The survey published by the French data protection authority (CNIL) on 3 July 2026, on data protection officers and artificial intelligence, shows a precise picture: 55% of DPOs say the European regulation on AI already falls within their responsibilities (source: CNIL, DPO and AI survey 2025, published 3 July 2026). The same survey indicates that 85% of them have received no dedicated training on this regulation. The CNIL held a webinar on this subject on 29 September 2026. Taken together, these two figures do not point to a training problem. They point to a governance problem.
A scope that has grown without a formal decision
The data protection officer's mandate is defined by the GDPR. Their remit covers oversight of compliance with the European data protection regulation: the record of processing activities, impact assessments, staff training, and liaison with the CNIL. This scope has not been formally updated since the GDPR came into force.
The EU AI Act creates a set of new obligations: technical documentation, risk management, logging, human oversight, and incident notification for high-risk systems. These obligations apply to providers and deployers of AI systems. Where the system in question processes personal data, the natural scope of the DPO and that of the EU AI Act overlap.
Organisations have handled this overlap in the simplest way: by assigning the question to the DPO, without changing their mandate. The result: 55% of DPOs already manage the EU AI Act in practice, yet 71% want this scope to be formally extended. They do the work. They do not have the authority that goes with it.
What the figures do not say explicitly
Two statistics from the survey deserve to be read together. On one hand, 70% of the organisations surveyed use, or plan to use, AI systems, including 81% who use generative AI. On the other, fewer than 31% have started preparing for the EU AI Act. The direct consequence: AI systems are being deployed in organisations that have not mapped their obligations under the regulation.
When neither the managing director, the CIO, nor the CISO formally owns the EU AI Act, the DPO absorbs the question by default, because their GDPR mandate naturally brings them closer to the subject. The survey shows this situation is common: in fewer than 25% of organisations, there is a formalised AI strategy or AI policy. Yet the same organisations believe their DPO handles EU AI Act compliance.
The revealing incident
A concrete scenario shows where the gap actually lies. A service provider to which you have outsourced an HR processing activity uses a candidate screening tool. This system falls into the high-risk category under Annex III of the EU AI Act: it affects access to employment. It processes candidates' personal data. In September, this provider suffers a compromise: thousands of application files are exfiltrated.
Your DPO must notify the CNIL within 72 hours under Article 33 of the GDPR, and assess whether the data subjects must be informed under Article 34. But who assesses whether the AI system complied with the technical documentation obligations of Article 11 of the EU AI Act? Who asks the provider for the system's activity logs, which are mandatory under Article 12? Who verifies that the conformity assessment provided for in Article 43 was carried out before deployment?
If your organisation has no designated EU AI Act owner, and if your DPO has not been trained on the regulation's specific obligations, you will find the answers to these questions at the moment you have the least time to do so. To understand how autonomous AI systems create new responsibilities in this type of scenario, the analysis of AI Act and NIS2 governance when facing autonomous agents details the most common blind spots.
Four measures to close the gap
Update the DPO's mandate letter. If your DPO already oversees AI systems that process personal data, formalise this scope. A mandate letter that explicitly entrusts them with oversight of high-risk systems under the EU AI Act gives them the means to act: access to technical documentation, the right to request conformity assessments from providers, and a voice in purchasing or deployment decisions. This update does not create a new burden. It gives authority to a burden that already exists.
Plan EU AI Act training before the situation forces it. 85% of DPOs have received no dedicated training. Specialist training providers offer two- to three-day formats covering deployer obligations: Annex III, Article 9 (risk management), Article 13 (transparency), and Article 17 (quality management system). Waiting for the first incident or the first CNIL inspection before investing in this training amounts to training a pilot after the accident.
Map the high-risk AI systems that process personal data. This intersection is the natural scope of the DPO: every system that falls under Annex III and processes identifying data must be documented, its conformity assessment verified, and its activity logs accessible. This inventory can start from the existing record of processing activities: every provider or tool using AI models in a high-risk processing activity is an entry to be qualified.
Define an "AI-data incident" protocol. For each scenario in which a high-risk AI system processes personal data and suffers a failure or compromise, define in advance who does what: the DPO for GDPR notification, the EU AI Act owner for the regulation's specific obligations, and the CISO for the security incident under NIS2. These three frameworks are triggered in parallel and have different deadlines. Improvising in the first 72 hours costs more than a written procedure prepared in advance.
What the CNIL webinar signals
On 29 September 2026, the CNIL organised a webinar specifically devoted to the role of the data protection officer in the age of artificial intelligence. The regulator's choice of subject is not incidental: the CNIL is signalling how it intends to approach future inspections. DPOs are identified as the natural point of contact on AI systems that process personal data.
The question to ask is not whether your DPO will be questioned about AI governance during an inspection. The question is whether, when that happens, they will have what they need to respond: a map of high-risk systems, documentation of conformity assessments, and formalised incident procedures. The survey indicates that 27% of DPOs report a good working knowledge of the EU AI Act. If your delegate is among the remaining 73%, the time to act is short.