Agentic AI and GDPR: the CNIL reminds us that human intervention must be real, not a formality
CNIL, July 2026 note: AI agents remain fully subject to the GDPR; data minimization, compartmentalized memory, a stop switch and human control for critical actions.
- In a July 2026 note, the CNIL reminds that agentic AI remains fully subject to the GDPR.
- It cites the EU Court of Justice: human intervention must be real and weigh on the final decision, a formal sign-off is not enough.
- It suggests compartmentalized memory, sandboxing, a human for critical actions and a kill switch to cut an agent off.
In a note published in July 2026, the CNIL examines how the GDPR applies to agentic AI, systems able to act autonomously on a user’s emails, files or browsing history. It reminds that these systems remain fully subject to the regulation. It points out that autonomy can lead, in some cases, to decisions falling under the automated individual decision-making regime of Article 22, and that the minimization principle is tested when an agent draws on large amounts of data, shares them among agents and keeps them in memory.
The note stresses human control: citing the Court of Justice of the European Union (SCHUFA ruling), it writes that human intervention must be real, effective and influence the final decision; a purely formal or automatic sign-off is insufficient. Suggested measures include clearly informing the user, letting them choose which data is accessible, compartmentalizing each agent’s memory, isolating the deployment space (sandboxing), requiring human intervention for critical consequences and providing a “kill switch” to interrupt an agentic process at any time.
For AppH
- These measures describe a prudent setup any agency can adopt: limit the data the assistant can reach, separate uses and keep a simple way to stop it.
- The text supports the principle of real human approval: at AppH, a person at the agency reads the prepared message and approves it before anything is sent, rather than clicking out of habit.
Against / the honest limit
- This is a reflection note on risks and options, not a new obligation or a sanction; it sets no rule specific to domiciliation agencies.
- Applying these recommendations takes organization (choice of data, logs, a stop procedure); a tool alone does not make an agency compliant.
For a small agency the message is concrete: little data, separate uses, a human who really decides and a stop button. Approving without reading is exactly what the CNIL says not to do.
Reviewed by a human at AppH