On 2 August 2026, the EU AI Act's obligations became fully applicable to high-risk AI systems. In France, the CNIL was designated as the market surveillance authority for the employment domain. It has made AI one of the three priorities of its 2026 inspection programme. Knowing what its inspectors look for makes it possible to prepare answers before an inspection notice arrives.
A new role for a familiar authority
The CNIL is familiar to most legal departments and data protection officers. But 2 August 2026 widened its remit. Article 77 of the EU AI Act requires each Member State to designate a market surveillance authority for AI systems. France designated the CNIL for uses in the employment domain, in addition to its existing GDPR powers.
This means that any AI system used in recruitment, performance evaluation or workplace monitoring now falls under a dual control: the personal data processed (GDPR, the CNIL's remit since 1978) and the AI system itself (EU AI Act, a remit since August 2026). The CNIL does not need a report to open an inspection. It can act on a complaint, on a file, or on its own initiative.
What the 2026 programme explicitly targets
In its work programme published in January 2026, the CNIL named three priorities: recruitment, artificial intelligence and cybersecurity. The intersection of the first two is the most active. According to its 2025 activity report, the CNIL carried out 340 inspections during the year. The integration of AI as an explicit priority for 2026, combined with its new market surveillance mandate, suggests that this figure will rise and focus on automated processing.
In the first half of 2026, the CNIL published an AI compliance guide co-written with ANSSI (France's national cybersecurity agency), the ACPR and the interministerial digital directorate. This guide gives a direct indication of the criteria it will use during inspections. Its main focus areas: transparency towards data subjects, auditability of automated decisions, and robustness of the system against bias.
AI recruitment: the first operational target
Article 6 of the EU AI Act classifies as high-risk any AI system used for recruitment or candidate selection, the evaluation of interviews, task allocation and performance monitoring. If your HR team uses an automated application screening tool, a CV scoring system or a scheduling allocation algorithm, that system is within scope.
A concrete example to make this tangible. A financial services company has been using since 2024 a US SaaS tool that assigns a score to each application before a recruiter reads it. This score combines training history, past experience and behavioural variables drawn from the online form. The system processes personal data and makes a decision that significantly affects candidates. It is subject to the GDPR, to the EU AI Act and, in France, to the CNIL's supervisory remit. If no DPIA was carried out before deployment, if candidates were not informed of the existence of this scoring, and if the DPA with the US provider does not cover AI uses: three points of non-compliance that can be identified immediately during an inspection.
The four documents the inspection checks
Based on the CNIL's documented inspection practices and the guidance of the guide co-written with ANSSI, four elements recur systematically.
The organisation's AI policy. This document defines which tools are authorised, what data they process, who decides on their deployment and how incidents are escalated. The CNIL considers its absence an indicator of insufficient maturity. It does not need to be long: a structured single page is worth more than a thirty-page document that is never updated.
The AI processing register. Your GDPR register must explicitly identify AI systems. An entry that mentions "automated processing of applications" without specifying the tool, its provider, its scoring logic, its retention period and its recipients is insufficient. The CNIL requires traceability of automated decisions, not merely their existence.
The contractual clauses with your AI suppliers. If you use an AI service in SaaS mode, your data processing agreement must cover AI-specific clauses: how the provider trains its models, whether your data contributes to them, and what residual rights it retains after termination. DPAs signed before 2025 generally do not contain these clauses.
The data protection impact assessment (DPIA). For any AI system classified as high-risk under the EU AI Act, a DPIA prior to deployment is mandatory. A DPIA carried out when the supplier contract was signed, and never updated when the version changed or the scope was extended, also constitutes non-compliance. The CNIL checks the date and scope of the document, not merely its existence.
Penalties and how enforcement works in practice
The applicable penalties reach EUR 35 million or 7% of total worldwide annual turnover for serious breaches of the EU AI Act, and EUR 20 million or 4% for GDPR breaches. These ceilings apply to the most serious violations. In practice, according to the CNIL's 2025 activity report, 73% of formal notices led to voluntary remediation without a fine. The authority seeks compliance first, not sanction.
The usual sequence: an inspection notice with a list of requested documents, an interview on site or remotely, a preliminary report, and possibly a formal notice with a deadline for correction. The main operational risk is not the immediate fine: it is the time consumed by the investigation, the obligations to respond within deadlines, and public exposure if the decision is published in the Official Journal.
Where to start in the coming weeks
The first concrete step is to inventory. Ask your HR department to list every digital tool that assists or makes a decision about a person: recruitment, evaluation, scheduling. For each tool, three questions: does it include AI? Does it process personal data? Was it assessed before deployment?
This inventory rarely takes more than a week. The answers outline the gap to close. Drafting the AI policy, updating the register, revising DPAs and completing missing DPIAs represents two to four weeks of work for an organisation that tackles them methodically. The article on the structural gaps that documentary compliance conceals details the most common omissions in programmes that formally comply but miss the substance.
The CNIL opened the second half of 2026 with an expanded mandate and declared priorities. Waiting for an inspection notice before starting the inventory is the least effective way to approach the subject.