Free resource · Word + Excel kit

GDPR Kit for AI Project Sponsors

The method for launching an AI project without jeopardizing compliance: determine in ten minutes whether it's GDPR compliant, what steps to take, in what order, and with whom. The five questions your DPO will ask, the six project categories, the vendor, the impact assessment, and the people involved. All without fear-mongering.

📄 Word, 41 pages📊 Excel Workbook, 5 tools🇫🇷 Up-to-date with CNIL and ECPD regulations 2026🆓 Free

Download the kitSee the five questions

The scene repeats itself in every large organization. A business unit manager has identified the right use case, the software vendor has provided the demonstration, and the budget is secured. Then someone says, "We'll have to discuss this with the Data Protection Officer," and the project enters a three-month tunnel, sometimes emerging as a pilot project with twenty people, sometimes not at all. This is almost never because the GDPR prohibits it. It's because no one around the table can answer the five basic questions: Is there personal data involved? Who is responsible for what? What is the deployment method? Who are the data subjects? And does the AI ​​assist, suggest, or make the decisions?

This toolkit helps answer these questions before the first meeting with the DPO, ensuring you arrive with the information they expect rather than a vague inquiry. It treats the GDPR as a seven-step process that follows the project cycle itself, not as an obstacle to overcome at the end. It focuses on the decisions the client actually makes—purpose, data, vendor, deployment method, usage rules—because these are the decisions that make or break compliance, long before any legal document is drafted.

1. The GDPR has no timetable: it already applies to your AI projects

Unlike the AI ​​regulation, the GDPR is not implemented in stages. It applies to any project that processes personal data, and an AI project almost always does: an assistant that reads emails and documents, a collaborator who pastes a customer exchange into a prompt, a chatbot that answers users, a tool that sorts applications. What changed in 2025 and 2026 is that the authorities clarified the doctrine, and the project sponsor now has references to counter those who tell them that "everything is forbidden" as well as those who tell them that "nothing applies."

Date	Text or position	What this changes for a sponsor
July 2024	CNIL, questions and answers on the use of a generative AI system	How to choose a tool, which deployment method to prioritize, what internal rules to establish, how to train people, when to conduct an impact analysis. The deployer's reference text.
17th December 2024	EDPB Opinion 28/2024 on AI models	A model trained on personal data is not anonymous by default; a deployer must verify that the model they are using was not developed illegally.
7th February 2025	CNIL, thirteen practical guides on the development of AI systems, supplemented	What you can demand from a supplier, and what applies to you if you train or refine a model with your data.
April 3, 2026	CNIL, priority controls 2026	Recruitment, including automated sorting tools, is the first theme, in preparation for the role of the CNIL under the AI ​​regulation; the CNIL is also equipping itself with technical tools (PANAME project with ANSSI and Inria) to check what the models do with the data.
8th July 2026	EDPB guidelines 02/2026 (anonymisation) and 03/2026 (harvesting for generative AI), consultation until 30 October 2026	A demanding anonymity standard: the risk of re-identification must be "negligible". Pseudonymized data remains personal.
July 2026	CNIL and CIANum, note on agentic AI	An agent that acts and memorizes creates new processes: compartmentalizing memory, isolating execution, planning for an emergency stop, maintaining human validation.
End of 2026 (expected)	European Commission and EDPB, guidelines on the relationship between the GDPR and the AI ​​regulation	How to combine GDPR impact assessment and fundamental rights impact assessment in a single document.

The kit details who is responsible for what (the organization, the sponsor, the DPO, the legal department, the CISO, the supplier, the staff representatives), what has not changed, who controls and what sanctions, and what continues to apply alongside the GDPR: the AI ​​regulation, labor law, trade secrets, security, sector law.

2. Five questions to define your project in ten minutes

These are the questions the DPO will ask you. Answering them first, even briefly, determines everything that follows: the project category, what you need to obtain from the supplier, whether an impact assessment is required, and what you owe to the individuals involved. The "Qualifier" tab in the Excel workbook presents these questions as drop-down lists and calculates the result.

