CNIL AI how-to sheets (English) — GDPR-compliant AI system development

CNIL published an English consolidated presentation of its practical recommendations on how GDPR applies to the development of AI systems that process personal data (the “AI how-to sheets”). The package provides operational guidance across major compliance themes relevant to AI development projects, including: (i) choosing and documenting an appropriate legal basis (often legitimate interests) and managing safeguards; (ii) informing data subjects (including in scenarios involving indirect collection and large-scale sourcing); (iii) ensuring and facilitating data subject rights; (iv) assessing whether an AI model/system should be treated as anonymous versus subject to GDPR (with emphasis on memorisation/regurgitation and re-identification risk); (v) implementing security controls during development; and (vi) managing data annotation processes. The CNIL also published an implementation-oriented checklist and supporting figures/diagrams alongside the recommendations.