CNIL Strategic Plan 2025-2028: A Clear Commitment to Strengthening AI Oversight and Data Protection

📅 January 16, 2025 – The CNIL has just unveiled its roadmap for the next four years, with a clear objective: anticipating digital challenges while safeguarding citizens’ fundamental rights.

In a world where generative AI is expanding, cyberattacks are surging, and minors are increasingly exposed to digital risks, the CNIL is reaffirming its determination to protect personal data while guiding businesses toward compliance.

🔎 Key Takeaways and Practical Implications

 
📌 1. AI: Innovation Under Control
👉 Generative AI is reshaping the legal and economic landscape. Algorithmic biases, automated decision-making, massive data collection—the risks are numerous!

🛠️ The CNIL’s Action Plan:
✅ A dedicated AI department to better understand technologies and their impact
✅ A comprehensive AI system monitoring framework throughout its lifecycle
✅ Stronger collaboration with European regulators, especially for enforcing the AI Act

🔹 Impact for Corporate Legal Teams: Expect stricter compliance requirements and in-depth audits focusing on algorithm transparency and the quality of training data.

 
🛡️ 2. Cybersecurity: Responding to the Surge in Data Breaches
Cyberattacks are at an all-time high. In 2024, 61% of French citizens reported falling victim to a digital attack.

🔒 The CNIL is stepping up its efforts:
✅ Stronger oversight of companies and public institutions handling sensitive data
✅ Enhanced coordination with regulators (ANSSI, ARCOM, DGCCRF) for faster threat response
✅ Alignment with NIS2 and DORA, introducing new cybersecurity obligations

🔹 Impact for Data Protection Officers (DPOs): It’s now critical to test and document your security measures to avoid fines and reputational damage.

 
👦 3. Protecting Minors: Increased Scrutiny
📲 67% of children aged 8-10 are on social media, often without understanding the risks.

🔎 The CNIL’s Response:
✅ Platform audits to ensure proper consent collection
✅ Greater education for young users on their rights and personal data protection
✅ Development of more effective parental control tools

🔹 Impact for Digital Businesses: Prepare for a major overhaul of user journeys for minors.

 
📲 4. Digital Identity & Mobile Apps: Strengthened Protections
📊 93.7% of internet users access the web via smartphones (GWI – 2024). But with identity theft on the rise, the CNIL aims to better regulate everyday digital services.

📌 Concrete Actions:
✅ Stricter mobile app compliance audits to ensure personal data protection
✅ Monitoring the evolution of the European Digital Identity and regulating digital identity wallets
✅ Promoting privacy-friendly solutions for identity and age verification

🔹 Impact for Businesses: Stronger compliance measures will be required for app development and authentication services.

🔮 A Strengthening Regulatory Framework… What’s Next?

With this strategic plan, the CNIL cements its role as a key player in digital regulation in France and Europe.

However, beyond audits and penalties, the real challenge lies in balancing innovation and fundamental rights protection.

🤔 How can companies reconcile artificial intelligence, cybersecurity, and regulatory compliance without stifling innovation?
👀 What regulatory changes lie ahead with the rise of the AI Act and the NIS2 directive?

The coming years will be critical, and for legal departments, now is the time to:
✅ Redefine your compliance processes
✅ Train your teams on emerging data sovereignty challenges
✅ Anticipate upcoming regulatory shifts

Sources :

https://www.cnil.fr/fr/ia-mineurs-cybersecurite-quotidien-numerique-la-cnil-publie-son-plan-strategique-2025-2028

https://www.cnil.fr/sites/cnil/files/2025-01/plan_strategique_cnil_2025-2028.pdf

https://wearesocial.com/fr/blog/2025/02/digital-2025/