Question	The most frequent answer	The result of this
1. Does the project process personal data?	Yes. A name in an email, a signature at the bottom of a contract, a voice in a meeting is enough. Pseudonymized data remains personal; anonymity is demonstrable, according to the EDPB standard.	The GDPR applies; one line in the register.
2. Who is responsible, who is a subcontractor?	You are responsible for the processing; the provider is a subcontractor for the service, and responsible for itself if it reuses your data for its models: this is what must be excluded.	Article 28 contract, training option deactivated.
3. What deployment method?	Enterprise SaaS in the general case; API, on-premises, RAG, refinement, agent depending on the project; personal public account to be avoided for any data of the organization.	The level of security, transfers, detention.
4. Who are the people, what data?	Most often employees and customers; vigilance regarding sensitive data (article 9), minors and vulnerable persons.	Information, rights, and sometimes outright exclusion from the tool.
5. Does AI help, propose, or decide?	It helps in most cases. As soon as it proposes a score or a recommendation that no one contradicts, it decides within the meaning of Article 22 (SCHUFA judgment of the Court of Justice, 7 December 2023).	Real human intervention, explanation, challenge, mandatory impact analysis.

3. The six families of AI projects and their level of requirements

Not all AI projects require the same level of effort. The toolkit categorizes them into six families based on what the tool does with data and what it does with people, with each category including the typical legal basis, the impact assessment verdict, key considerations, and reference sources. A project combining two families falls under the highest level, and a pilot project falls under the same family as a full deployment: the GDPR does not recognize a pilot phase.

Family	Examples	Level	The topic that matters
A. Generalist company assistant	Microsoft 365 Copilot, ChatGPT Enterprise, Claude, Gemini, Mistral	Standard	The supplier's contract and parameters, rules of use, employee information and consultation with the Works Council.
B. RAG on internal documents	HR assistant or support who responds based on procedures and tickets	Standard to high	Reviewing access rights and over-sharing before opening: the assistant makes everything that is accessible findable.
C. Training or refining on your data	A model specifically designed for your customer interactions and files.	High	The thirteen CNIL fact sheets on development apply to you; many refinement projects become RAG projects.
D. Agent who acts	Agent who reads messages, updates the CRM, triggers orders	High	Action-based and memory-based processing: six framework requirements from the CNIL/CIANum note of July 2026.
E. AI for decision-making about people	Application screening, scoring, pricing, and prioritization	Very high	Article 22, the impact analysis, and the high risk of the AI ​​regulation from December 2, 2027.
F. Business solution incorporating AI	AI functionality enabled in the HRIS, CRM, and video conferencing	Variable	An AI function is not an update, it is a project: project sheet and registry update.

4. The supplier: twelve questions, the clauses to obtain, and the Copilot case

In almost all projects, you don't train anything: you buy a service, and the provider becomes the linchpin of your compliance. The toolkit turns this into a method: qualify the provider (subcontractor for the service, responsible for its own purposes, provider of the model as defined by the AI ​​regulation), ask the twelve due diligence questions that a deployer should have checked before signing (reuse for training, localization, retention of prompts and logs, clear text access, content filters, legality of model training, regurgitation, rights assistance, violation notification, certifications, AI regulation documentation, contract termination), and obtain the clauses that are not included in the standard agreement. It also reviews transfers to the United States after the Latombe ruling of September 3, 2025, and devotes a section to Microsoft 365 Copilot based on public impact analyses from the Dutch State and SURF: two risks that remained "orange" in 2026, and the four conditions for a compliant deployment.

5. Painless Impact Analysis

The data protection impact assessment (DPIA) is the tool that sponsors dread the most, yet, when conducted correctly, saves them the most time: it's the document that answers the question "Is this project reasonable?" once and for all. It's mandatory as soon as two of the nine European criteria are met, and a large-scale generative AI assistant almost always meets at least two: novel technology, large scale, and employees in a subordinate position. Rather than demonstrating that it's not required, the toolkit suggests conducting it in a proportionate, five-step format, using the CNIL's PIA software or the "express DPIA" tab of the workbook, pre-filled for a SaaS assistant. It also translates the eight AI-specific risks listed by the CNIL into project language, with the corresponding measure for each.

