The European regulation on artificial intelligence (AI Act) has entered its phase of gradual implementation, but the initially planned timeline has undergone a profound reshuffling that most available summaries do not yet incorporate. This shift concretely alters the compliance deadlines for companies and administrations operating in France.
Digital Omnibus: the actual timeline of AI obligations after July 2026
Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026, has redistributed the effective dates for the various layers of the AI Act. Ignoring this text exposes one to two symmetrical errors: believing oneself to be late on postponed obligations, or neglecting those that already apply.
Chapters I and II, including Article 4 on AI literacy and Article 5 on prohibited AI practices, have been applicable since February 2, 2025. The rules governing general-purpose AI (GPAI) models, as well as the governance and sanctions aspects, have been applicable since August 2, 2025.
The transparency obligations of Article 50 (user information interacting with an AI system, reporting generated content) will apply from August 2, 2026, and have not been postponed by the Digital Omnibus.
The heavier obligations regarding high-risk systems have been postponed. Autonomous systems listed in Annex III (recruitment, credit scoring, employee evaluation) have been moved to December 2, 2027 instead of August 2, 2026. This delay goes beyond mere administrative tolerance: it reflects the technical difficulty of implementing compliance assessment mechanisms within the initial deadlines.
To better understand the legislation on artificial intelligence in France, one must integrate this new timeline as an operational reference.
AI Regulatory Authority in France: a persistent institutional void
As of mid-2026, France has still not officially designated its competent national authority to oversee the implementation of the AI Act. This delay is not trivial: without an identified authority, companies have no point of contact for pre-compliance inquiries, incident notifications, or questions regarding the interpretation of risk categories.
The CNIL appears to be a natural candidate, given its expertise on the GDPR and its published work on the interplay between data protection and AI systems. It has also produced several technical resources on the subject. However, there is no guarantee that the mandate will be fully assigned to it: other institutional configurations remain possible, including a sharing of competencies among several sectoral regulators.
This uncertainty creates a concrete legal insecurity for deployers of high-risk systems. Without national guidelines, companies must rely solely on European texts and the orientations of the European AI Office, which do not cover the specifics of French law.
Interplay of AI Act, GDPR, and French copyright law: three overlapping regimes
August 2, 2026, also marks the implementation of transparency obligations that directly intersect with copyright law. Article 53 of the AI Act requires providers of GPAI models to publish a sufficiently detailed summary of the training data used, including content protected by copyright.
Under French law, this requirement clashes with the existing framework of intellectual property. Publishers, photographers, and authors already have mechanisms to oppose text and data mining. The overlap of the two regimes raises practical questions:
- Can a summary of training data compliant with the AI Act suffice to demonstrate respect for the right to oppose TDM as provided by the Intellectual Property Code?
- Must providers of GPAI models trained on multilingual corpora adapt their transparency policy country by country, or does the European framework take precedence?
- Does liability for unauthorized reproduction of a work in an AI-generated output fall on the model provider, the deployer, or both?
We recommend that companies using generative models document their training data supply chain now, even if the full compliance deadline for high-risk systems has been postponed.
AI transparency obligations applicable from August 2026: concrete scope
Article 50 of the AI Act, applicable from August 2, 2026, imposes three categories of obligations that directly affect French companies deploying AI systems in contact with the public:
- Reporting interaction with an AI: every user must be informed when interacting with an AI system, unless this is evident given the circumstances of use.
- Marking synthetic content: images, texts, audio files, or videos generated or manipulated by AI must be identified as such in a machine-readable manner.
- Information on automated decisions: when an AI system produces decisions affecting individuals, the deployer must provide explanations regarding the system’s logic and its main variables.
These obligations do not replace the GDPR requirements on automated individual decisions (Article 22). They are in addition to them. A customer service chatbot, for example, must both indicate its artificial nature under the AI Act and comply with access and rectification rights under the GDPR.
The absence of a designated national authority complicates the enforcement of these obligations, but does not exempt compliance. The sanctions provided by the AI Act for non-compliance with transparency obligations can reach significant amounts, proportional to the global revenue of the offender.
The legal framework for AI in France is being built in successive layers, between European regulation, national intellectual property law, and data protection. Companies waiting for the designation of a regulatory authority to act are accumulating a compliance backlog that is difficult to catch up on, particularly regarding the documentation of training data and the transparency mechanisms already required.