The EU AI Act is now in force across all Member States, and France's implementing framework – the Digital Omnibus on AI – took effect on 27 July 2026, making AI Act compliance an immediate operational priority for businesses deploying or developing AI systems in the French market. Key obligations under Article 50 (transparency requirements) and AI Office enforcement powers became applicable on 2 August 2026, meaning that organisations without a documented compliance programme are already exposed to regulatory scrutiny. Ferraz & Whitmore assists international clients in mapping their AI systems against the Act's risk classification tiers, preparing conformity assessments, and coordinating cross-border governance structures that satisfy both EU-level and French national requirements.
Why AI Act Compliance Matters Now in France
France moved quickly to integrate EU AI Act obligations into its domestic legal order. The Digital Omnibus on AI, in force since 27 July 2026, provides the national procedural and institutional scaffolding through which the Act is applied by French authorities. The practical consequence is that the Act is no longer a future compliance project: Article 50 transparency obligations apply today, and enforcement by the EU AI Office – with the French supervisory architecture sitting alongside it – is active.
The watermarking grace period for AI-generated content ended on 2 December 2026, which means that any system generating synthetic text, images, audio or video must now comply with labelling and disclosure requirements without exception. Organisations that missed this deadline are operating outside the permitted window and should seek immediate legal assessment of their exposure.
For financial services and insurance firms, the intersection of AI Act obligations with the supervisory mandates of the AMF (Autorité des marchés financiers) and the ACPR (Autorité de contrôle prudentiel et de résolution) creates a layered compliance environment. These regulators have published expectations around the use of AI in client-facing processes, credit scoring and algorithmic trading, and those expectations now sit alongside – and in some cases amplify – the Act's own requirements.
Risk Classification: The Foundation of Any Compliance Programme
AI governance under the Act begins with a rigorous risk classification exercise. The Act establishes four tiers – unacceptable risk (prohibited), high risk, limited risk, and minimal risk – and the obligations that flow from that classification are materially different at each level.
- Prohibited systems: Certain uses are banned outright regardless of commercial rationale, including real-time biometric categorisation in public spaces in the circumstances defined by the Act.
- High-risk systems (Annex III): Full obligations – including conformity assessment, technical documentation, human oversight mechanisms, and registration in the EU database – apply from 2 December 2027. Annex III covers systems deployed in employment, critical infrastructure, education, essential services and law enforcement contexts.
- Annex I systems: AI systems governed by existing EU product safety legislation face an additional compliance layer, with full harmonised obligations applying from 2 August 2028.
- Limited-risk systems: Subject to transparency obligations under Article 50, which are already in force as of 2 August 2026.
A common pitfall at this stage is misclassification – either under-classifying a system to avoid Annex III requirements, or failing to identify that a general-purpose AI system has been integrated into a high-risk deployment context. Both errors carry significant regulatory and civil liability consequences under French law.
Conformity Assessment and Technical Documentation in France
For high-risk AI systems, the conformity assessment process requires a combination of internal procedures and, in some cases, third-party involvement from a notified body. The assessment must demonstrate that the system satisfies requirements covering data governance, robustness, accuracy, transparency, and human oversight. In France, the Digital Omnibus establishes the procedural framework for how assessments are conducted and recorded at the national level; specific procedural details remain subject to implementing rules that are being developed under the national framework.
Technical documentation must be prepared and maintained before a high-risk system is placed on the market or put into service. This documentation forms the basis of any regulatory inspection and must be kept up to date throughout the system's lifecycle. French enforcement authorities can request access to this documentation at any point, and the absence or inadequacy of records is treated as an independent compliance failure rather than merely as an evidentiary gap.
Post-market monitoring obligations require operators to collect and analyse data on how their systems perform in practice, feeding back into the conformity record. This is a continuous obligation, not a one-time assessment.
If you are approaching the December 2027 deadline for Annex III systems and have not yet commenced your conformity assessment process, we encourage you to contact our team at info@ferrazwhitmore.com or visit our contacts page to discuss a structured programme.
Transparency Obligations and the Article 50 Regime
Article 50 transparency obligations are the compliance layer most immediately relevant to the widest range of businesses. They require, among other things, that users be informed when they are interacting with an AI system, that AI-generated content be labelled, and that emotional recognition or biometric categorisation systems disclose their operation to subjects.
These obligations have been in force since 2 August 2026. Enforcement by the EU AI Office is active, and the French regulatory authorities operate within the enforcement architecture established by the Act and supplemented by the Digital Omnibus. Businesses that deploy conversational AI, content generation tools, or customer-facing recommendation systems should have completed their transparency compliance review by now; if that review has not taken place, the exposure window is open.
The watermarking deadline of 2 December 2026 reinforced these requirements for AI-generated synthetic media. Organisations in media, advertising, financial communications and professional services that use generative AI tools in client-facing outputs should audit their workflows for compliance with this specific obligation.
Cross-Border Dimension: Operating in France as a Foreign Entity
The AI Act applies on the basis of where an AI system is deployed or where its output is used, not only where the provider is established. This means that a US, UK, or Asian company whose AI product is used by French clients or integrated into a French-market service must comply with the Act's requirements in the same way as a French company. The Digital Omnibus on AI addresses the position of foreign providers specifically in the context of appointing authorised representatives within the EU.
