More specifically, since this summer the new transparency rules of Article 50 require certain AI systems such as chatbots to inform users when they interact with the AI and when the content has been generated or modified by it.<\/p>\n
In addition, providers of content edited or generated using AI will need to be identified as such.<\/p>\n
This content must also bear machine-readable markers in order to be detected more easily.<\/p>\n
Certain exceptions have been provided for in the criminal context as well as for texts whose content is controlled by a human, and adaptations exist for artistic creations.<\/p>\n
The Commission also proposed three icons to identify content generated wholly or partially using AI.<\/p>\n
To help businesses comply with these obligations, the European Commission published guidelines on July 20 clarifying who is affected by these rules and what content must be disclosed.<\/p>\n
A "code of good practice on transparency of AI-generated content", already signed by more than 180 organizations including OpenAI and Google, aims to help companies demonstrate their compliance with the Regulation.<\/p>\n
Who in France is responsible for implementing and monitoring compliance with the regulation?<\/em><\/p>\n Supervision is spread across numerous entities, under the leadership of the DGE and the DGCCRF, which will oversee the general obligations of information and traceability.<\/p>\n This constellation of responsibilities, which will inevitably lead to overlaps, requires enhanced cooperation between stakeholders. The DGCCRF plays the role of the single point of contact at the operational level.<\/p>\n The risks in case of an offence can be significant.<\/em><\/p>\n Sanctions vary according to the level of risk: up to 35 million euros or 7% of global turnover for prohibited AI, 15 million euros or 3% for high-risk non-compliant AI, and 7.5 million euros or 1% for lack of transparency.<\/p>\n For SMEs and very small businesses, the penalties are capped at the lower of the absolute threshold and the percentage of turnover.<\/p>\n The regulation applies in a modulated manner to each AI system used by an organization, and not to the organization as a whole.<\/p>\n It is therefore recommended to map all systems used (including third-party AI and subcontracting) and to assess their level of risk in order to adapt compliance.<\/p>\n France is the first European country to adopt a law prohibiting access to social networks for minors under the age of 15.<\/p>\n The compromise text adopted by parliament on July 21 places the obligation on service providers to implement a reliable age verification system, without imposing a specific mechanism.<\/p>\n From September 1, 2026, minors under the age of fifteen will no longer be able to create new accounts on these platforms.<\/p>\n For existing accounts, the ban will apply after a period of four months, i.e. on January 1, 2027. ARCOM will be responsible for ensuring compliance with this ban.<\/p>\n Note that the text raises questions of proportionality because it requires all social network users to prove their age, and the effectiveness of the mechanism is questioned by its detractors who cite the mixed results obtained by Australia in this area.<\/p>\n The Constitutional Council has been asked to review the text by two groups of members of parliament. Furthermore, the European Commission intends to present a proposal on the subject this autumn, while prioritizing age verification mechanisms that preserve anonymity.<\/p>\n From August 11th and by virtue of a decree of July 23rd, unlike the Bloctel system which requires an active opt-out, telephone solicitation will be prohibited in principle for companies in all sectors of activity except in exceptional circumstances:<\/p>\n Failure to comply exposes companies to fines of up to 375,000 euros for legal entities, as well as the nullity of contracts concluded following irregular solicitation.<\/p>\n Last April, the CNIL took a firm stance regarding tracking pixels in emails, giving companies three months to comply with the legal provisions protecting electronic communications.<\/p>\n Numerous messages have since landed in everyone's mailboxes, requesting consent to track when mail is opened. On July 22nd, the CNIL (French Data Protection Authority) published a series of questions and answers to clarify the conditions for implementing its recommendation.<\/p>\n The CNIL and the CIANum (AI and Digital Council) have conducted a joint reflection and published an exploratory note on the issues raised by agentic AI for the protection of personal data.<\/p>\n This work echoes the discussions undertaken on this subject by the CNIL with its international counterparts, particularly within the framework of the G7 of data protection authorities.<\/p>\n The document notes a change in scale in the use of AI, which is becoming more widespread, and raises questions of responsibility and loss of control over personal data. While the current legal framework applies to these systems, the CNIL highlights a challenge in adapting the methods of its implementation.<\/p>\n Doctolib announced in early July in an email to its 60 million users that, from August onwards, unless they object, it would use some of their health data to train and improve its artificial intelligence tools, as part of research projects in collaboration with Inria, Inserm and Universit\u00e9 Paris Cit\u00e9.<\/p>\n The company states that the data in question is pseudonymized and that its use is governed by the rules of the CNIL.