Stage	What we do	What comes out of it
1. Describe	Purpose, people, data, flows, actors, durations, deployment method	The project sheet, in detail: half of the analysis
2. Justify	Legal basis, minimization, retention, information, rights, contract, transfers; balancing legitimate interest	Proof that the project is necessary and proportionate
3. Assess the risks	Unauthorized access, unwanted modification, disappearance; severity and plausibility; the eight risks inherent to AI	A risk map before measures
4. Decide on the measures	Technical and organizational aspects, with a designated person and a deadline	The action plan and residual risks
5. Get it validated	Opinion of the DPO, consultation with the Works Council, decision of the data controller, CNIL if a high risk remains	A signed document, filed in the evidence folder

6. People: employees, customers, candidates

The GDPR is written from the perspective of individuals. Every project must be able to answer four questions that an individual is entitled to ask: Do I know that my data is being processed by this tool? Can I object to this or have it corrected? Is a machine making decisions about me? And what happens to my most sensitive data? The toolkit addresses all four, with particular attention to employees: no consent is required (it is not freely given), dedicated information is provided that is not the policy charter, the Works Council must be consulted before any deployment, a pilot program that equips an entire department, becomes long-term, or affects working conditions is already considered a deployment (Nanterre Court of Appeal, February 14, 2025), and only a truly voluntary test, limited in time and scope, can precede it (Paris Court of Appeal, February 10, 2026), and there is a firm rule regarding the usage logs of assistants, which are not a surveillance tool. Three models of information notices are provided: the note to employees, the paragraph for the privacy policy, the welcome message of a chatbot.

7. What the kit contains

The Word document has 41 pages, in eight parts and seven annexes: the user guide; why the sponsor is on the front line (who is responsible for what, what changed in 2025-2026, who controls and what sanctions, what else applies); the five questions; the six project families; the supplier (qualification, twelve due diligence questions, clauses, transfers, the Copilot case); the impact analysis (nine criteria, five steps, eight AI-specific risks, link with the AI ​​regulation, register); the people (informing, employees and social dialogue, rights, automated decision-making, sensitive data); the rules of use, security and agents (the charter and what is never entered, eight security topics, six requirements for an agent, training); the timetable and roadmap (what is changing between now and 2027, the seven stops, the first thirty days, the indicators). The annexes provide the one-page project sheet for the DPO, the twenty-five question supplier questionnaire, three models of information notices, the thirty-point checklist, the frequently asked questions, the glossary and dated sources.

The Excel workbook includes the tools in five tabs: the project qualifier, which calculates the family, the level of requirement, the verdict on the impact analysis and the documents to be produced; the pre-filled AI processing register with six standard lines; the rated supplier questionnaire with its traffic light; the pre-filled express impact analysis for a generative AI assistant, with the correspondence to the fundamental rights impact analysis of the AI ​​regulation; and the action plan with the step-by-step summary, the overdue points and the regulatory countdown calendar.

The kit, part by part: what each part contains and what it's for. The templates to fill out are in the Word document and the Excel workbook.

Part 1. Why the sponsor is on the front line

1.1 Who is responsible for what

The GDPR identifies the data controller, the organization, but it is the data subject who defines the purpose, chooses the tool, and decides what data will be entered into it: they create the processing. The DPO (Article 39) informs, advises, and monitors; they are not responsible on your behalf. Their role is not to say no: the earlier they are consulted, the more solutions they can offer.

1.3 Who controls, and what sanctions

The penalties under Article 83 can reach up to €20 million or 4% of global annual turnover. For a sponsor, the most tangible risk lies elsewhere: the project being halted by the DPO or the Works Council due to a lack of documentation, or an order to suspend a tool already used by thousands of employees.

Part 2. The five questions to ask yourself before opening the file

Question 3. What deployment method?

The toolkit compares seven deployment methods. Public-facing personal accounts are prohibited for any organizational data; enterprise services (SaaS) are the general case; with an API, data minimization, logging, and security rules are your responsibility; on-premises or private cloud deployment is the method recommended by the CNIL (French Data Protection Authority) for sensitive or confidential data. RAG (Remote Access Group), refinement, and agent deployments each have their own specific requirements.

