GDPR and AI: what CNIL really asks of SMEs

GDPR does not wait for an “AI project”. It applies as soon as a person is identifiable in what you type, paste, or index. A quote, a CV, an email thread: that is already the regulation.

CNIL has said plainly to micro-businesses and SMEs: the company is data controller. Not the intern. Not OpenAI. You.

We already told what happens when you paste a client file into ChatGPT. Here is the other side: what to do before it happens.

What CNIL really says (not LinkedIn)

Three official documents are enough. Not a €400/h firm.

1. The SME factsheets (France Num / CPME / CNIL): do not enter confidential, personal, or strategic data into a consumer tool.
2. The FAQ on deploying generative AI: if you put client data or sensitive docs in, prefer on-premises. A US cloud API is the opposite: you control almost nothing.
3. Recommendations on developing AI systems: purpose, legal basis, minimisation. Useful even if you train nothing — because your prompt often trains the vendor.

The EU AI Act (chatbot transparency, etc.) moves forward in 2026. GDPR has been there since 2018. You do not survive by waiting for the next text.

The Monday-morning checklist

Not a 40-page register. Five lines an office manager can hold.

Question	If the answer is “no”
Have we written down what may go into a chatbot?	People paste. It is human.
Do client / HR / health data stay out of consumer tools?	You are already in uncontrolled processing.
Do we know who the vendor is, where it runs, whether prompts retrain the model?	Reread the terms. Then change tool.
Does a human review before sending to the client?	Hallucination is your signature.
Can we erase or stop processing if a client asks?	Access / erasure rights: that is you, not the chatbot.

That is GDPR in an SME. Not “€20 million”. It is: being able to explain to CNIL, and to your client, what you did with their data.

Transfer outside the EU: the “it is encrypted” trap

A US tool with a datacenter in Frankfurt does not cancel the CLOUD Act. CNIL reminds: if data can leave the EU (parent company, support, logs), you need framework. “We ticked the GDPR box in settings” is not a framework.

What we offer, concretely

CNIL says: personal data or sensitive docs → on-premises, rather than an API whose keys you no longer hold.

That is AroBox’s job: index and files at your premises; inference on private Arobass infrastructure in France; drafts to validate. 15-day trial, quote-based offer. DPA and contract separately — we do not play magic certificate.

This is not legal advice. For a specific case: your counsel, or cnil.fr.

Request a trial — we install, scope the indexed perimeter, and ChatGPT paste is no longer the team’s plan B.