AI and GDPR: what small businesses must do to use AI at work

The GDPR doesn’t ban AI at work. It applies as soon as a request contains personal data: a client’s name, a colleague’s email address, a candidate’s file. Your company then needs a legal basis, a contract with the provider if it processes that data on your behalf, safeguards if the data leaves the European Union, and must inform the people concerned. For consumer tools, the CNIL, France’s data protection authority, is clear: non-confidential uses only, with no personal data.

The GDPR and the EU AI Act apply across the EU, so the rules below hold wherever your business is based in the Union. The practical guidance quoted comes from the CNIL, in French, and its quotes are translated; rules and recommendations checked on 22 October 2026. This article doesn’t replace the advice of your data protection officer (DPO), a lawyer or your national data protection authority (the CNIL in France): each use has to be looked at case by case.

When does the GDPR apply to AI?

As soon as personal data goes into the tool. The GDPR defines personal data as “any information relating to an identified or identifiable natural person” (Article 4). A name, an email address, a case number, but also a description precise enough to recognise someone (“our accountant, who’s just back from maternity leave”).

The CNIL sums it up in its guides for small businesses: “By using an AI tool with personal data, you become a ‘controller’ within the meaning of the GDPR” (CNIL guide with France Num and the CPME, a French small-business federation, in French). And it’s the company that answers for its employees’ use: “it is the user organisation that will be legally liable if its staff misuse AI” (CNIL Q&A, in French, 18 July 2024).

On the other hand, rephrasing an email with no names in it, looking for the right wording or summarising a public text brings in no personal data: the GDPR has nothing to say about it, even if trade secrets may still be at stake.

Personal data in your requests

The basic rule is data minimisation: data must be “adequate, relevant and limited to what is necessary” for what you’re trying to do (Article 5). This applies to what you type into the AI, your request (or prompt). To rephrase a reply to a client, the AI doesn’t need their name.

On a consumer service, the CNIL says no to personal data. Users should “never share confidential information such as personal data, company or government data” when they use a consumer service (CNIL Q&A). It only considers these services “for non-confidential uses”, with dedicated work email addresses and, where possible, the provider’s reuse of the data turned off.

Some data is prohibited in principle. Health, political opinions or trade union membership, religion, racial or ethnic origin, sexual orientation, biometric data: processing it is prohibited, with limited exceptions (Article 9). A sick note pasted into an AI to draft a letter falls into this category.

In practice, before you send a request:

1. Remove names, email addresses and numbers (client, case, social security) and replace them with a role: “the client”, “the candidate”.
2. Check that the context doesn’t give the person away: a unique job title, a date or a place is sometimes enough to identify someone.
3. Keep back whatever the request doesn’t need: to fix the tone of an email, the AI only needs the email, not the attachment.

Which legal basis, which records?

Any processing of personal data must rest on one of the six legal bases in the GDPR: consent, contract, legal obligation, vital interests, public task or legitimate interests (Article 6). The choice is the company’s, and it must be able to justify it: that’s a point to settle with your DPO, not in an article.

Two documents follow from it:

• The record of processing activities (Article 30). Companies with fewer than 250 employees have an exemption, but the CNIL points out that it “is therefore limited to very specific cases”: regular processing doesn’t qualify (CNIL, the record, in French). A use of AI that involves personal data gets its own line in it.
• The data protection impact assessment (DPIA), mandatory when processing is “likely to result in a high risk”, in particular when “using new technologies” (Article 35). For generative AI, the CNIL recommends involving the DPO and, “where appropriate”, carrying one out.

The contract with your AI provider

Who does what? When you use AI for your company, the company is in principle the controller; the provider that processes data on its behalf is its processor. The CNIL asks you to “consider your role and that of the provider”, “where appropriate by entering into a processing contract or a joint controllership agreement” (CNIL Q&A).

With a processor, a contract is mandatory (Article 28). It’s often called a DPA (data processing agreement). It sets out the subject matter, duration and purpose of the processing and the types of data, and requires the provider to:

• act only “on documented instructions” from your company, including for transfers;
• guarantee the confidentiality and security of the data;
• not bring in another processor without your authorisation;
• help you respond to requests from individuals;
• delete or return the data at the end of the contract;
• allow audits.

A personal account has no DPA. Consumer plans are taken out on the provider’s terms, as an individual. At OpenAI, for example, the DPA is reserved for the Business and Enterprise plans and its API (compared in ChatGPT for business). That’s one of the reasons a personal account isn’t suitable for company data.

