CNIL's AI Guidance for Schools — Renewed Data-Protection Partnership with France's Ministry of National Education

CNIL, France's independent data-protection authority, has run a long-standing partnership with the Ministry of National Education on digital literacy. As generative AI tools spread rapidly among teachers and school administrators, questions accumulated over what the GDPR and the EU AI Act require when a class, teacher, or school uses a chatbot or an AI grading aid. CNIL has also flagged that minors are 'more vulnerable and less aware of risks,' which shaped the cautious tone of the guidance.

The initiative aims to clarify data-protection obligations for teachers and school data controllers as generative AI adoption grows in classrooms. It seeks to steer schools toward vetted, GDPR-compliant resources rather than ad hoc use of commercial AI tools, and to ensure institutional (not individual teacher) accountability for AI-related data processing.

On 20 June 2025, CNIL published two practical FAQs: one for teachers, setting out do's and don'ts such as prioritising vetted resources accessed through GAR, avoiding delegation of grading decisions to AI, and not relying on AI-detection tools it considers unreliable; and one for school leadership and data controllers, clarifying that the institution bears legal responsibility, that a Data Protection Officer must be consulted, and that parents and students must be informed with a right to object. On 16 December 2025, CNIL President Marie-Laure Denis and the Ministry's Secretary-General Édouard Geffray renewed the CNIL-Éducation nationale partnership, covering digital-citizenship education, GDPR compliance support for schools, and cooperation on digital education at European and international level.

The guidance is precautionary and procedural rather than evaluative: CNIL does not test or certify the pedagogical value of any specific AI tool. Neither the FAQs nor the partnership renewal disclose figures on how many schools, teachers, or students have been reached, or on compliance rates achieved since publication.