France AI Act Adaptation Bill

Overview

The French DDADUE Bill, officially titled « Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne en matière économique, financière, environnementale, énergétique, d'information, de transport, de santé, d'agriculture et de pêche », represents a significant legislative effort by France to integrate a multitude of European Union legal instruments into its national legal framework. This comprehensive bill addresses a broad spectrum of domains, reflecting the extensive reach of EU law into Member State legislation. Among its many provisions, Article 24 specifically targets the implementation of the landmark EU Artificial Intelligence Act (AI Act), a regulation adopted by the European Parliament on June 13, 2024, and which entered into force on August 1, 2024. The primary objective of Article 24 is to establish the necessary national legal and institutional mechanisms for the effective application and enforcement of the AI Act within French territory. This includes the crucial task of designating the national competent authorities that will be responsible for overseeing AI systems, ensuring compliance with the AI Act’s stringent requirements, and imposing penalties for non-compliance. The bill aims to clarify the roles and responsibilities of various existing French regulatory bodies, adapting their mandates to encompass the new challenges and opportunities presented by artificial intelligence technologies. The DDADUE Bill's journey through the French parliament underscores the complexity of adapting national law to a comprehensive EU regulation that introduces a novel risk-based approach to AI governance. As of early 2026, the bill has progressed through the Senate, where it was adopted with modifications, and is now awaiting examination by the National Assembly. This legislative process involves detailed discussions and potential amendments to ensure that the designated authorities are adequately equipped and that the national implementation framework is robust enough to handle the technical and ethical intricacies of AI regulation, covering everything from prohibited AI practices to high-risk applications and transparency obligations for general-purpose AI models. Its enactment is a pivotal step for France to align with the EU's harmonized rules on artificial intelligence, ensuring the safety, transparency, and ethical deployment of AI systems while fostering innovation and maintaining its digital sovereignty.

Definitions

Within the context of the DDADUE Bill and its implementation of the EU AI Act, several key definitions are paramount for understanding the scope and application of the regulation. An "AI system" is broadly defined as a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. This broad definition ensures that a wide range of AI technologies, from simple algorithms to complex machine learning models, fall under the regulatory umbrella. A central concept in the AI Act, and thus in its French implementation, is the classification of AI systems based on their "risk level." The AI Act adopts a risk-based approach, categorizing AI systems into unacceptable risk, high-risk, limited risk, and minimal/no risk. Systems posing an "unacceptable risk," such as those involving social scoring by public authorities or manipulative techniques causing physical or psychological harm, are strictly prohibited. The category of "high-risk AI systems" is particularly significant, as these systems are subject to the most stringent requirements. High-risk AI systems are those intended to be used as safety components of products, or those falling into specific areas enumerated in Annex III of the AI Act, such as critical infrastructure, education, employment, law enforcement, migration, and the administration of justice. For these systems, comprehensive conformity assessments, risk management systems, data governance, technical documentation, human oversight, robustness, accuracy, and cybersecurity are mandatory. The DDADUE Bill, through Article 24, is tasked with designating the "competent authorities" in France responsible for overseeing these definitions and ensuring compliance. These authorities are national public bodies with the power to enforce the AI Act, conduct market surveillance, and impose sanctions. Their designation is critical for the practical application of the AI Act's provisions and for providing clarity to developers, deployers, and users of AI systems in France regarding their legal obligations and the regulatory landscape, including specific provisions for general-purpose AI models (GPAI) and their transparency requirements.