For businesses with AI compliance programmes already underway in other jurisdictions, France presents both overlapping and distinct requirements. Our practice in Italy provides a useful comparative reference point; for clients managing multi-jurisdictional AI governance, coordinating obligations across France, Italy and other Member States is typically more efficient than pursuing jurisdiction-by-jurisdiction compliance in isolation. You can review our EU AI Act compliance service for Italy to understand how we structure cross-border programmes.
Cross-border AI disputes and enforcement actions raise procedural questions that go beyond the Act itself. The Cour de cassation has not yet generated a significant body of case law on AI-specific liability under the Act, but precedents from data protection and product liability jurisprudence inform how French courts approach questions of fault attribution, evidentiary standards, and damage assessment in technology disputes. Procedural tools such as injonction de payer and enforcement through a commissaire de justice remain available for commercial disputes arising from AI-related contractual failures. For clients interested in how AI disputes are being handled in other legal systems, our analytics piece on AI disputes adjudication in China provides a comparative perspective.
Typical Pitfalls We See in Practice
- Delayed risk classification: Treating classification as an internal IT task rather than a legal and regulatory exercise, leading to misclassification and incorrect scoping of compliance obligations.
- Inadequate contractual allocation: Failing to address in vendor and customer contracts who bears responsibility for conformity assessment, incident reporting and post-market monitoring – particularly in SaaS and API-based deployments.
- Ignoring the general-purpose AI (GPAI) layer: Using a GPAI model as a component in a high-risk system without considering how the systemic risk classification and transparency obligations at the model level interact with the deployment-level requirements.
- Treating the watermarking deadline as aspirational: The 2 December 2026 grace period end date is a hard deadline, not a target; organisations that treated it as a planning objective rather than a legal cut-off are now non-compliant.
- Underestimating the AMF/ACPR overlay: Financial services firms that focus exclusively on the AI Act may overlook sector-specific AI guidance from these regulators, which can impose additional requirements or accelerated timelines.
- Insufficient human oversight documentation: High-risk system operators must not only implement human oversight mechanisms but demonstrate and document them in a way that satisfies both the Act's standards and French procedural expectations.
How Ferraz & Whitmore Supports Clients in France
Our AI law practice in France brings together expertise in EU regulatory law, French administrative and civil procedure, and the sector-specific frameworks that apply to financial services, healthcare, infrastructure and professional services. We work with clients at each stage of the compliance lifecycle.
Our typical engagement for a new client in France proceeds in four phases. First, we conduct an AI inventory and risk classification review, examining the client's AI systems against the Act's classification criteria and the Digital Omnibus implementing rules. Second, we produce a compliance gap analysis, mapping current practices against applicable obligations and identifying priority actions by deadline. Third, we assist with documentation and governance design – drafting or reviewing technical documentation, conformity assessment records, transparency notices, and internal AI governance policies. Fourth, for high-risk systems approaching the December 2027 deadline, we manage the conformity assessment process in coordination with any required notified body.
We also advise on the contractual architecture between providers, deployers and users, which is often the most commercially sensitive element of an AI compliance programme and the area where disputes are most likely to arise if it is not addressed with care.
Self-Assessment Checklist: Where Does Your Organisation Stand?
- Have you completed an inventory of all AI systems used or deployed in the French market?
- Has each system been classified against the Act's risk tiers, including an assessment of whether it falls within Annex III or Annex I?
- Are Article 50 transparency obligations currently met for all limited-risk and higher-risk systems, as required from 2 August 2026?
- If you generate AI-produced content, are watermarking and labelling obligations met following the end of the grace period on 2 December 2026?
- For Annex III high-risk systems: is your conformity assessment programme on track ahead of the 2 December 2027 deadline?
- Do your vendor and customer contracts clearly allocate AI Act compliance responsibilities, including incident reporting and post-market monitoring?
- If you are a foreign provider with French-market exposure, have you assessed your authorised representative obligations under the Digital Omnibus?
- Have you reviewed AMF and ACPR guidance on AI if you operate in financial services or insurance?
If several of these questions reveal gaps, we recommend seeking legal advice promptly. Enforcement timelines under the Act are not hypothetical: the AI Office is operational, and French authorities are active. To discuss your situation in confidence, please reach out to our team at info@ferrazwhitmore.com or use our contacts page.
Next Steps
AI Act compliance in France is a structured legal and technical process with hard statutory deadlines. The obligations that are already in force – under Article 50 and the Digital Omnibus – require action now, and the December 2027 and August 2028 deadlines for high-risk systems are approaching within normal project planning cycles. Organisations that act early have a material advantage in terms of both regulatory positioning and commercial credibility with clients and partners who require evidence of AI governance maturity.
Ferraz & Whitmore is available to support clients at any stage of this process, whether you are beginning an AI inventory for the first time or reviewing a compliance programme already underway. We invite you to contact us at info@ferrazwhitmore.com or through our contacts page to arrange an initial discussion.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.