Skip to content
KisunoAI
Self-host for free Get started
Pricing Docs Blog Get started Self-host for free

Agents and oversight

Agentic AI in France: three workflows, and who releases the tools

In July the French data protection authority wrote down what worries it about agentic AI: that personal data circulates between many services and that control over it is lost. Eight days later a new version appeared of the protocol through which such systems drive their tools. This article follows three workflows to show how tool permissions, sign-off and the audit log fit together, and it names the limit at which our managed operation is out for French public administrations.

Agents and oversight Reading time: 12 minutes

In brief

  • On 20 July 2026 the CNIL, France’s data protection authority, and the Conseil de l’IA et du Numérique, the country’s advisory council on AI and digital affairs, published an exploratory note on agentic AI. Presenting the note, the CNIL sums up the finding in two phrases: personal data circulating between numerous services, and a real risk of losing control over one’s own data.1
  • Eight days later, on 28 July 2026, the new specification of the Model Context Protocol appeared. It makes the transport stateless and puts the extension regime in order; managed authorisation for enterprises is kept there as an extension of its own.2
  • Only 6% of organisations are rated very well prepared for the AI Act by their own data protection officers, out of 2,390 officers surveyed.3
  • The limit, named openly: the French requirements framework for particularly sensitive state data comes from ANSSI, the national cybersecurity agency, and accepts as proof only a qualification from ANSSI or a certification issued in the EU or the EEA and recognised as equivalent by the agency. Switzerland is neither one nor the other.4

Starting point: two documents from the same July

On 20 July 2026 the Commission Nationale de l’Informatique et des Libertés, France’s data protection authority and known as the CNIL, and the Conseil de l’IA et du Numérique published a joint note on agentic AI. It describes the architecture first: an orchestrating agent, specialised agents beside it, and behind them connected services, applications, databases, search tools. The finding, as the CNIL sums it up when presenting the note, comes in two phrases. Agentic AI puts personal data into circulation between numerous services, and for the people using it a real risk arises of losing control over their own data.1 A second point comes on top of that, and it weighs more in daily operation than it sounds: because several parties take part in one automated sequence, it becomes harder to see who answers for which step.

Eight days later, on 28 July 2026, the new version of the Model Context Protocol, MCP for short, appeared. MCP is an open standard for how an AI system addresses external tools, in other words an interface: an agreed way for two programs to talk to each other. The version of 28 July 2026 makes the transport stateless. The opening handshake and the session identifier fall away, and every request carries its own protocol version, its origin and its capabilities with it. On top of that come a hardened authorisation with stricter rules for registering applications and for validating credentials, and an orderly extension regime; managed authorisation for enterprises is kept there as an extension of its own.2

The two documents are not answers to one another, and we do not present them that way. They describe the same problem from two sides. One asks who keeps control over the data in an acting system and who answers for which step. The other sets out how a single tool call is declared, authorised and passed on. Anyone who wants to answer the first question in practice ends up at the second, because control over an acting system is in the end control over its tools.

How widespread agentic AI already is in France cannot be pinned down cleanly, and the reason sits in the official statistics themselves. According to Insee Première number 2120 of 21 July 2026, 18% of French companies with ten or more employees used at least one artificial intelligence technique in 2025, surveyed among around 11,000 companies from a population of some 194,000. The methodology section carries the sentence that matters: the answers do not as a rule include use that employees run occasionally and for themselves.5 Surveys that ask employees directly therefore land on quite different figures. The Baromètre Phygital Workplace, run by Ifop on behalf of a consultancy among 1,003 employees from companies with 1,000 staff or more, gives 62% usage against 34% with formalised rules.6 Those are two questions put to two different populations, and neither figure disproves the other. Turning them into a single percentage sells a precision that does not exist. What remains is the pattern: more is used than is governed. The same Insee survey names, among the companies already using AI, 43% with concerns about data protection and privacy and 42% citing a lack of legal clarity.5

  1. A request, put by a person with a role and permissions
  2. A plan of individual steps, each step a tool call
  3. Every call checks the permissions, write access needs a separate sign-off
  4. The result, the source reference and the log entry stay with you
The path of a request. What is not released is not called, and what is called is in the audit log.

