A Regulator Wrote Down What Worries It About AI Agents

In late July 2026 the CNIL, France’s data protection authority, published a joint exploratory note with the Conseil de l’IA et du Numérique on agentic AI and personal data. The note is on the CNIL’s site, in French, and it is exploratory by its own description.

That last word matters. This is not guidance. It does not state regulatory expectations, it does not announce forthcoming rules, and nothing in it changes what you are obliged to do today. Anyone selling you a compliance product on the strength of it is ahead of the document.

What it is, is a regulator thinking out loud in public. Those are worth reading, because they tend to describe the shape of the eventual guidance a year or two early.

What the Note Actually Flags

The concerns cluster around four things, none of which will surprise anyone who has watched an agent work.

Processing chains you cannot see. An agent acting on your behalf touches several services in sequence, and personal data moves between them. Reconstructing which system held what, and when, is harder than with a single tool doing a single thing.

Persistent memory. Agents that retain interaction history accumulate a detailed profile over time. The note treats that accumulation as a risk rather than a feature, because retention nobody chose is retention nobody bounded.

Cascading errors. One wrong step early in a multi-step task propagates. The output looks confident either way.

Unclear allocation of responsibility. When an autonomous system acts across several providers, the GDPR roles of controller and processor become harder to assign cleanly. The note observes that existing European AI rules have not resolved this.

The note also sketches technical mitigations: memory partitioned per agent and per process with size limits and automatic expiry, sandboxed execution, filtering whenever a model is invoked, risk-tiered actions with human approval above a threshold, a user-accessible kill switch, and independent evaluation extended to cover data protection rather than capability alone.

Read as a list of questions to ask a vendor, that is a good list.

Why This Reaches You Even If You Do Not Deploy Agents

You may not run an agent. You almost certainly use software that has quietly grown one.

Email clients now summarise threads. Browsers offer to act on the page. Document tools propose edits across a folder. Each of those is a processing chain with your work text in it, and the shift from “assistant that answers” to “agent that acts” happened inside products people already had installed, without a migration or a decision.

So the inventory question is no longer “which AI tools did we approve” but “which approved tools grew agentic features since we approved them”. The mechanics are in how to run an AI tool audit for your team, and the clipboard-level version in AI browser agents and your clipboard.

The Boring Control Still Works

One of the mitigations on that list needs no vendor cooperation at all: send less.

An agent cannot mishandle a document it never received. Where a task genuinely requires an agent acting across services, that trade is sometimes worth making. Where the task is “make this paragraph less blunt”, it is not, because rewriting is a single-step operation with no need to touch anything beyond the text in front of you.

This is why Wrivio’s Local engine exists. A local rewrite runs an in-process model and makes zero network calls during the rewrite, so the text stays on the machine. That is a bounded claim about one operation, not a claim that using Wrivio makes you compliant with anything. Compliance is a property of your whole processing chain, and one tool is one link in it. The distinction is set out in which tasks should stay local.

Writing This Up for People Who Did Not Read It

The common failure after a document like this is the internal summary that overstates it. Someone reads the coverage, writes a note saying the regulator has issued requirements for AI agents, and a team spends a fortnight responding to a document that requires nothing.

Before:

The French regulator has issued new rules on AI agents. We need to review our agent usage and prepare for compliance requirements around memory, autonomy, and responsibility.

After:

The CNIL and CIANum published an exploratory note on agentic AI and personal data in late July 2026. It is exploratory, not guidance, and creates no new obligations. It flags four risk areas: opaque multi-service processing chains, persistent memory, error cascades, and unclear controller and processor roles. Suggested mitigations include memory partitioning with expiry, sandboxing, and human approval for higher-risk actions. No action required now. Useful as a vendor question list, and a likely preview of future guidance.

The second version is longer and it is the one that prevents wasted work, because it says what the document is before saying what it contains.

A Wrivio Context for summarising regulatory material could say:

Rewrite this as a factual internal note for non-lawyers. State the document’s legal status in the first sentence. Keep every regulator name, date, article reference, and defined term exactly as written. Do not convert observations into requirements, do not add deadlines, and do not add recommendations that are not in the source.

Press Ctrl+Shift+Space, paste your draft, and read the word-level diff. The specific thing to watch for is a rewrite promoting “the note observes” into “the regulator requires”. That single verb change is how an exploratory document turns into a fire drill.

What to Do Before Guidance Arrives

Three things, all cheap. Keep an inventory of tools that can act rather than only answer, and note when an existing tool gains that ability. Ask vendors the memory questions directly: what is retained, per what boundary, for how long, and can you turn it off. Decide which categories of text are allowed near an agent at all, and write that down before someone needs to ask.

For the vendor conversation, questions to ask an AI vendor about data has the version that produces contractual answers rather than reassuring ones.

This post describes a published document as of August 2026 and is not legal advice. If agentic tools process personal data in your organisation, get advice from someone qualified in your jurisdiction.

Common Questions

Does the CNIL note create new obligations for AI agents?

No. The CNIL and CIANum describe it as an exploratory note. It creates no new requirements and does not announce forthcoming guidance, so your existing GDPR and AI Act obligations are unchanged by it.

Why does persistent agent memory matter under the GDPR?

Retained interaction history builds a detailed profile over time, which raises questions about purpose limitation, storage limitation, and the lawful basis for that accumulation. The note treats it as a risk area rather than resolving it.

Who is the controller when an agent acts across several services?

The note identifies this as genuinely unclear and says European AI rules have not settled it. In practice you should establish the roles contractually with each vendor rather than assume the answer.

Is this relevant if we only use AI to rewrite text?

Less so. A single-step rewrite does not create a multi-service processing chain or persistent memory, which is why keeping simple text tasks separate from agentic tools is a reasonable boundary.

Where can I read the note?

On the CNIL’s website. It is published in French, and machine translation is adequate for the substance if you read the original alongside it for defined terms.

Download Wrivio for Windows to keep routine rewriting as a local, single-step operation instead of routing it through something that acts on your behalf.