Part 3. The six families of AI projects and their level of requirements

3.1 Family A: the generalist business assistant

The usual legal basis is the employer's legitimate interest, with a documented balancing of interests. An impact assessment is recommended for large-scale deployments and mandatory if the assistant reads everyone's emails and documents. Deploying this type of system without a charter, information, or consultation is the most common cause of litigation.

3.2 Family B: the RAG on your documents

The model doesn't retain anything, but the assistant reads everything the user has permission to read, including a payroll file placed in a poorly protected folder. After reviewing access rights comes defining the purpose (an HR assistant should not be used to evaluate employees), minimizing the index, purging it when the source document is deleted, and logging.

3.3 Family C: Training or refining a model on your data

The CNIL's thirteen practical guides on development apply to you. Legitimate interest is possible for development (guideline 8), provided it passes the three-step test: legitimate interest, necessity, and balancing with safeguards. According to EDPB Opinion 28/2024, a model is only considered anonymous if the risk of extracting personal data from it is negligible, which can be demonstrated through testing.

3.5 Family E: AI that decides, or influences a decision

Three regulatory frameworks overlap: the GDPR and its Article 22, the AI ​​Regulation which classifies these uses as high-risk with obligations starting on December 2, 2027, and labor law or sector-specific law. The crucial question is that of human intervention: if the answer is "an operator who validates forty files per hour," the intervention is not effective and the project falls under Article 22.

Part 4. The supplier: choosing, qualifying, and contracting with them

4.3 Clauses to be obtained

Beyond the eight commitments of Article 28, seven clauses are being negotiated: the exclusion of any use of your data to train, refine or evaluate the provider's models; localization within the Union, including for support and backups; adjustable retention; transparency of filters and human reviews; notification of breaches within 24 to 48 hours in practice; documentation of the model; reversibility.

4.4 Transfers outside the European Union

The EU-US data protection framework adopted in July 2023 remains valid: the General Court of the European Union dismissed Philippe Latombe's appeal on September 3, 2025. Standard contractual clauses are the fallback solution to be included in the contract. Location in Europe does not solve everything: a company subject to US law remains subject to the CLOUD Act regardless of the storage location.

4.5 The Microsoft 365 Copilot case

SURF concluded in 2026 that two risks remained "orange": a content filter with undocumented criteria and the retention of pseudonymized diagnostic data for up to eighteen months. Copilot can be deployed in accordance with four conditions: an impact analysis that explicitly accepts these residual risks, a review of over-sharing in SharePoint and OneDrive, retention policies defined in Purview, and a charter with employee information and consultation with the Works Council.

Part 5. Painless Impact Analysis

5.1 When it is mandatory

The CNIL (French Data Protection Authority) considers that processing that meets two of the nine European criteria is presumed to require analysis: evaluation or rating, automated decision-making, systematic monitoring, sensitive data, large scale, data matching, vulnerable individuals (including employees), innovative use, exclusion of a right or contract. Deep learning and generative AI fall under the category of innovative use, unlike regression or random forests.

5.3 The eight risks specific to AI

The CNIL's sheet 5 lists eight risks, which the kit translates into project language with a typical measure: misuse of training data, discrimination by bias, fictitious or erroneous content, automated decision without explainability, specific attacks such as instruction injection, extraction of confidential data, systemic ethical risks, loss of control of individuals over their online data.

Part 6. People: employees, customers, candidates

6.1 Inform

Three actions, covered by the templates in Appendix C: adding a paragraph on AI to the privacy policy, informing employees through a dedicated memo (not the charter), and indicating that a contact person is an AI (Article 50 of the AI ​​Regulation). The flexibility of CNIL Fact Sheet 9, a general information notice published, concerns the template provider: for your clients and employees, the information must be individualized.

6.3 The rights of individuals

Rights can be exercised over data processed by the tool within one month, extendable by two months: it is necessary to know where a person's data is located (RAG index, stored conversations, uploaded files) and how to delete it with the provider. For templates, CNIL fact sheet 10 calls for "realistic and proportionate" solutions: retraining when possible, and failing that, output filters.

