Lagging FR Verified 21 Oct 2026

France

EU AI Act implementation, 2026

France still has no enacted designation of AI Act authorities: the DDADUE omnibus bill carrying the scheme (DGCCRF coordinating, CNIL for most Annex III uses, Arcom and existing sector regulators) passed the Senate on 18 February 2026 but has sat in committee at the Assemblée nationale since, more than a year after the 2 August 2025 deadline.

Implementing law
Draft billFeb 2026
Penalty regime (Art. 99)
Not adopted
Regulatory sandbox
None
Readiness rank
19 of 27score 35 / 100

Key findings

  • No French authority has legally been designated under Articles 28 or 70 of the AI Act as of 21 October 2026; the designation sits in Article 24 of the DDADUE omnibus bill awaiting Assemblée nationale first reading.
  • The chosen model is decentralised: DGCCRF coordinates and is the proposed single point of contact, CNIL takes prohibited practices and most Annex III uses, Arcom handles transparency, and existing sector regulators keep their fields.
  • No national penalty rules under Article 99 are in force. Government amendment no. 444, adopted by the Senate on 17 February 2026, adds administrative sanction procedures; a further government amendment (no. 445) on fines without prior formal notice for breaches of Articles 21, 72 and 73 was debated, but its adoption could not be confirmed from the sitting record. Nothing is enacted.
  • No Article 57 regulatory sandbox exists in law; the bill only authorises future ordinances on AI regulation.
  • The Digital Omnibus (Regulation (EU) 2026/1744) gives France until December 2027 for most high-risk enforcement, but transparency, GPAI and governance obligations already apply without a national enforcer.

National authorities

Market surveillance

Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF)

Proposed coordinating market surveillance authority and single point of contact (Art. 70(2)); consumer products. Designation pending in Parliament.

presse.economie.gouv.fr (opens in new tab)
Market surveillance

Commission nationale de l'informatique et des libertés (CNIL)

Proposed lead authority for prohibited practices and most Annex III high-risk uses (biometrics, employment, essential services, law enforcement, migration, justice) under government amendments adopted by the Senate in February 2026. Not yet in force.

senat.fr (opens in new tab)
Market surveillance

Autorité de régulation de la communication audiovisuelle et numérique (Arcom)

Proposed authority for certain Article 50 transparency obligations (deepfakes, AI-generated content). Not yet in force.

senat.fr (opens in new tab)
Market surveillance

Existing sector regulators, with DGE as notifying authority for toys; ANSSI and PEReN as technical support

Decentralised model: regulators already supervising a sector would supervise AI systems in their fields (individual regulators are not named in the DGE/DGCCRF press release); ANSSI and PEReN provide technical expertise rather than acting as authorities. Not yet in force.

presse.economie.gouv.fr (opens in new tab)
Notifying authority

Not designated or not confirmed as of 21 Oct 2026.

Single point of contact (Art. 70(2))

DGCCRF (proposed; listed as 'pending' on the European Commission's national authorities page as of 7 September 2026)

Implementing law, penalties and sandbox

Implementing law Draft bill

Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne (DDADUE) – Article 24 on Regulation (EU) 2024/1689 (Sénat n° 118, 2025-2026; Assemblée nationale n° 2518)

Feb 2026

senat.fr (opens in new tab)
Penalty regime Not adopted

No national penalty rules under Article 99 are in force; regulators rely on existing powers.

Regulatory sandbox None

No national AI regulatory sandbox under Article 57 has been established in law; the DDADUE bill would authorise ordinances on AI regulation, subject to CNIL and Arcom opinions, but the text is not adopted.

senat.fr (opens in new tab)
National AI strategy

Stratégie nationale pour l'intelligence artificielle (France 2030) – third phase launched by the interministerial AI committee of 6 February 2025

2025

info.gouv.fr (opens in new tab)

Notable developments

  1. DGE and DGCCRF publish the draft designation scheme

    Press release no. 881 of 9 September 2025 set out a decentralised model prioritising existing sectoral authorities, with DGCCRF leading market surveillance, DGE representing France on the AI Board, and ANSSI/PEReN in support. The release states the scheme must be submitted to Parliament through a bill.

