French AI: who makes it, where it runs, what it guarantees

The best-known French AI company is Mistral AI, based in Paris, which makes the Vibe assistant (formerly Le Chat) and open AI models. Around it: LightOn for businesses, the Kyutai and H Company labs, and Albert, the French state’s AI, reserved for public servants. But “French” guarantees only one thing, the company’s head office: where your texts are processed, by which host and under which law, you have to check separately.

Everything below was checked on 22 October 2026 on the official pages of the companies, of ANSSI (France’s national cybersecurity agency) and of the European Union. This landscape moves fast: two companies mentioned below are being acquired.

Which French AI companies matter in 2026?

Sources: mistral.ai, lighton.ai, kyutai.org, hcompany.ai, Lucie-7B model card, ia.numerique.gouv.fr (in French).

If you work in an office and want an AI to help you write, only one of these companies offers a consumer assistant today: Mistral AI. The others sell to businesses or publish models for developers.

Mistral AI, the most used

• Head office: a simplified joint-stock company (SAS) registered in Paris, at 15 rue des Halles (legal notice).
• The assistant: Le Chat became Vibe on 28 May 2026, according to Mistral’s announcement. There is a free plan, with “limited” messages, and Pro, Team and Enterprise plans (pricing).
• Data: “By default, your data is hosted in the European Union”, but “depending on the feature you use, your data can be temporarily transferred outside of the European Union” (Mistral help, 12 August 2026).
• Training: for individual users, your conversations are used to train the models by default, unless you switch this off; the Enterprise plan is excluded by default (Mistral help, 3 September 2026).
• Open models: most are published under the Apache 2.0 licence, which lets you use them freely, including at work. Mistral Small 4 (March 2026) is one of them. Some models have a more restrictive licence for large companies (Mistral help).
• Ownership: in September 2026, Mistral AI raised 3 billion euros, at a valuation of more than 21 billion; the round was led by Samsung Electronics (press release). A French company can have foreign shareholders: most large start-ups do.

What about the rest of Europe?

• DeepL, the translation service, is a German company based in Cologne (legal notice).
• Aleph Alpha, the German AI company from Heidelberg, signed an agreement on 16 September 2026 to combine with Cohere, a Canadian company; the combined group will be called Cohere, with dual head offices in Berlin and Toronto, subject to approvals (Cohere’s announcement).
• Black Forest Labs, in Freiburg im Breisgau, makes image models (FLUX).
• Silo AI, the Finnish lab, was bought by the American company AMD in August 2024 (AMD press release).
• The European Union launched InvestAI in February 2025, a plan that aims to mobilise 200 billion euros, including 20 billion for AI “gigafactories” (European Commission).

The lesson of this list: an AI company’s nationality can change within a year. Check it when you choose, not in an article from 2024.

What “French” guarantees, and what it doesn’t

A “French” AI answers one question out of three.

1. Who makes it? This is the only one the flag settles. A company under French law is subject to French and EU law, including the GDPR. You still need to look at the company that signs your terms of use. Hugging Face, the big platform for AI models, was founded by three French people, but its parent company, Hugging Face, Inc., is American, and its privacy policy states that “the Company and its servers are located in the United States”; its Paris company is its establishment in the EU (privacy policy). On top of that, NVIDIA announced on 3 September 2026 an agreement to buy it, not yet completed (NVIDIA’s announcement).

2. Where is your data processed, and by whom? The flag doesn’t say. A French model can run at an American host: Mistral AI, for example, offered its models on Microsoft Azure as early as February 2024 (announcement). The other way round, Albert runs open models on French servers, some of them published by OpenAI. What matters for your texts is where they are processed, and which company runs those servers.

3. Which law applies? It depends on the contract, and on the nationality of every link in the chain. The CLOUD Act, a US law from 2018, requires a provider subject to US law to hand over, on lawful request, the data in its possession, custody or control, even when stored outside the United States (18 U.S.C. § 2713). An American host in France remains subject to it. Transfers of data to certified US companies are also allowed by an EU decision of 10 July 2023, the Data Privacy Framework (Decision 2023/1795). The EU General Court upheld it on 3 September 2025 (Court press release), but an appeal is pending before the Court of Justice: this framework could still fall, like the two before it. What this means for your company is a question for your data protection officer or lawyer (the GDPR rules are summarised in AI and GDPR); OpenAI’s plans are reviewed from this angle in ChatGPT for business.

Where are French AI services hosted?

In France, the most demanding benchmark for a cloud host is SecNumCloud, the security qualification issued by ANSSI. It is a French national scheme, not an EU-wide one. Its version 3.2 (March 2022) adds criteria for protection against non-European laws such as the CLOUD Act (standard, in French). A qualification covers one specific offer from a host, not the whole company, and it has an end date.

Checked on 22 October 2026 in ANSSI’s catalogue of qualifications (updated 16 October 2026, in French) and its list of qualifications in progress (in French).

Two caveats. A qualified host doesn’t make the AI running on it qualified: the AI service itself has to use the qualified offer. And “in progress” doesn’t mean qualified: a service hosted at Scaleway or Bleu cannot call itself SecNumCloud today. Scaleway, which offers AI models hosted in a data centre in Paris (documentation), has also held HDS certification, France’s certification for health data hosts, since 2024 (announcement, in French).

How to choose a French AI

Before you choose, ask these five questions, and look for the answers in the company’s documents, not its advertising:

1. Which company signs the terms of use? Its name, its country, its parent company.
2. Where are your texts processed, and by which host? The “where is my data stored” page or the list of subprocessors (often in a “Trust Center”).
3. Are your texts used to train the models? And is that setting on by default?
4. How long are they kept? After your request, and after you delete a conversation.
5. Is there a data processing agreement (DPA) for your company, and does the host hold a qualification or certification you can check on the authority’s website?

Depending on your situation:

• For personal use or low-stakes texts: Mistral Vibe, with training switched off in the settings.
• For a team: a business plan with a DPA, data hosted in the EU and training switched off by the administrator.
• For sensitive data or a French public contract that requires SecNumCloud: a service hosted on a qualified offer, checked on cyber.gouv.fr on the day you choose.
• So that your texts go nowhere: an AI that runs on your own computer, with an open model. It is the only option where the hosting question doesn’t arise.

That is what Keypop does in its free plan: local AI runs on your computer, for free, and all you need is a free account with your email. The Pro plan adds sovereign cloud AI hosted in Paris by Scaleway (SecNumCloud qualification in progress), without storing your texts; in automatic mode, it takes over on a computer with less than 12 GB of memory and for some writing tasks.

Pitfalls to avoid

• “French AI” on a tool that resells an American model. Many tools designed in France rely on models from OpenAI, Anthropic or Google: the company is French, the processing isn’t necessarily. Their list of subprocessors tells you.
• “Hosted in France” at an American host. The servers are in France; US law may apply to the host.
• “SecNumCloud qualified” with no details. Check the exact name of the offer and its end date in ANSSI’s catalogue.
• Rankings of “French AI start-ups”: they mix assistants, image tools and research labs, and say nothing about your data.

To go further on AI hosted in France and in Europe: the sovereign resources.