The CNIL has already issued over 50 million euros in fines in 2026: what it signals for AI
Free fined 42 million euros, France Travail fined 5 million: the CNIL showed in Q1 2026 that it enforces for real. Its new AI powers change the picture.
More than 50 million euros in fines had already been issued by the CNIL over the first quarter of 2026, with particular attention paid to personal data processing, subcontracting, and data transfers. Two sanctions stood out especially this year, Free, fined 42 million euros, and France Travail, fined 5 million euros, both for specific security failures, missing multi-factor authentication and overly broad access rights to sensitive databases.
These amounts concern large organizations, and an SMB might reasonably feel far removed from this level of risk. That would be an incomplete reading of the situation. The failures sanctioned, missing strong authentication, poorly controlled access rights, are not mistakes specific to large organizations, they are configuration oversights found just as often in much smaller structures, simply with less media visibility when caught.
What changes the picture for 2026 and beyond is the CNIL's new role. It has been designated the reference authority for enforcing the AI Act in France, cementing its status as a central player in digital regulation and granting it expanded oversight powers over artificial intelligence. These new powers push the ceiling for possible sanctions to 35 million euros or 7% of global turnover, a level that in theory applies to any company, with no size threshold.
The CNIL's 2025-2028 strategic plan sets four priority areas, artificial intelligence, protecting minors, cybersecurity, and everyday digital uses. For 2026, the focus specifically targets auditing AI systems and multi-factor authentication for access to sensitive databases, exactly the two failures that cost Free and France Travail a combined 47 million euros. Artificial intelligence and data scraping now rank among the regulator's new priority enforcement areas.
This context concretely changes the nature of the risk for an SMB using AI tools with no documented framework. No past inspection guarantees anything for the future, especially in an environment where the regulator has explicitly made AI a priority and demonstrated, within the first quarter alone, its willingness to impose heavy sanctions for failures found. An SMB connecting an AI tool to its customer data or HR files, without checking who can access it and under what authentication level, exposes itself to the same kind of failure sanctioned at Free and France Travail.
Two simple checks, drawn directly from these sanctions, let an SMB reduce its exposure without mobilizing a substantial compliance budget. The first is enabling multi-factor authentication on any access to a database holding sensitive information, customer, HR, financial. The second is limiting access rights to only those who genuinely need it for their role, rather than granting broad access for management convenience.
This is what the framing step should now explicitly incorporate, a review of access rights and authentication for every AI tool connected to sensitive data, drawing directly on the failures sanctioned by the CNIL as a concrete checklist rather than a generic theoretical one. A five-business-day diagnostic checks your access rights and authentication before any audit.
Frequently asked questions
How much in fines had the CNIL already issued in Q1 2026?
More than 50 million euros, including a 42-million-euro sanction against Free and a 5-million-euro sanction against France Travail, both tied to security failures, missing multi-factor authentication and overly broad access rights.
What do these sanctions have to do with artificial intelligence?
The CNIL has been designated the reference authority for enforcing the AI Act in France, cementing its central role in digital regulation. Its new AI powers push possible sanctions up to 35 million euros or 7% of global turnover.
Do these sanctions only concern large companies like Free or France Travail?
The most publicized amounts do concern large organizations, but the underlying obligations, access security, authentication, apply to any company processing personal data, regardless of size.
What are the priority areas of the CNIL's 2025-2028 strategic plan?
Four priority areas, artificial intelligence, protecting minors, cybersecurity, and everyday digital uses, with a specific 2026 focus on auditing AI systems and multi-factor authentication for sensitive databases.
Should an SMB worry about these sanctions if it has never had a CNIL inspection?
No past inspection guarantees nothing for the future. AI and data scraping are now among the CNIL's new priority enforcement areas, and SMBs using AI tools with no documented framework are exposed just like anyone else.
What basic security obligations should an SMB check first?
Multi-factor authentication for access to sensitive databases and limiting access rights to only those who genuinely need them, the exact two failures behind the Free and France Travail sanctions.
Do these sanctions change how an SMB should approach its AI tools?
They confirm the regulatory risk is no longer theoretical. Documenting AI uses, securing access to the data they handle, and checking permissions become concrete priorities rather than abstract recommendations.
Which step of an AI project helps anticipate this kind of risk?
The Framing step should incorporate a review of access rights and authentication for each AI tool connected to sensitive data, using the failures sanctioned by the CNIL as a concrete checklist.