    presse.economie.gouv.fr (opens in new tab)

  2. Senate adopts the DDADUE bill with government amendments on AI authorities

    At the sitting of 17 February 2026 the Senate adopted government amendment no. 444 completing Article 24 (information-sharing between authorities, PEReN/ANSSI technical support, DGE as notifying authority for toys) and amendment no. 440 authorising ordinances on AI regulation. The bill was adopted at first reading on 18 February 2026 and transmitted to the Assemblée nationale as text no. 2518 on 20 February 2026.

    senat.fr (opens in new tab)

  3. Assemblée nationale committee stage stalls

    The Commission des affaires économiques has been lead committee since 20 February 2026, with four committees referred for opinion on 23 April 2026. As of 21 October 2026 the Assembly's dossier shows no committee or plenary examination date.

    assemblee-nationale.fr (opens in new tab)

  4. Digital Omnibus on AI postpones high-risk deadlines

    Regulation (EU) 2026/1744 entered into force on 27 July 2026, deferring Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028. This relieves some pressure on France's missing designation, but Article 50 transparency duties and the governance/penalty provisions have applied since 2 August 2026 without a designated French enforcer.

    actuia.com (opens in new tab)

  5. Commission still lists France's single point of contact as pending

    The European Commission's market surveillance authorities page (updated 7 September 2026) lists DGCCRF for France with the designation marked 'pending'.

    digital-strategy.ec.europa.eu (opens in new tab)

Analysis

France chose a 'puzzle' rather than a single AI regulator. The DGE/DGCCRF scheme of September 2025 deliberately built on existing competences: companies already supervised by a sector regulator go to that regulator for AI Act matters, DGCCRF coordinates and fronts the European contact point, and the CNIL, after government amendments in the Senate, becomes the de facto lead for fundamental-rights-sensitive uses. The upside is deep sectoral expertise; the downside is that nothing works until Parliament enacts the whole allocation, and the vehicle chosen was a sprawling omnibus bill covering energy, transport, health and finance alongside AI.

That vehicle is the problem. The Senate finished its work on 18 February 2026, but the text has been in the Assemblée nationale's Commission des affaires économiques since 20 February 2026 with no examination date published. France therefore missed the 2 August 2025 designation deadline by well over a year and entered the 2 August 2026 application date for transparency, GPAI-related governance and penalties with no body legally empowered to receive complaints or impose fines. The Commission's own list still marks France's single point of contact as pending.

Practically, the CNIL continues to act on AI through its GDPR powers and has published AI guidance, and the DGCCRF handles consumer-product issues under existing law, so there is supervision of a kind. But operators cannot yet rely on a national penalties scale, a sandbox or a formal complaints route, and the Court of Auditors' criticism of an eight-month leadership vacuum at the national AI coordinator role (July 2025 to March 2026) underlines a broader governance drift. Unless the Assembly schedules the DDADUE bill this autumn, France will remain one of the larger member states without an operative AI Act framework.

PDF edition

EU AI Act 2026 Q3 Report

All 27 member-state profiles including France, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.

* You will also be subscribed to my newsletter. No spam, unsubscribe any time.

Sources

  1. Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF) (opens in new tab) presse.economie.gouv.fr
  2. Commission nationale de l'informatique et des libertés (CNIL) (opens in new tab) senat.fr
  3. Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne (DDADUE) – Article 24 on Regulation (EU) 2024/1689 (Sénat n° 118, 2025-2026; Assemblée nationale n° 2518) (opens in new tab) senat.fr
  4. Stratégie nationale pour l'intelligence artificielle (France 2030) – third phase launched by the interministerial AI committee of 6 February 2025 (opens in new tab) info.gouv.fr
  5. Assemblée nationale committee stage stalls (opens in new tab) assemblee-nationale.fr
  6. Digital Omnibus on AI postpones high-risk deadlines (opens in new tab) actuia.com
  7. Commission still lists France's single point of contact as pending (opens in new tab) digital-strategy.ec.europa.eu