On May 16, 2023, the French Data Protection Authority (the “CNIL”) announced its action plan on artificial intelligence (the “AI Action Plan”). The AI Action Plan builds on prior work of the CNIL in the field of AI and consists of a series of activities the CNIL will undertake to support the deployment of AI systems that respect the privacy of individuals.

The AI Action Plan is centered around four key objectives:

• Understanding the functioning of AI systems and their impacts on people: Through its new artificial intelligence service, the CNIL will focus on addressing key data protection issues relevant to the design and operation of AI applications. These issues include the protection of publicly available data on the web against scraping, the protection of data transmitted by users of AI systems, and consequences for the rights of individuals to their data with respect to data collected for training AI applications and the outputs produced by AI systems, among other issues.

• Guiding the development of AI that respects personal data: To support organizations innovating in the field of AI and to prepare for the potential passage of the EU AI Act, the CNIL will publish guidance and best practices on several AI topics, including a guide on rules applicable to the sharing and re-use of data as well as recommendations for the design of generative AI systems.

• Supporting innovative players in the AI ecosystem in France and Europe: The CNIL will support actors in the AI ecosystem to innovate in a way that ensures protection of French and European fundamental rights and freedoms. In particular, the CNIL will soon open a new call for projects for participation in its 2023 regulatory sandbox and plans to engage in increased dialogue with research teams, R&D centers and organizations developing AI systems.

• Auditing and controlling AI systems: The CNIL plans to develop a tool to audit AI systems and will continue to investigate complaints lodged with its office related to AI, including generative AI.