<\/p>\n This research project has generated a number of reactions, including that of the League of Human Rights, which in a press release dated July 16 criticizes the default enrollment of users in the research project and the fact that it is being conducted by a private company (whose data is stored by a company subject to US law) rather than by a public body.<\/p>\n The European Parliament voted on July 9 on the extension of the "Chat Control 1.0" scheme, which allows digital companies to analyze private messages voluntarily, without a mandate.<\/p>\n This "temporary derogation" from the rules relating to privacy and electronic communications, intended to detect online sexual abuse of children, would remain in force until April 3, 2028.<\/p>\n This text, rejected in March by parliament, had been put back on the agenda during a second reading during which the rejection of the proposal requires an absolute majority of all members.<\/p>\n Meanwhile, lawmakers are negotiating an updated framework, "Chat Control 2.0", which could allow access to the content of encrypted communications, a project considered by more than 800 cybersecurity researchers as a threat to the encryption and confidentiality of communications.<\/p>\n On July 7, the European Commission presented an action plan on cybersecurity and artificial intelligence aimed at "promoting safe and responsible use of AI while strengthening Europe's cybersecurity".<\/p>\n The action plan complements the existing EU legal framework on AI and cybersecurity, including the AI Regulation, the Cyber Resilience Regulation, the NIS2 Directive, the Digital Operational Resilience (DORA) Regulation and the Cyber Solidarity Regulation.<\/p>\n On July 23, the European Commission issued two decisions finding that Google had violated the Digital Markets Regulation (DMA) by favoring its own services on Google Search and by imposing restrictions on businesses to prevent them from directing Google Play users to other, often cheaper, purchasing channels. It fined Google \u20ac460 million and \u20ac430 million respectively.<\/p>\n On July 8, the European Data Protection Board (EDPB) published new guidelines aimed at clarifying the application of the GDPR to two major issues:<\/p>\n Regarding anonymization, the committee specifies that data can only be considered truly anonymous if no reasonably possible re-identification exists, based in particular on three criteria: the absence of isolation, linking and deduction.<\/p>\n The guidelines take into account in particular the judgment delivered by the Court of Justice of the European Union in Case C-413\/23 P, EDPB v SRB of 4 September 2025.<\/p>\n Regarding web scraping, the EDPB points out that the automated collection of personal data to train AI models remains subject to the GDPR, in particular the requirements of legal basis, transparency and purpose limitation.<\/p>\n These two draft guidelines are open for public consultation until October 30, 2026. In addition, the blockchain guidelines have been adopted in their final version.<\/p>\n On July 31, 2026, the EDPB also sent a letter to the European Commission asking it to examine whether the ruling by the US Supreme Court in the case of Trump v. Slaughter was likely to affect the validity of the EU-US data protection framework.<\/p>\n The Court of Justice of the European Union (CJEU) held on July 16 that professional emails constitute communications protected under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, but that they can be seized by a competition authority in the context of an investigation without prior judicial authorization, provided that a strict legal framework and adequate safeguards against abuse and arbitrariness are in place (Joined Cases C-258\/23 to C-260\/23).<\/p>\n In its judgment of 14 July (C 474\/24 \u2013 NADA Austria and Others), it considered that the publication of the names of professional athletes who had breached anti-doping rules could be lawful.<\/p>\n However, the entity responsible for publication must be able to balance the competing interests in order to respect the principle of proportionality. It also acknowledged that a complaint could be filed as a preventative measure.<\/p>\n The CJEU finally ruled in a judgment of 9 July (C-199\/24 ND v Legal Newsdesk Sweden AB) that the publication of information relating to criminal convictions in publicly accessible databases did not constitute journalistic activity and could not benefit from an exemption under the GDPR by virtue of national laws transposing Article 85(2).<\/p>\n In Austria, after seven years of proceedings, the Supreme Administrative Court upheld a fine of 13 million euros imposed on the Austrian Post Office.<\/p>\n The company had collected data on the political affinities of more than two million people and had sold this information to third-party companies for direct marketing purposes.<\/p>\n While the company argued in good faith and cited the opinions of consultants who had validated its practices, the Supreme Court rejected these arguments, stating that "no action or knowledge on the part of the governing bodies is required for a legal entity to be sanctioned." The Court further held that "indefensible" legal opinions should not be considered a mitigating circumstance, nor even as an exculpatory factor.<\/p>\n On July 14, the EDPB issued a decision ordering the Belgian Data Protection Authority (APD) to process the complaint filed by the NGO Noyb, a complaint the APD had deemed inadmissible. In a binding decision, the Committee examined whether the complaint should be dismissed on the grounds of abuse of rights and confirmed that mandating a non-profit body, organization, or association to file a complaint on behalf of a complainant was compliant with the GDPR.