---
title: "State services: \"Some fairly basic security measures are not being implemented\" — Marsanne Studio AI watch"
description: "The head of CNIL's legal department details the authority's role in implementing the AI Act and advises CIOs on AI projects."
url: "https://marsanne.studio/en/ai-watch/state-services-some-fairly-basic-security-measures-are-not-being-4445c5/"
lang: "en"
---

[Marsanne Studio](https://marsanne.studio/en/)

[← Back to home](https://marsanne.studio/en/ai-watch)

[← The AI watch](https://marsanne.studio/en/ai-watch)

Interview · 3 September 2026

# State services: "Some fairly basic security measures are not being implemented"

Original title, in French: “Services d’État : “Certaines mesures de sécurité assez basiques ne sont pas mises en œuvre””

**Publication**

Alliancy (France)

**Author**

Aude Brès

**Published on**

3 September 2026 · read in the page structured data

## Summary

In an interview, Éric Delisle, head of the legal department at the CNIL, explains the dual role the institution is expected to play in applying the European AI regulation (AI Act): as an authority protecting fundamental rights and as a market surveillance authority. He points out that the obligations for high-risk systems will not come into force until December 2027, but that the GDPR already applies to AI systems that process personal data, which is generating requests for guidance from companies. He also addresses cyberattacks targeting State services, pointing to the absence of basic security measures such as MFA. Finally, he advises CIOs not to rush into deploying AI projects and to favour a jointly agreed internal governance approach.

Summary based on the full text of the article.

[Read the article on Alliancy →](https://alliancy.fr/services-detat-certaines-mesures-de-securite-assez-basiques-ne-sont-pas-mises-en-oeuvre-7b7c8e1b-e4a5-42d5-9a64-976fa4c9a417)

## Figures cited

-   321 inspections
    
    number of inspections carried out by the CNIL in 2024
    
    France, 2024
    
    > « 321 contrôles et 87 sanctions en 2024 »
    
-   87 sanctions
    
    number of sanctions imposed by the CNIL in 2024
    
    France, 2024
    
    > « 321 contrôles et 87 sanctions en 2024 »
    
-   20,000 complaints
    
    number of complaints received by the CNIL in 2025
    
    France, 2025
    
    > « environ 20 000 en 2025, +1000 à 1500 par an »
    
-   160 staff
    
    CNIL headcount in 2018
    
    France, 2018
    
    > « nous sommes passés d'environ 160 agents à près de 300 »
    
-   300 staff
    
    current CNIL headcount
    
    France, today
    
    > « nous sommes passés d'environ 160 agents à près de 300 »
    

## Classification

**Country**

France

**Company size**

All sizes

**Industries**

Government and local authorities · All industries, or industry not specified

**Companies**

CNIL (cited)

**Keywords**

ai act, gdpr, cnil, cybersecurity, ai governance, compliance

Entry written by Marsanne Studio from the cited article, with the help of an AI model (claude-sonnet-5). The rights to the article and its illustrations belong to Alliancy and its author. Entry translated from French by Claude Sonnet 5.5.