Meeting in plenary on Thursday, 5 November 2026, the CNIL College had included in its agenda the presentation of the note"IA Agent and Personal Data"written with the Council for AI and Digital (CIANum). The same session included a paper on fully automated individual decisions (Article 22 GDPR).
The note itself is not new: the CNIL I posted on 20 July 2026, presenting it as anote exploratoire. It is therefore neither a recommendation nor a reference, but a state of the French regulator's reflection on agents.
What concerns the regulator
According to CNIL, the switch from general AI to agent AI, able to act in place of its user, "marks a scale change" for personal data. Three mechanisms have been identified:
- the flow of data between the many services to which an agent is connected (messagery, calendar, business tools, etc.);
- the persistent and historical memory of exchanges, which favour very detailed user profiles;
- dilution of responsibilities between the players in the chain, and the extension of cybersecurity risks to all connected services.
The advanced tracks
The note proposes, from a legal point of view, enhanced transparency rules on what the agent does and mandatory human validation for the most critical decisions. Technically, it evokes the partitioning of agents' memory to avoid data accumulation, their deployment in isolated environments, and an emergency shutdown button left to the user. It also notes that the European AI Regulation does not provide specific rules for agents.
What it changes for your uses
In concrete terms, before connecting an agent to his mailbox or accounts, it is reasonable to limit access to the strict necessary, to know where his memory is stored and to keep hands with any action that engages money or a person. This is the logic we follow in the prompts offered on iadujour.fr: the agent prepares, the human valid before sending or payment.