Cybersecurity Policy Report, Study Focuses on Impact of AI on French Data Protection Officers, (Jul 6, 2026)
By Tony Foley
A study of data protection officers (DPOs) conducted by the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), along with several other agencies and associations, focuses on the integration of artificial intelligence (AI) into professional practices and the implementation of the European Union’s AI Act that have created new challenges for DPOs.
The survey, conducted in November 2025 by CNIL, the French Agency for Adult Vocational Training, the General Delegation for Employment and Vocational Training, and the French Association of Data Protection Officers, provides a better understanding of how AI is used within organizations and how their governance is structured, according to a news release. The study, which may be downloaded from the release but is available only in French, highlights the key compliance challenges under the EU General Data Protection Regulation (GDPR) and the AI Act identified by the DPOs, as well as the evolution of the DPO profession and their specific support needs.
The study establishes a profile of the DPO profession that in many respects confirms previous trends, among them the following:
79% of DPOs perform their function as internal DPOs;
54% of DPOs come from fields other than legal or IT;
85% of internal and shared DPOs perform their tasks on a part-time basis;
45% have more than six years of experience in the data protection field; and
There is a balance of men and women serving in the role.
With respect to AI, the survey found that 70% of organizations responding planned to use the technology, with 81% citing adoption of generative AI systems and two-thirds of those respondents buying their solutions from outside suppliers. Larger organizations are using AI more frequently, and while governance measures are being put into place, the study found that it remained largely unstructured, with fewer than 25% of organizations having a formal strategy or policy, fewer than one-third having implemented employee awareness campaigns or adopting an AI use charter, and only 31% stating that they had started preparing for when the AI Act enters into force. The study indicated that AI systems are increasingly required to process personal data and that more than half of the DPOs surveyed indicated that they were often, or systematically, involved in AI projects.
Noting that the AI Act does not mention DPOs, the study said the question of extending DPOs’ skill to encompass compliance with the AI Act remained an open question. In this respect, the study showed inconsistent results, with 55% of DPOs stating that they already had the AI Act within their scope of responsibilities, and 71% expressing a desire that their functions be broadened to include AI Act compliance. Only 27% reported a good level of knowledge of the AI Act and 85% said they had not receive specific training on the law.
Faced with these challenges, CNIL said it would support DPOs by continuing to develop practical tools and resources to facilitate the application of the GDPR to AI systems and to help professionals understand and apply GDPR and AI Act requirements.
News: InternationalLegislation DataPrivacy DataSecurity GDPR AINews