If the AI runs at a hosting provider, the CNIL asks for this to be secured “through a processing contract with the system’s host and, where appropriate, with the AI system provider”. For personal data and sensitive documents, it considers it “generally more appropriate and more secure” to favour solutions installed on the company’s own servers (CNIL Q&A).

Contracts are checked in practice too: in December 2025, the CNIL fined a processor €1 million for keeping a copy of the data of more than 46 million of its client’s users after their relationship ended (Mobius Solutions decision, in French).

Transfers outside the European Union

Personal data can only leave the EU under the conditions of Chapter V of the GDPR (Articles 44 to 49). For the United States, home to most of the big AI providers, there are two routes:

• The EU-US Data Privacy Framework, a Commission decision of 10 July 2023 that recognises an adequate level of protection, but only for US companies on its list (Decision 2023/1795). The EU General Court upheld it on 3 September 2025 (Court press release); an appeal is pending before the Court of Justice.
• The Commission’s standard contractual clauses (Decision 2021/914), which most DPAs include.

In practice, the provider’s DPA tells you where the data is processed and on what basis it leaves the EU. The question of US law that can apply to a US provider even in Europe (the CLOUD Act) is a separate topic, covered in French AI: who makes it, where it runs.

Informing employees, their representatives and the people concerned

The people whose data you process must be told: who processes it, why, on what basis, and who receives it (Articles 13 and 14). If your company sends client data through an AI provider, its privacy notice must reflect that. Go over it with your DPO.

Employees. Employment law is national, and French law is the example here. The French Labour Code forbids collecting personal information about an employee “through a device that has not been brought to their attention beforehand” (Article L1222-4, in French). An AI tool that keeps each person’s history, or makes it possible to monitor their activity, falls under this rule.

The CSE, the staff representative body in French companies with at least 50 employees, must be informed and consulted on “the introduction of new technologies” (Article L2312-8, in French), and on means of monitoring employees’ activity (Article L2312-38, in French). Outside France, check the equivalent rules with your DPO or an employment lawyer.

The AI policy: the CNIL recommends governing generative AI with “internal policies or charters clearly defining permitted and prohibited uses” (CNIL Q&A) and, more broadly, giving the IT charter binding force, for example by attaching it to the company’s internal rules, the French règlement intérieur (CNIL, security, in French).

What about the EU AI Act?

The EU AI Act (Regulation 2024/1689) adds to the GDPR without replacing it. For a small business using a writing assistant, three points matter as of 22 October 2026:

• Train your teams. Since 2 February 2025, companies that use AI have had to act on their staff’s “AI literacy”. The “Digital Omnibus” regulation of July 2026 relaxed this: they now have to take measures to “support” AI literacy, without guaranteeing a specific level (Regulation 2026/1744).
• One ban concerns the workplace: inferring a person’s emotions at work, except for medical or safety reasons (Article 5).
• High-risk HR uses (sorting job applications, evaluation, promotion, performance monitoring) will have their own obligations, including informing workers’ representatives and employees. Their application date has been postponed to 2 December 2027.

The GDPR part of the same omnibus package is still being negotiated: the GDPR applies as it stands.

Practical steps for a small business

The CNIL suggests a six-step approach (how to deploy generative AI, in French): start from a concrete need; define a list of permitted and prohibited uses; don’t overlook the limits of these systems; choose a secure deployment, “for example by favouring local systems”; train users; involve the DPO, the IT manager and the business teams from the start.

As a to-do list:

1. List the actual uses of AI in your team, including personal accounts.
2. Choose a tool with a DPA, a known processing location and training on your data switched off.
3. Write the policy: what can be pasted in, what never is, which tools are allowed.
4. Update the record, and the DPIA if the processing presents a high risk.
5. Inform employees, consult staff representatives where they exist, and review the information given to clients.
6. Train, then review all of this once a year: plans and laws change.

The CNIL offers free resources, in French: generative AI guides for small businesses, a guide for processors and a simplified record template.

Pitfalls to avoid

• Letting everyone use their personal account. No DPA, settings the company doesn’t control, and liability that stays with the company.
• Thinking that removing a name is enough. A request that describes a situation precisely can still be personal data.
• Confusing “hosted in Europe” with “GDPR-compliant”. Where data is hosted settles the question of transfers, not the legal basis, the contract or informing people.
• Underestimating the fines. Breaches of the contract, record or security obligations can cost up to €10 million or 2% of worldwide annual turnover; breaches of the principles, legal bases, individuals’ rights or transfer rules, up to €20 million or 4% (Article 83).

French government departments have their own rules, summarised in Albert, the French government’s AI. More on the same subject: the confidentiality resources.