Governance and Institutional Framework

The DDADUE Bill, particularly through Article 24, is instrumental in shaping France's governance and institutional framework for artificial intelligence by designating the national competent authorities for the EU AI Act. Rather than creating a single, standalone AI regulator, France has opted for a multi-sectoral approach, leveraging the expertise of existing regulatory bodies. This distributed model aims to integrate AI oversight into established regulatory domains, ensuring that sector-specific nuances are adequately addressed. Key entities identified for these roles include the CNIL (Commission Nationale de l'Informatique et des Libertés) for aspects related to personal data and fundamental rights, particularly concerning prohibited AI practices like social scoring and certain high-risk systems under Annex III. The ARCOM (Autorité de Régulation de la Communication Audiovisuelle et Numérique) is set to oversee AI applications in media and online content, including issues related to platform algorithms, recommendations, deepfakes, and misinformation. Meanwhile, the DGCCRF (Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes) will play a coordinating role for market surveillance authorities and address consumer protection aspects, such as unfair commercial practices and misleading AI-related claims. This fragmented yet coordinated regulatory architecture is designed to provide comprehensive oversight across the diverse applications of AI. Other bodies, such as the ANSM (Agence Nationale de Sécurité du Médicament et des produits de santé) for medical devices, the ACPR (Autorité de contrôle prudentiel et de résolution) for financial institutions, and the ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information) for cybersecurity, will also have responsibilities for AI systems within their respective purviews. The coordination among these various authorities is a critical element, with the DGCCRF often cited as the central point of contact for market surveillance, as per Article 70.2 of the EU AI Act. The DDADUE Bill provides the legal basis for this distribution of responsibilities, which will likely be further detailed through governmental amendments and subsequent decrees. This framework aims to ensure that the complex requirements of the AI Act, ranging from conformity assessments to post-market monitoring, are effectively enforced, while also adapting to the rapid evolution of AI technologies and their societal impact, ensuring a robust and responsive regulatory environment.

Key Focus Areas

The DDADUE Bill, through its implementation of the EU AI Act via Article 24, places significant emphasis on several key focus areas designed to ensure the responsible development and deployment of artificial intelligence in France. A primary focus is the risk-based approach to AI regulation, which categorizes AI systems according to their potential to cause harm. This includes the outright prohibition of AI systems deemed to pose an unacceptable risk to fundamental rights, such as manipulative subliminal techniques, real-time remote biometric identification in public spaces, or systems exploiting vulnerabilities of specific groups. For high-risk AI systems, the bill's implementation will mandate stringent requirements covering areas like data governance, technical documentation, human oversight, robustness, accuracy, and cybersecurity. These obligations are crucial for ensuring the safety and reliability of AI applications in critical sectors like healthcare, law enforcement, and critical infrastructure, where the potential for severe harm is highest. The designated national authorities will be responsible for enforcing these requirements, including conducting conformity assessments before high-risk AI systems are placed on the market or put into service, potentially involving third-party assessments for critical systems. Another critical area of focus is transparency and disclosure. The AI Act, and consequently the DDADUE Bill, introduces obligations for providers and deployers of certain AI systems to ensure transparency, particularly for AI systems interacting with humans (e.g., chatbots), emotion recognition systems, biometric categorization systems, and AI-generated content (deepfakes). Users must be informed when they are interacting with an AI system, and AI-generated content may require clear labeling to prevent misinformation and ensure authenticity. This focus on transparency is vital for building public trust in AI and enabling individuals to make informed decisions. Furthermore, the bill's implementation of the AI Act will reinforce the protection of fundamental rights. The entire framework is designed to ensure that AI systems respect human rights, non-discrimination, and privacy, with particular attention to preventing bias and ensuring fairness in algorithmic decision-making. The designation of authorities like the CNIL underscores this commitment, as they will oversee AI applications that intersect with personal data and individual liberties, ensuring mechanisms for redress and complaint handling are in place. The DDADUE Bill thus aims to create a regulatory environment where innovation in AI can flourish while safeguarding societal values and individual protections.

