Current position
Overview
AI legislation has been enacted.
Key legislation & sources
EU AI Act (Regulation 2024/1689)
DGCCRF — proposed lead MSA and single point of contact
EU AI Act National Implementation Tracker
CNIL — fundamental rights authority for AI
Council of Europe Framework Convention on AI (CETS 225)
EU AI ACT
The EU AI Act (Regulation 2024/1689) applies directly across all member states. Prohibitions on unacceptable-risk AI systems have been in force since 2 February 2025; GPAI model rules since 2 August 2025. High-risk AI obligations are due from 2 August 2026, subject to the Digital Omnibus proposal which may defer enforcement. For the full implementation timeline, governance structure, and current status, see the European Union overview.
CNIL is seeking designation as supervisory authority for AI systems processing personal data. The AI Commission (chaired by Anne Bouverot) advises the government on national implementation.
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
adoption
National Commission for Information Technology and Civil Liberties and Council for AI and Digital Technology released a note on the risks of agentic AI for personal data protection
Source: Digital Policy Alert · View update ↗
implementation
Order No. 2026-2 relating to the remote marketing of financial services to consumers including design requirement enters into force
Source: Digital Policy Alert · View update ↗
implementation
Decree No. 2026-60 relating to experimentation of games with monetisable digital objects including design requirement entered into force
Source: Digital Policy Alert · View update ↗
On 7 February 2026, Decree No. 2026-60 on the experimentation of games with monetisable digital objects entered into force. The decree was issued pursuant to Articles 40 and 41 of Law No. 2024-449 of 21 May 2024 on securing and regulating the digital space. The decree requires enterprises offering games with monetisable digital objects to prompt players, from the moment they open an account, to set a play-time limit, prohibiting any game activity until the limit is set. The limit, which cannot be pre-set by the enterprise, applies immediately to cumulative play over a seven-day period. Enterprises must continuously provide players with easily accessible information on time spent playing, display a warning and a visible counter when 75% of the allotted time has passed (or at least 30 minutes before expiry), and issue a further warning 10 minutes before the limit is reached. A self-exclusion function, effective immediately, must also be available at all times for periods ranging from 24 hours to 12 months.
adoption
Minister of the Economy, Finance, and Industrial, Energy, and Digital Sovereignty adopted Decree No. 2026-60 relating to experimentation of games with monetisable digital objects including design requirement
Source: Digital Policy Alert · View update ↗
On 4 February 2026, the Minister of the Economy, Finance, and Industrial, Energy, and Digital Sovereignty adopted the Decree No. 2026-60 on the experimentation of games with monetisable digital objects. The decree was issued pursuant to Articles 40 and 41 of Law No. 2024-449 of 21 May 2024 on securing and regulating the digital space, and it provides that it enters into force the day after publication. It requires the enterprise offering a game with monetisable digital objects, from the opening of the game account, to ask the player to set a play-time limit, and it prohibits any game action until the player has set that limit, which cannot be pre-set by the enterprise. It provides that the limit applies immediately to cumulative play time over a seven-day period. It requires the enterprise to inform the player at all times, in an easily accessible manner, of the time spent playing. It requires a warning and a continuously displayed counter when 75% of the player’s time has elapsed or at the latest 30 minutes before expiry, and it requires a further warning 10 minutes before expiry. It requires a continuously available self-exclusion function for 24 hours to 12 months, with immediate effect.
adoption
French Data Protection Authority adopted guidance on deepfakes including protection and reports of illegal content
Source: Digital Policy Alert · View update ↗
On 3 February 2026, the French Data Protection Authority (CNIL) published guidance on deepfakes explaining the associated privacy and security risks and setting out steps for individuals to protect themselves and report illicit content. The guidance defines deepfakes as audio, image, or video content created or modified using artificial intelligence, including techniques such as face swapping and lip-synching, and notes that such content can be used for conduct including identity misuse, online harassment, fraud, and disinformation. The guidance highlights that creating or sharing certain deepfakes can lead to criminal liability under French law, including that creating an image montage of a person without consent may be punishable by one year of imprisonment and a EUR 15'000 fine, and that fraud involving deception to obtain money, property or a service may be punishable by 5 years of imprisonment and a EUR 375'000 fine. The guidance also describes the CNIL’s role in informing the public, supervising compliance with data protection rules, supporting research and detection work, including through the GenFakes project, and contributing to European initiatives, including work on codes of practice for AI-generated content.
Showing 5 of 34 available API entries. Dates and summaries are supplied by Digital Policy Alert.