AI Agents and GDPR: How to Stay Compliant in France?

Why does an AI agent create specific GDPR obligations?

An AI agent runs tasks end-to-end: it reads, writes and decides on data, without systematic human validation. This autonomy shifts GDPR responsibility onto the company deploying the agent, which is treated as the data controller. Article 22 of the GDPR specifically governs "solely automated" decisions that produce legal effects on an individual. According to CREDOC (Baromètre du numérique 2026 edition, survey conducted June 2025, 4,145 people), 48% of French people use generative AI, up 15 points in one year. This acceleration mechanically increases the volume of personal data processed by AI systems, and therefore the legal exposure.

What personal data does an AI agent actually process?

A business AI agent almost always touches personal data: names and emails of CRM contacts, customer interaction histories, HR data, sometimes health or banking data. Each of these categories calls for a distinct legal basis (consent, legitimate interest, contractual performance). Growth Wave observes in the field that 2 to 3 agent or custom software projects are rescued in emergency each month, with failures including CRM access or confidential data exposed with no identified legal basis (source: Growth Wave proprietary data, recurring observation, June 2026). The risk is not theoretical: it is operational.

How to choose a GDPR-compliant LLM in France?

The choice of language model determines where data travels and where it is stored. Growth Wave applies a simple rule: Mistral recommended when data is sensitive or when a sovereignty requirement exists, Claude API for cases without a location constraint (source: Growth Wave proprietary data, POV & definitions, June 2026). This approach is agnostic: the right LLM depends on the project, not on dogma.

Data location: EU servers vs US servers

Transferring data to the United States requires additional safeguards (standard contractual clauses, impact assessment). For sensitive data, hosting in the European Union remains the safest route. According to Deloitte (State of AI in the Enterprise 2026, survey conducted August to September 2025, 3,235 executives, 24 countries), 83% of companies consider "sovereign AI" important and 77% factor the vendor's country of origin into their decision. Sovereignty is no longer an activist topic; it has become a purchasing criterion.

Criterion	EU servers	US servers
Sensitive data	Recommended	To avoid
GDPR safeguards	Native framework	Clauses + assessment required
Growth Wave recommendation	Mistral	Claude API if no sensitive data

Contractual clauses and DPA (Data Processing Agreement)

Any LLM provider acting as a processor must sign a DPA framing the processing: purposes, duration, security, further sub-processing. Check that the provider commits not to reuse your data to train its models. Growth Wave has a DPO certification within the team, which makes it possible to frame these clauses right from the design stage.

How to document and audit your AI agent's decisions?

Auditability is the third pillar: you must be able to reconstruct why an agent made a decision about a person. This requires a processing log, traceability of the data used, and a human-in-the-loop mechanism for high-impact decisions. This requirement is prepared at step 00 Data Governance of the Growth Wave framework, by defining the rules and roles before any deployment. Growth Wave has deployed more than 150 AI agents in production, with an in-house DPO certification (source: Growth Wave proprietary data, June 2026). According to Growth Wave, deploying an AI agent on an unstructured base automates errors: on a clean and governed base, it automates performance, in full compliance.

What obligations toward the people whose data is processed?

The individuals concerned keep their rights: information, access, rectification, objection, and the right not to be subject to a solely automated decision (Article 22). In practice, your agent must provide for a possibility of human intervention and clear information about automated processing. These obligations translate into features to be designed upfront (point of contact, objection mechanism), not into a layer added after go-live.