Implementation Framework

The implementation framework for the EU AI Act in France, as outlined by the DDADUE Bill, particularly Article 24, involves a multi-layered approach to integrate the comprehensive European regulation into national law. The bill serves as the foundational legal instrument to designate the necessary national competent authorities and to establish the procedural mechanisms for the AI Act's enforcement. This framework is not about creating entirely new legislation from scratch but rather adapting existing French legal structures and administrative capacities to meet the specific demands of the AI Act. The core of the implementation lies in identifying which existing French regulatory bodies are best suited to oversee different aspects of AI, given their established expertise and mandates. For instance, the CNIL, with its long-standing role in data protection, is naturally positioned to handle AI systems that process personal data and impact fundamental rights. Similarly, the ARCOM's expertise in audiovisual and digital communication makes it a logical choice for regulating AI in media and online content, extending its existing mandates under other digital regulations. Beyond the designation of authorities, the DDADUE Bill provides the legal basis for these bodies to exercise their new powers, which will likely include conducting market surveillance, carrying out investigations, issuing warnings, ordering corrective actions, and levying administrative fines for non-compliance. The bill also anticipates the need for further executive decrees (décrets d'application) and ministerial orders (arrêtés ministériels) to elaborate on specific procedural details, such as the exact modalities for conformity assessments, the handling of complaints, and the coordination mechanisms among the various designated authorities. This phased approach, starting with the legislative designation in the bill and followed by more detailed regulatory texts, is typical for the implementation of complex EU regulations. The framework is designed to ensure that France can effectively monitor the development, deployment, and use of AI systems, particularly high-risk ones, throughout their lifecycle. It also aims to facilitate the establishment of regulatory sandboxes, as encouraged by the AI Act, to support innovation by providing a controlled environment for testing novel AI systems before their market release, thereby balancing regulatory rigor with the promotion of technological advancement and ensuring a dynamic regulatory landscape.

Monitoring and Evaluation

The monitoring and evaluation mechanisms for AI systems under the DDADUE Bill's implementation of the EU AI Act are designed to ensure continuous compliance and to assess the effectiveness of the regulatory framework in France. With the designation of multiple sector-specific competent authorities, each body will be responsible for monitoring AI systems within its jurisdiction. For example, the CNIL will monitor AI systems that process personal data, ensuring adherence to data protection principles and fundamental rights, and investigating potential biases. The DGCCRF, in its coordinating role, will oversee market surveillance activities for AI products and services, verifying that they meet the safety and transparency requirements before and after they are placed on the market. This involves checking for CE markings, declarations of conformity, and proper instructions for use, especially for high-risk AI systems. The evaluation process will extend beyond mere compliance checks to include assessing the real-world impact of AI systems. This is particularly crucial for high-risk AI, where continuous monitoring of performance, accuracy, robustness, and cybersecurity is mandated. Authorities will investigate incidents, handle complaints from individuals and organizations, and conduct audits to ensure that AI systems remain compliant throughout their lifecycle. The framework also anticipates the need for ongoing evaluation of the regulatory approach itself, to ensure it remains agile and responsive to rapid technological advancements. This might involve periodic reviews of the designated authorities' effectiveness, the adequacy of their resources, and the clarity of their mandates. Furthermore, the AI Act encourages the establishment of regulatory sandboxes, which will serve as controlled environments for testing innovative AI systems. The data and insights gathered from these sandboxes will be invaluable for evaluating the practical implications of the regulations and informing any necessary adjustments to the monitoring and evaluation strategies, thereby fostering a dynamic and adaptive regulatory landscape for AI in France and contributing to the broader European AI Office's efforts.

Penalties, Liability, and Appeals

The DDADUE Bill, by implementing the EU AI Act, establishes a robust framework for penalties, liability, and appeals in France, designed to ensure strict adherence to the new AI regulations. The EU AI Act itself outlines significant fines for non-compliance, which the French bill will transpose into national law. These penalties are tiered based on the severity of the infringement and the type of AI system involved. For instance, violations related to prohibited AI practices or non-compliance with data governance requirements for high-risk AI systems can incur substantial fines, potentially reaching up to €30 million or 6% of a company's global annual turnover, whichever is higher. Non-compliance with other AI Act provisions, such as those for high-risk AI systems, could lead to fines of up to €15 million or 3% of global annual turnover. The designated national competent authorities, such as the CNIL, ARCOM, and DGCCRF, will be empowered to investigate alleged infringements, issue warnings, order corrective actions, and impose these administrative fines within their respective domains. The specific powers and procedures for these enforcement actions will be detailed through the DDADUE Bill and subsequent implementing decrees, ensuring due process. Regarding liability, while the AI Act primarily focuses on regulatory compliance and administrative penalties, it also lays the groundwork for potential civil liability claims. Although the DDADUE Bill itself may not directly establish new civil liability regimes for AI, its implementation of the AI Act will contribute to a clearer understanding of the duties of care for providers and deployers of AI systems. This increased clarity can, in turn, influence future civil liability litigation where AI systems cause harm, potentially aligning with future EU-level liability directives for AI. The AI Act also includes provisions for individuals to lodge complaints with the relevant market surveillance authority concerning non-compliance with the AI Act and to seek redress. The French implementation will outline the procedures for such complaints and the avenues for appeal against decisions made by the competent authorities, ensuring that affected parties have legal recourse and that regulatory decisions are subject to review, upholding principles of due process and administrative justice. The overall aim is to create a strong deterrent against non-compliance while providing clear pathways for accountability and redress in the rapidly evolving landscape of artificial intelligence.