6.4 Automated decision-making

Article 22 allows for three exceptions (contract, legal authorization, explicit consent) and imposes safeguards: human intervention, expression of viewpoint, and the right to challenge. The intervention must be genuine, carried out by a competent person who has the time, information, and authority to disregard the machine's decision, and the logic must be explainable: the criteria, the data used, and the tool's influence on the decision.

6.5 Sensitive data, minors, the health sector

A generalist assistant must not receive data from Article 9. When they are the very subject of the project: legal basis of Article 9, impact analysis, certified host for health data and, in healthcare, the guide from the HAS and the CNIL of February 2026. For minors, under fifteen years of age, consent is given jointly by the minor and the holder of parental authority (Article 45 of the Data Protection Act), and any profiling is prohibited.

Part 7. Rules of Use, Safety and Agents

7.1 The charter and what is never grasped

Never in an assistant, except within a framework validated by the DPO and the CISO: health data, opinions, trade union or religious membership, sexual orientation, criminal convictions; bank details, usernames, passwords, keys; individual employee or candidate files; entire customer lists; classified documents, trade secrets, information covered by confidentiality agreements. In a public tool on a personal account: no organizational data.

7.2 Security

Eight topics to obtain from the IT department and the CISO: review of access rights and over-sharing, named accounts with strong authentication, logging, shortest possible retention, protection against instruction injection, compartmentalization of agents, guarantees from the supplier, and a data breach procedure, with notification to the CNIL within 72 hours in case of risk (article 33).

7.3 The agents

Six framework requirements from the CNIL and CIANum note of July 2026: a purpose and scope of action written by agent, minimal access by service account, compartmentalized and purgeable memory, an isolated environment with emergency shutdown, human validation before any action with consequences, traceability and independent evaluation before production.

Part 8. The Timeline and Roadmap

8.2 The journey of a project in seven stages

Define the scope (one week), choose the method and supplier (two to four weeks), finalize the contract (two to six weeks), analyze the impact (two to four weeks), prepare the participants (three to six weeks, concurrently), deploy, and maintain the project. Each stage has a deliverable and a responsible party; the timeframes are for projects in categories A or B, categories C, D, and E require more time.

8.4 Performance indicators

Eight indicators with their target, including: 100% of production projects with a datasheet validated by the DPO, a DPO opinion in less than 15 working days, 100% of DPIAs carried out before production, more than 80% of users trained, incidents qualified in less than 24 hours.

Appendices. Directly reusable templates

Appendix A. AI project sheet for the DPO

A one-page document to be given to the DPO before the first meeting, divided into nine sections: what the project does, personal data, roles, what AI does to individuals, legal basis, retention and security, information and rights, impact assessment, timeline, and then the DPO's opinion. This is the document that is signed and filed in the evidence folder.

Appendix B. Supplier Questionnaire

Twenty-five questions on the contract, location, storage, data access, model, security, and rights. The "3 Supplier Questionnaire" tab of the workbook records each answer (compliant, needs improvement, blocking) and calculates a traffic light system; a negative answer to a question marked with an asterisk should disqualify the supplier.

8. Frequently Asked Questions

The DPO is blocking my AI project. What can I do?

In nine out of ten cases, the DPO doesn't block the process; they wait for answers. Complete the one-page project form in the kit, fill out the supplier questionnaire, and return to them with both. If a legal disagreement remains, it's up to the legal department or senior management to arbitrate based on the impact assessment: the DPO advises, they don't make decisions.

We use Copilot, ChatGPT, or Claude (enterprise version). Isn't the provider responsible for compliance?

From their perspective, yes: the security of the service, the legality of training their models, and compliance with the contract. From your perspective, no: you decide why and with what data the tool is used, you inform your employees and customers, you respond to access requests, and you conduct the impact assessment. A compliant tool does not guarantee compliant use.

Does a pilot with only a few weeks of experience really need all that?

He needs the project sheet, information for the participants, and clear rules of use. The impact analysis can be proportionate, but a pilot with real users and real data constitutes a process. From the Works Council's perspective, the rule is the same as for a deployment: a pilot that equips an entire department, is implemented over time, or affects working conditions is already a deployment and must be preceded by consultation (Nanterre Court of Appeal, February 14, 2025); only a truly voluntary test, limited in time and scope, can precede it (Paris Court of Appeal, February 10, 2026).

