State services: "Some fairly basic security measures are not being implemented"

Summary

In an interview, Éric Delisle, head of the legal department at the CNIL, explains the dual role the institution is expected to play in applying the European AI regulation (AI Act): as an authority protecting fundamental rights and as a market surveillance authority. He points out that the obligations for high-risk systems will not come into force until December 2027, but that the GDPR already applies to AI systems that process personal data, which is generating requests for guidance from companies. He also addresses cyberattacks targeting State services, pointing to the absence of basic security measures such as MFA. Finally, he advises CIOs not to rush into deploying AI projects and to favour a jointly agreed internal governance approach.

Summary based on the full text of the article.