Relationship to Other Instruments

The DDADUE Bill's implementation of the EU AI Act, particularly through Article 24, exists within a complex web of interconnected legal instruments at both the national and European levels. Its primary relationship is, of course, with the overarching EU AI Act (Regulation (EU) 2024/1689), which provides the harmonized legal framework for artificial intelligence across the European Union. The French bill serves as the national legislative vehicle to give effect to the directly applicable provisions of this EU Regulation and to designate the national authorities responsible for its enforcement. This means that while the core obligations and prohibitions originate from the EU AI Act, the DDADUE Bill specifies how these will be applied and overseen in France. The AI Act itself also interacts with other existing EU legislation, such as the General Data Protection Regulation (GDPR). The DDADUE Bill's designation of the CNIL as a key competent authority for AI aspects involving personal data highlights this synergy, ensuring that AI development and deployment remain compliant with both AI-specific rules and broader data protection principles. At the national level, the DDADUE Bill's provisions on AI will also interact with other French digital laws and regulations. For instance, it builds upon existing frameworks related to digital services and platforms, such as the Law aimed at securing and regulating the digital space (Loi SREN). The SREN law already designates authorities like ARCOM and DGCCRF for enforcing other EU digital regulations (e.g., DSA/DMA), and the DDADUE Bill extends their mandates to include AI Act responsibilities. This approach avoids regulatory fragmentation and leverages existing institutional expertise. Furthermore, the bill's implementation of the AI Act will need to be coherent with other sectoral regulations where AI is deployed, such as in healthcare (e.g., Bioethics Law for medical AI) or finance, ensuring that AI-specific rules complement rather than contradict established sector-specific safety and ethical standards. The ongoing discussions and potential amendments during the parliamentary process will be crucial in ensuring a seamless integration of the AI Act into the broader French legal landscape, minimizing overlaps and ensuring clarity for all stakeholders involved in the AI ecosystem.

International Alignment

The DDADUE Bill's Article 24, focused on implementing the EU AI Act, is fundamentally driven by the imperative of international alignment, specifically with the European Union's harmonized approach to artificial intelligence. The EU AI Act is the world's first comprehensive legal framework for AI, establishing a common set of rules for the development, deployment, and use of AI systems across all 27 Member States. By transposing this regulation, France is ensuring that its national legal landscape for AI is fully aligned with the broader European strategy, fostering a unified digital single market and promoting a consistent level of protection for citizens and businesses throughout the EU. This alignment is crucial for several reasons: it facilitates cross-border innovation and trade in AI technologies within the Union, prevents regulatory fragmentation that could hinder the growth of the European AI sector, and strengthens the EU's global leadership in setting ethical and trustworthy standards for AI. The bill's commitment to implementing the AI Act means that France will adhere to the common definitions, risk classifications, and obligations established at the EU level. This includes the prohibition of certain AI systems deemed to pose unacceptable risks, the stringent requirements for high-risk AI, and the transparency obligations for other AI applications, including general-purpose AI models. By adopting these harmonized rules, France contributes to the EU's objective of promoting a human-centric and ethical approach to AI on the international stage, often referred to as the 'Brussels Effect'. It also ensures that French companies developing or deploying AI systems will operate under the same regulatory framework as their counterparts in other EU Member States, reducing compliance burdens and fostering a level playing field. While the DDADUE Bill focuses on national implementation, its very existence is a testament to France's commitment to the principle of subsidiarity and the effective functioning of the EU's single market, ensuring that the benefits of a harmonized AI regulatory environment are fully realized within its borders and contribute to the overall strength of the European approach to AI governance and its global influence in shaping future AI norms and standards.

Implementation Timeline

Compliance Checklist

Sources and References