What did the CNIL publish about agentic AI in July 2026?

On July 20, 2026, France's AI and digital council (CIANum) published an exploratory note co-written with the CNIL on agentic AI and personal data. It says agents stay fully subject to GDPR, but their memory, autonomy and many data flows justify adapting how the rules are applied.

Why does the note single out persistent memory?

Because agents keep and enrich what they learn about a user across sessions. The note says this lets agentic AI build very precise user profiles that, combined with growing autonomy, risk users losing control of their own data. It suggests separate memories per agent and per purpose, with automatic expiry.

Does the EU AI Act have rules for AI agents?

Not specific ones. The note says the AI Act applies to agentic AI but doesn't treat agents as a category of their own, and its full application in 2027 brings no agent-specific rules. Guidelines on how the AI Act and GDPR fit together are expected by the end of 2026.

What should teams do if they deploy AI agents that process EU personal data?

Check that memory is separated per agent and purpose and can be wiped on request; log, for each task, which personal data, agents and outside services were involved; and require a human to approve high-risk actions such as payments, deletions or sending data outside the system.

CNIL Agentic AI GDPR: Persistent Memory Risks and 3 Checks

Image: Pexels, used under the Pexels License.

France's AI and digital council, the CIANum, published a note co-written with the CNIL on July 20, 2026, and its message is blunt: AI agents remain fully subject to GDPR, but the way those rules are applied has to change. The note is exploratory. It imposes nothing new. It does show where French regulators think GDPR stops fitting neatly once a system remembers you, calls other services and acts in your name.

Screenshot of the Conseil de l'IA et du Numérique page for the note "IA agentique et protection des données personnelles : équation à inconnues multiples pour les utilisateurs", co-written with the CNIL

Screenshot: IA agentique et protection des données personnelles, Conseil de l'IA et du Numérique.

The note is the second in a CIANum series on agentic AI; the first dealt with security. Its title calls agents for users "an equation with multiple unknowns". In 17 pages it names three pressure points and a set of fixes, legal and technical.

Correction, October 15, 2026: an earlier version quoted the note in French phrases that don't appear in it, attributed to it a European Commission definition of agents it doesn't contain, and said the CNIL would publish follow-up guidance. The quotes below are from the published PDF; the note points instead to EDPB and Commission guidelines expected by the end of 2026. A claim about the CNIL's G7 role was removed because we couldn't confirm it.

What makes an agent different

The note defines agentic AI as programs built on generative models that can make decisions autonomously, orchestrate complex actions and interact with third-party services, "avec ou sans validation humaine", with or without human sign-off. A typical setup has an orchestrator agent that talks to the user, specialist agents for tasks such as code or payments, and outside services such as apps, databases and web search.

That design is what strains GDPR. The note's summary says agents "constituent une rupture" in how personal data is processed and moves, and that they put GDPR's core principles under tension while those principles stay essential.

Excerpt from page 1 of the CIANum and CNIL note: the executive summary on persistent memory, opaque data flows between services, and safeguards such as memory compartmentalisation and a kill switch

Screenshot: Résumé opérationnel, IA agentique et protection des données personnelles, CIANum and CNIL.

The video above, from the French channel Le Centre de gravité in August 2026, takes the note as its starting point and asks whether agents can be given real freedom of action without breaking GDPR. It's in French.

Risk 1: memory that builds a profile

Agents work better the more they remember. The note says persistent memory lets agentic AI build "des profils utilisateurs très précis", very precise user profiles, which, combined with growing autonomy, create a risk that users lose control of their own data. Agents can also enrich that profile by drawing on external data sources.

The GDPR friction is with data minimisation. Article 5(1)(c) requires data that is "adequate, relevant and limited to what is necessary" for the purpose. A memory that grows with every session sits uneasily with that, and so does the right to erasure under Article 17: a user who asks to be forgotten has to be removed from every memory store, not just the chat history.

Risk 2: data flows users can't follow

The note's second concern is circulation. In a multi-agent system, it says, a person may struggle to know which agent collected a piece of information, where it was stored and whether it was passed to another component. The summary describes flows that are "parfois opaques et souvent entre de multiples services", sometimes opaque and often across many services.

For a deployer, that's a disclosure and contract problem. Your privacy notice has to cover the services the agent actually calls, and every outside service that processes personal data for you needs a processing agreement under GDPR Article 28. A commenter on r/gdpr put it plainly: "it doesn't matter which tools the LLM invokes, it matters which tools are configured", and if those tools hand work to third parties, that "requires data processing agreements, all the way down the supply chain".

Risk 3: nobody is clearly responsible

The third section is about liability. The note says agents don't change the rule that a controller must be identifiable, but their ability to use several agents, call third parties and decide some things alone "peuvent complexifier l'identification des responsabilités" of each party. Its examples: a wrong purchase, an email sent to the wrong person, confidential data handed to a third-party system.

The legal backdrop doesn't help. The note recalls that the EU dropped its proposed AI liability directive in 2025, and that the AI Act sets compliance duties by risk and role rather than a liability regime. It says the AI Act applies to agents without treating them as a category of their own.

What the note recommends

On the legal side, the note wants traceability that lets a user see, for each task, the personal data used, the agents involved, the third-party services called and the order of events. It wants users to choose which data an agent can reach, and a reminder that Article 22 safeguards apply when an agent makes a decision with legal or similarly significant effects.

On the technical side, it asks for filtering and monitoring of unusual agent behaviour, testing before and during deployment, and a sandbox that limits what the agent can touch. The most concrete passage is on memory.

Excerpt from page 14 of the note: memory should be compartmentalised, each agent with its own isolated memory, entries could expire automatically, and the deployment environment should be sandboxed

Screenshot: Cloisonner la mémoire et l'environnement des systèmes, CIANum and CNIL note.

Memory "devrait être cloisonnée": each agent gets its own isolated memory with no automatic access to other agents' data, entries can expire or be replaced, and memory can be split by processing purpose. Human sign-off should be required for critical actions, with actions on each service ranked by risk, from reading data to deleting it or sending it outside the system. The summary also mentions a kill switch in the user's hands.

As for what comes next, the note says guidelines from the EDPB and the European Commission on how the AI Act and GDPR fit together are being drafted and are expected by the end of 2026. It suggests the EDPB could then turn to recommendations aimed at agent developers and deployers.

Our take

This is a think piece, not a rulebook, and nobody gets fined for ignoring it. But it's the clearest statement yet of what a European regulator will ask when an agent with memory goes wrong, and the asks are reasonable. Three checks are worth running now:

Memory. Can you wipe one user's memory end to end, including vector stores and caches? Is memory separated per agent and per purpose, or does everything land in one pool?
Traceability. For any task, can you show which personal data, agents and outside services were involved, in what order? If not, you can't answer an access request or a regulator's first question.
Human sign-off. Which actions can the agent take alone? Rank them by risk, and put payments, deletions and sending data outside the system behind a human.

If you buy rather than build, put the same three questions to the vendor. Our guide to agentic AI vendor contract clauses covers how to get the answers into the contract.