I have to comply

AI and the law in 10 terms

Ten terms to understand what the law asks for, and why. This path gives no legal advice: it explains the notions and the logic of the texts, so that you know which questions to ask, and of whom.

All audiences, French and European angle · 10 terms · 30 minutes · final quiz

The sequence

0 / 10 seen

Personal dataThe notion that triggers almost everything else. It is far broader than a name: it covers anything that makes it possible to trace back to a person, even indirectly.
GDPR and AIThe framework that already applies, independently of any law specific to AI. Pasting a document into a tool is processing, like any other.
AI ActThe European regulation that grades obligations according to the risk of the use, not according to the technology employed. The same model can fall under two different regimes depending on what is done with it.
AI governanceWho decides what, who answers for what, and on what evidence. It is what turns an obligation into a workable practice, and a practice into evidence.
GuardrailsThe technical translation of a requirement. A rule that exists only in an internal memo is not a guardrail: it stops nothing.
Human in the loopHuman oversight, when it is real. Mechanically validating what you have no means of examining oversees nothing, and merely transfers responsibility.
TraceWhat makes it possible to reconstruct what happened. Without a trace, it is impossible to demonstrate anything at all, including that everything went well.
HallucinationThe reason an output is not a decision. A system that produces what is plausible commits whoever uses it, not whoever trained it.
Digital sovereigntyThe question of where the data lives, under which law, and who can gain access to it. It arises before the choice of supplier, not after.
Shadow AIUndeclared use, and therefore use with no bounds around it. It is the main gap between what an organisation believes it does and what it actually does.

Your progress stays in this browser. No account, no data sent.

What to remember

The summary

The law does not look at the technology, it looks at the use

The same technical building block can be innocuous in one case and heavily regulated in another: what changes is what it decides on, and for whom. The right first question is therefore never “which model?” but “for what use, on what data, with what consequences for people?”.

The GDPR already applies, without waiting

Many organisations wait for regulation specific to AI before asking themselves any questions, when the personal data framework already covers most of their everyday uses. A client document pasted into an external tool is a transfer of data, with or without a new law.

What is not traced cannot be demonstrated

All these requirements converge on the same thing: being able to explain, after the fact, what was done, by whom, on what data, and why. It is a design subject, not a documentation subject: the trace is planned beforehand, it cannot be reconstructed afterwards.

Human oversight has to be real to count

Placing a person at the end of the chain is not enough if they have neither the time, nor the information, nor the power to say no. A validation that becomes a reflex is no longer oversight: it is a transfer of responsibility, and it will be seen as one.

The final quiz

3 questions · click your answer

Level 1 · Recognise

An employee pastes the write-up of a client interview into a consumer assistant to summarise it. What is this, from the point of view of data protection law?

Level 2 · Distinguish

Two departments use exactly the same model: one drafts internal emails, the other pre-screens job applications. Why do their obligations differ?

Level 2 · Distinguish

A system proposes decisions that a staff member validates in one click, several hundred times a day. Is that human oversight sound?

v2026-08 · pathCite this path