#AI Lawyer in France: Artificial Intelligence Law in Paris

An artificial intelligence lawyer helps businesses develop, buy or deploy AI systems in compliance with the EU AI Regulation, the GDPR and intellectual property law. Hashtag Avocats, a Paris law firm dedicated to digital law, advises AI solution vendors and user businesses alike, from scoping the project through to contracts and risk management.

Why use a lawyer dedicated to artificial intelligence?

AI combines several bodies of rules that apply at the same time: specific EU regulation, data protection, copyright, civil liability and sector-specific rules. A poorly classified AI project can be blocked late in the day, whereas the obligations are determined at the design stage. The lawyer steps in early: classifying the system and the business’s role, mapping obligations, contracts with suppliers, compliance documentation. This area moves fast: the law presented here is stated as at 5 October 2026.

EU AI Act: what obligations apply at each risk level?

Regulation (EU) 2024/1689 on artificial intelligence, known as the AI Act, entered into force on 1 August 2024. It takes a risk-based approach with four levels: prohibited practices, high-risk systems, systems subject to transparency obligations, and minimal risk.

Prohibited systems and high-risk systems

Practices deemed unacceptable are prohibited, such as general social scoring or certain forms of remote biometric identification. High-risk systems cover in particular biometrics, critical infrastructure, education, recruitment and employee management, access to essential services, and the administration of justice. They require risk management, data quality, technical documentation, human oversight and registration. Systems that interact with people or generate content (chatbots, deepfakes) must also meet transparency obligations.

Obligations of providers and deployers

The regulation distinguishes the provider, which develops the system or has it developed and places it on the market, from the deployer, which uses it under its own authority. The main burden falls on the provider, but the deployer has its own obligations: use in line with the instructions for use, human oversight, monitoring of operation. A business that substantially modifies a system or markets it under its own brand can become a provider without having anticipated it. General-purpose AI models (large language models) fall under a separate regime.

AI Act timeline

Application is phased: prohibitions have applied since 2 February 2025, the rules on general-purpose models since 2 August 2025, and general application since 2 August 2026. Regulation (EU) 2026/1744 of 8 July 2026 (the digital omnibus on AI) postponed the obligations for high-risk systems: they will apply from 2 December 2027 for Annex III systems and from 2 August 2028 for those embedded in regulated products (Annex I). This postponement leaves time to document compliance, but the prohibitions and, save for transitional measures, the transparency obligations already apply.

AI and personal data (GDPR)

Legal basis and data minimisation for training

The AI Act adds to the GDPR; it does not replace it. Training a model on personal data requires a legal basis, information for the individuals concerned and compliance with data minimisation. The CNIL (French data protection authority) has published recommendations dedicated to the development of AI systems, which explain how to build compliant training datasets. A DPIA (data protection impact assessment) is often needed for high-risk processing. These issues extend the business’s general compliance work, handled with our GDPR lawyer team.

Fully automated decision-making (Article 22 GDPR)

Article 22 of the GDPR prohibits in principle decisions that produce legal effects, or similarly significantly affect the individual, based solely on automated processing, including profiling. There are three exceptions: contractual necessity, authorisation by law, explicit consent. Where the decision relies on contractual necessity or consent, the individual must be able to obtain human intervention, express their point of view and contest the decision. Any AI system that scores, filters or selects people must be designed with this constraint in mind. The fine of nearly €825 million imposed on Uber on 24 August 2026 by the Dutch data protection authority, in cooperation with the CNIL, shows the cost of an automated decision (in French) taken without genuine human intervention. Data subjects’ rights are also covered on our personal data (in French) page.

Intellectual property: models, training data and AI outputs

Three questions dominate. First, training: the text and data mining (TDM) exception in Article L122-5-3 of the French Intellectual Property Code (Code de la propriété intellectuelle) allows the reproduction of lawfully accessible works, unless rights holders have opted out, in particular by machine-readable means. Second, protection of the model itself: architecture, weights and datasets are protected mainly through trade secrets and contracts. Finally, AI outputs: French copyright protects works that bear the imprint of a human author’s personality; an output generated entirely without human creative input is hard to protect. The human share in the process therefore becomes a legal and contractual issue.

AI contracts: development, integration, model licences

AI contracts build on the structure of IT contracts and add their own clauses: quality and provenance of training data, warranties on bias and performance, ownership of fine-tuned models, treatment of prompts and outputs, AI Act compliance shared between provider and deployer, auditability. On the buying side, the terms of the large model providers leave little room for negotiation: the focus shifts to internal rules on use and risk cover. We draft these contracts to the same standards as our IT contracts.

Liability for damage caused by AI

Under current law, damage caused by an AI system is handled with existing tools: contractual liability between businesses, liability for defective products, and general fault-based liability. The difficulty lies in proof: establishing the link between the damage and the system’s behaviour. Hence the importance of liability clauses, technical documentation and usage logs, which prepare the evidence before any dispute.

Frequently asked questions

Does the AI Act apply to my business?

Yes, as soon as you provide or use an AI system in the European Union, including as a mere deployer. How demanding the obligations are depends on the system’s risk level and your role. Mapping your uses of AI is the first step.

Can an AI-generated work be protected by copyright?

Copyright requires an original human creation. An output generated entirely by the machine falls, in principle, outside this protection. However, a work in which a human makes substantial creative choices, with AI serving as a tool, can be protected. Where the line falls is assessed case by case and is best settled by contract.

Can you train a model on personal data?

Yes, provided you comply with the GDPR: legal basis, information, minimisation, retention periods, security and, often, an impact assessment. The CNIL’s recommendations on developing AI systems serve as a practical reference. Anonymising or pseudonymising datasets greatly reduces the risk.

Who is liable when an AI makes a mistake?

It depends: the system’s provider, the integrator or the user business, in contract or in tort. The allocation depends on the contracts and on whether each party has complied with the instructions for use and its AI Act obligations. Setting out this allocation in writing in advance remains the most effective protection.

Official sources

• Regulation (EU) 2024/1689 of 13 June 2024 on artificial intelligence (AI Act), amended by Regulation (EU) 2026/1744 of 8 July 2026: overview and application timeline by the CNIL (in French): cnil.fr (in French)
• Article 22 of Regulation (EU) 2016/679 (GDPR), automated individual decision-making (in French): text on cnil.fr (in French)
• CNIL recommendations for the development of AI systems (in French): cnil.fr (in French)
• Article L122-5-3 of the French Intellectual Property Code, text and data mining exception: Légifrance (in French)

Law stated as at 5 October 2026. This content provides general information and does not constitute legal advice. Every situation is different: contact our team for an analysis of your AI project.