The CNIL: Europe's most active data protection authority
The Commission nationale de l'informatique et des libertés (CNIL) has issued some of the largest GDPR fines in Europe. In 2022 alone, the CNIL fined Meta €60M for cookie consent violations and Clearview AI €20M for biometric data processing without consent. Its enforcement priorities in 2026 focus on AI systems, children's data, cookie compliance, and cross-border data transfers.
What makes France unique is that the CNIL supplements GDPR with the Loi Informatique et Libertés, which adds specific national provisions. Companies must comply with both the EU regulation and French-specific requirements, particularly around cookie consent (the CNIL requires a strict opt-in model) and employee data processing.
Sapin II and anti-corruption obligations
The Sapin II law (2016) imposes anti-corruption compliance on companies with 500+ employees or €100M+ revenue. It requires a code of conduct, internal whistleblowing procedures, risk mapping, third-party due diligence, and accounting controls. The Agence Française Anticorruption (AFA) audits compliance and can impose penalties for inadequate programs.
For tech companies, Sapin II is particularly relevant when doing business with public entities or large enterprises. Cleo automates the third-party screening component, checking suppliers and partners against sanctions lists, enforcement databases, and adverse media sources.
The Duty of Vigilance law
France was the first country to enact a supply chain due diligence law in 2017. Companies with 5,000+ employees in France (or 10,000+ worldwide) must publish a vigilance plan covering human rights, environmental risks, and health & safety across their supply chain. This pioneering legislation directly inspired the EU CS3D Directive. Cleo helps companies map their supply chain exposure and screen third parties against relevant risk databases.
How Cleo maps French regulatory compliance
Cleo's multi-agent AI pipeline scans French regulatory sources including CNIL decisions, AMF guidance, ACPR rules, and ANSSI advisories alongside EU-level frameworks. It maps which regulations apply to your specific business, identifies overlapping obligations, and alerts you when enforcement patterns change.
