European AI regulation: a regulatory goose game?
Complying with the GDPR is a challenge for all businesses. A dedicated RGPD software allows you to automate your legal obligations, centralize the management of personal data and significantly reduce the risks of sanctions.
The European Artificial Intelligence Regulation (RIA), which has been in force since August 2024, constitutes a major advance in the regulation of digital technologies. It aims to regulate the uses of AI according to their level of risk, while guaranteeing the protection of fundamental rights and the safety of citizens.
The European AI regulation provided for the appointment of a competent national authority in each member country of the European Union on 2 August 2025. The French draft for the designation of authorities published on 9 September 2025 is based on a complex administrative architecture, based on a plural designation of competent national authorities, each responsible for a specific part of the system. This choice, which favors sectoral specialization, raises issues of coordination, readability and effectiveness for a text that no lawyer can describe as simple.
French governance: multiple authorities and roles
While the CNIL has been working on the subject since May 2023, has published good practice sheets and has already opened a dedicated service to analyze the various use cases and the various threats that this new technology could generate, the cleaver has fallen.
It is finally the DGCCRF which is expected to play the role of market surveillance authority, by ensuring the control of the AI systems put into circulation and by coordinating the actions of other regulators. La EDGE would be responsible for strategic coordination, in particular in the context of exchanges with European authorities. THEANSSI would intervene on the cybersecurity aspects of AI systems, in particular those integrated into critical infrastructures. The PerEn would provide transversal technical expertise, in particular for the evaluation of algorithms and the compliance of high-risk systems. La CNIL And theARCOM would be mobilized depending on the use case, in particular for systems involving personal data or audiovisual content.
This model, while technically relevant, could very well have been generated by a “prompt” from a myriad of meetings where everyone came to preach for their parish.
This multiplicity of regulators creates significant administrative complexity: overlaps of competences, extended processing times and legal uncertainty for economic operators.
Grey areas and concrete examples
- Biometrics : the CNIL would be competent to supervise prohibited uses (biometric identification in real time in public spaces). Authorized but high-risk uses, such as facial recognition in airports or schools, fall under a shared monitoring, without a clearly identified one-stop shop
- Critical infrastructures : ANSSI for cybersecurity, HFDS for national defense
- Industrial equipment integrating AI : DGPR for pressure or gas vessels
For businesses, understand the distribution of roles under the European AI regulation is crucial to anticipate obligations and avoid legal risks.
An approach by risk level
The European AI regulation Introduce a classification by risk level, imposing increasing obligations on suppliers and users of AI systems:
RIA challenges
Juridical
- Increased vigilance in the classification of systems
- Complete documentation of compliance with European AI regulation
Economical
- Regulation perceived as a A brake on innovation, especially for startups and SMEs
- Significant technical and administrative compliance burden, often adapted to large groups
Societal
- Objective: to establish a Trusted AI, respectful of fundamental rights and democratic values
- Depends on cooperation between national authorities, sharing of expertise and legibility of the system for economic actors
Practical implementation for businesses
In a practical and practical way, public and private organizations must get started quickly: artificial intelligence is already present in many services and departments.
Recommended steps
- Map all the use cases of AI in the organization
- Evaluate benefits and risks
- Streamline compliance
- Initiate the AI systems registry :
- List the models used
- Ensure compliance according to the role taken and the level of risk, in accordance with European AI regulation
Once organizations can answer the questions “How and why is AI being used in our country?” , they are ready to document and secure their systems in accordance with European AI regulation.
Conclusion
The implementation of RIA in France illustrates the tensions between:
- Regulation and innovation
- Specialization and coordination
- European ambition and national realities
The success of the framework will depend on the ability of the authorities to overcome administrative silos, simplify procedures and support actors towards a ethical, secure and competitive artificial intelligence, in accordance with the European AI regulation.
Article appeared in the magazine Archimag no. 388.