<\/p>\n The Spanish Data Protection Authority (APD) has fined a genomics and biotechnology company 2.4 million euros for failing to adequately protect genetic and health data and for reporting a personal data breach to the data protection authority after the 72-hour deadline.<\/p>\n The APD also fined Vodafone \u20ac1,050,000 for insufficient data protection measures.<\/p>\n The Italian Data Protection Authority (APD) has fined an energy supplier 5.8 million euros for failing to disclose credit ratings or explain how they were calculated, for illegally sharing debt data within its group, for retaining credit data for ten years without sufficient justification, and for reusing it for incompatible purposes.<\/p>\n A fine of 2 million euros has been imposed by the Italian Data Protection Authority on Lusha Systems Inc., an American data broker which, via its platform, provides "enriched" information about individuals, such as their professional situation, email addresses and telephone numbers, for a fee.<\/p>\n Lusha collects this data from several sources (data extraction from social networks, purchases from other data brokers, etc.) and makes it available to its clients for commercial purposes or to combat fraud.<\/p>\n The company also carries out updates involving online monitoring of the behavior of the individuals concerned, which falls under the GDPR. The Italian Data Protection Authority (APD) has prohibited the processing of data relating to individuals located in Italy and has ordered its deletion.<\/p>\n The APD also sanctioned the telecommunications operator TIM for numerous violations of regulations relating to privacy and telemarketing.<\/p>\n Several of its call centers, acting as subcontractors, made promotional calls on behalf of the company, using numbers not belonging to the official sales network, in order to illegally collect user data.<\/p>\n The authority points out that adherence to a code of conduct does not exempt the responsible party from the obligation to monitor the activities of its subcontractors and to verify the effective application of data protection measures throughout the telemarketing chain.<\/p>\n In Canada, a bill from June 15th proposes to remove the DPA's powers to monitor the private sector and create a single body responsible for regulating online harm, social networks, AI-based chatbots, and privacy protection in the private sector.<\/p>\n In the United States, Section 702 of the Foreign Intelligence Surveillance Act (FISA) expired in June.<\/p>\n Since 2008, this provision allowed US intelligence agencies to collect communications from foreign nationals outside the United States without a warrant.<\/p>\n For several years, a growing number of parliamentarians had been making the renewal of Article 702 conditional on the requirement of a mandatory mandate. They finally obtained the necessary votes to make their position heard.<\/p>\n However, the Foreign Intelligence Surveillance Court (FISC) authorizations renewed in March for the Section 702 program remain in force and "will continue to apply without change, at least until March 17, 2027," according to MP Jamie Raskin.<\/p>\n Some operators have privately warned that they will cease cooperating as soon as the law expires, fearing legal liability in the absence of an existing law to support the government's demands.<\/p>\n Intelligence agencies and telecommunications companies are thus faced with uncertainty regarding which data collection activities can legally continue.<\/p>\n Also in the United States, the amicable settlement reached with the company 23andMe following the 2023 cyberattack, which affected approximately 6.4 million customers, has been definitively approved by a US court.<\/p>\n However, compensation has not yet been paid to the American victims whose genetic data was compromised, due to the company's bankruptcy proceedings.<\/p>\n The compensation fund amounts to $46.75 million, but most beneficiaries will receive only limited compensation, with the highest amounts reserved for victims who can demonstrate significant harm.<\/p>\n The "Rome Declaration for a Peace without Weapons and Based on Disarmament in the Age of Artificial Intelligence, Nuclear and Autonomous Weapons, New Digital Protocols and Emerging Patterns of Digital Development" was signed on Thursday, July 16, on the Capitoline Hill in Rome, marking the culmination of the World Assembly of Nobel Laureates on Artificial Intelligence and Nuclear Warfare.<\/p>","protected":false},"excerpt":{"rendered":" Si le r\u00e8glement europ\u00e9en sur l\u2019intelligence artificielle (IA) est entr\u00e9 en vigueur le 1er ao\u00fbt 2024, nous arrivons \u00e0 une \u00e9tape charni\u00e8re de sa mise en \u0153uvre. On trouvera sur le site internet de la Commission europ\u00e9enne un rappel utile de la chronologie de l\u2019application des dispositions du R\u00e8glement, qui prend en compte les r\u00e9centes […]<\/p>\n","protected":false},"author":1,"featured_media":15228,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[35],"tags":[],"class_list":["post-15232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-veille-juridique"],"acf":[],"yoast_head":"\n\n
![\"French](\"https:\/\/viqtor.eu\/wp-content\/uploads\/2026\/11\/france_1780494638494-6.jpg\")
<\/p>\nIn France<\/h3>\n
\n
![\"European](\"https:\/\/viqtor.eu\/wp-content\/uploads\/2026\/11\/Europe_1780494688401-6.jpg\")
<\/p>\nIn Europe<\/h3>\n
European institutions and bodies<\/h4>\n
\n
News from the member countries of the European Union.<\/h4>\n
![\"Flags](\"https:\/\/viqtor.eu\/wp-content\/uploads\/2026\/11\/INTERNATIO_1780494763286-6.jpg\")
<\/p>\nInternationally<\/h3>\n