5(1a) to (1b), inserted by Regulation (EU) 2026/1744 (Digital Omnibus on AI)
Who enforces it
National authorities, or the EU AI Office for AI built on the provider’s own general-purpose AI model or in very large online platforms; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in France because France is part of the European Union.
European UnionFrom December 2, 2027
Treat AI for admissions, grading and exams as high-risk
This covers AI that admits or places students, grades their work, decides what level of education they can reach, or watches for cheating in tests. If you use it, follow the maker’s instructions, have trained staff oversee it, keep its logs for at least six months and tell students it is used. Public bodies, and private bodies providing a public service, must first assess its impact on people’s rights.
Who must do it
Schools, universities, training providers and exam bodies using such AI in the EU; the makers must pass a conformity assessment before selling it. AI on the market before then is covered only after a significant design change, except that AI for public authorities must comply by August 2, 2030.
The law
AI Act, Annex III point 3 and Articles 26, 27 and 111(2) (dates set by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in France because France is part of the European Union.
Good to know in France: France has not yet passed the law that names its AI Act enforcers: the Senate approved it on February 18, 2026, and it is still before the National Assembly. The EU rules apply anyway, because EU regulations apply directly. Bill to adapt French law to EU law (French Senate)