Is employee consent required?

No, and it's best not to ask: due to the employer-employee relationship, an employee's consent is presumed not to be freely given. The employer relies on legitimate interest or the performance of the employment contract, informs and consults the Works Council, and organizes the right to object.

Is an impact analysis mandatory for a simple writing assistant?

For a large-scale deployment to employees, it is most likely due to: new technology, large scale, people in subordinate positions, and communication content. It is short for a well-supervised assistant and becomes the reference document for all subsequent projects of the same type.

Where do we begin if we haven't done anything?

Identify the actual uses of AI, often on personal accounts; complete a project sheet for the three most common uses; schedule a meeting with the Data Protection Officer (DPO) with these three sheets. Then, follow the seven steps in the toolkit for each use case, starting with the one that affects the most people.

9. Going further

This kit is the "data" counterpart to the AI Act kit from the sponsorwhich addresses AI literacy, transparency, high risk, and social dialogue; the two are read together, and the impact assessment of this toolkit is designed to accommodate the 2027 fundamental rights impact assessment of the AI ​​regulation. AI charter template sets out the rules of use that Part 7 presupposes, and the AI Systems Governance Kit provides the register of systems and agents. Organizations that want to quickly qualify their ongoing projects entrust the scoping to a half-day workshop with the DPO, the business stakeholders, and the IT department, which leaves with project sheets and impact analysis findings: this is the purpose of the mission. Governing your agents and AI training in companies, the foundation of which includes the rules on data.

Read also : AI Project Sponsor Security and Data Kit, Sponsor's AI Act Kit: The 2026-2027 Roadmap, AI systems governance: the 2026 toolkit, AI Charter in Business: The 2026 Model (Downloadable) et AI Adoption Roadmap in 12 Months: The 2026 Toolkit.

The entire series of free kits. To drive adoption: AI charter template, AI Ambassadors Kit, Manager's toolkit for dealing with AI, Adoption Roadmap Kit, AI maturity grid, AI Measurement and ROI Kit et AI Governance KitFor the AI ​​project sponsor: AI Act kit, Security and data kit, AI and Social Dialogue Kit, frugal AI kit, AI Sovereignty Kit et responsible AI kitBy profession: AI HR kit, AI marketing kit, AI finance kit, AI kit for lawyers, AI kit for salespeople, AI toolkit for project managers, AI innovator kit et communicator's AI kit.

10. Sources

The positions cited on this page and in the toolkit are based on the following dated sources. The texts published in the Official Journal of the European Union are authoritative.

• European Union, Regulation (EU) 2016/679 of 27 April 2016 (GDPR) ; Regulation (EU) 2024/1689 on artificial intelligence, as amended by Regulation (EU) 2026/1744.
• CNIL, AI: How to achieve compliance?, AI fact sheets (completed on February 7, 2025) and the check-list from July 2025.
• CNIL, The CNIL's Q&A on the use of a generative AI systemJuly 18, 2024; Data Protection Impact Assessment and the PIA software.
• CNIL and the AI ​​and Digital Council, Agentic AI and personal data protection: an equation with multiple unknowns for usersJuly 2026; CNIL priority controls for 2026, announced on April 3, 2026 (analysis of June 10, 2026): IT Social).
• European Data Protection Board, Opinion 28/2024 of 17 December 2024 on AI models (analysis: CMS); AI Privacy Risks & Mitigations: Large Language ModelsApril 2025; Guidelines 02/2026 on anonymization and 03/2026 on harvestingadopted on July 8, 2026 (analysis: Pearl Cohen).
• IAPP, A sneak peek into upcoming guidelines on GDPR, AI Act interplayJune 18, 2026, and European General Court dismisses Latombe challenge, September 2025.
• SURF, Privacy risks Microsoft 365 Copilot remain orange despite improvements, 2026; Microsoft, Build Your Own M365 Copilot DPIA templates.
• Court of Justice of the European Union, judgment of 7 December 2023, SCHUFA Holding (C-634/21); Y. Bouaïcha, Consultation with the Works Council and artificial intelligence tools: what the judges decided in 2025-2026, Village of Justice.