Who is affected, and what triggers the need in each case

The narrowest group is the one most often drawn too wide. The implementing decree to Article 31 of the loi SREN, the French law on regulating and securing the digital space, was issued on 14 April 2026 and names the administrations of the State, their operators and six groupements d’intérêt public listed by name, public interest groupings under French law. Local and regional authorities are not named in the decree; they therefore do not fall under this duty. Nor does every public body fall under it automatically.7 In substance the duty also bites only for data whose breach could harm public order, public security, the health or life of people, or the protection of intellectual property. Anyone reading today that the whole of France has to host sovereignly is reading in something that is not there.

On the data protection side the pressure is of a different kind, but it can be measured. For 2025 the CNIL published a record of 83 sanctions with a total of 486,839,500 euros, 78 of them fines.8 Those proceedings did not concern agentic AI, but they describe the supervision that controllers work under. Allowing a system to act in several business applications shifts no responsibility, it widens it.

The people expected to carry this in daily work say themselves that they are not there yet. In the survey by the Observatoire des DPO, run from 5 to 21 November 2025 among 2,390 data protection officers, 6% of organisations count as very well prepared for the AI Act. 27% of respondents say they know the text of the regulation well, 85% have not yet attended any training of their own on artificial intelligence.3 That the obligations for high-risk systems apply only from 2 December 2027 under Regulation (EU) 2026/1744, and from 2 August 2028 for embedded systems, buys time but does not take the work away. The survey is carried by the French employment administration DGEFP and the CNIL, together with the professional association of data protection officers and Afpa, which ran it, so it is not a vendor study but a self-report from the profession.

Who is asking What triggers the need What Kisuno contributes there
Administrations of the French State and their operators Article 31 of the loi SREN requires, for particularly sensitive data, proof through a qualification from ANSSI or a certification issued in the EU or the EEA and recognised as equivalent by the agency Only self-hosting remains here: the duty attaches to obtaining a cloud service from a private provider. The LibreChat base is MIT licensed, the repository with our own extensions follows shortly, managed operation in Switzerland is out
Local and regional authorities, hospitals and public bodies outside the decree Not covered by the duty, yet sovereignty turns up in tenders as an award criterion, often next to requirements on logging and permission management Managed operation in Lupfig or self-hosting, in both cases with permissions per tool and an exportable audit log
Data protection officers and compliance teams in companies The AI Act, the CNIL note on agentic AI, and a usage that the official statistics expressly do not capture What runs through the platform becomes visible: which user, which tool, which sign-off, what time, executed or refused
Banks, insurers and healthcare organisations Supervision of outsourcing, requirements on how health data is held, plus Article 22 GDPR for automated decisions Write access has to be released separately, so that the human step is not merely claimed but evidenced
Law firms, fiduciaries and HR departments Professional secrecy and personnel data, plus the question of which document an acting system may touch at all Permissions in the order user, role, group, server default, plus knowledge bases from your own documents with a source reference

Five groups, five different triggers, and one shared question behind them: who decides which tool an agent may call, and how can that be shown after the fact? The answer differs by group, and for one of these groups it goes against us. That stands further down in the section on the limits, and it stands there at length.

Use case 1: the case that runs across several business applications

A request comes in, and the answer is spread across three programs: the contract in the file store, the delivery status in the ERP system, the last correspondence in the mailbox. Today a person clicks through all three. The AI colleague can take over that path if the systems are connected. It plans the steps, calls the released tools one after another, checks every intermediate result and finally puts up a draft for sign-off. The point is not that it can do this. The point is that every single call can fail on a permission beforehand and stands in the audit log afterwards.

The connection runs over MCP. A connector is the single link to one particular program, an instance is the standalone installation running for your organisation. What the AI colleague is not allowed to see, it does not see: the order is user, role, group, server default. A tool that is not released for a role does not even appear in the plan, so it is not refused, it does not occur. Which software can be connected today is on the integrations page.

  1. The request as it comes in
  2. A plan of steps, each step a released tool
  3. A draft for sign-off, plus one entry per call in the audit log
Three programs, one case. What is not released does not appear in the plan.

The limit of this workflow: a permission per tool is not a permission per record. If a connector allows search across the entire file store, then it allows it across the entire file store, even when the case needs a single contract. How finely that can be narrowed depends on the connected system and not on us. Check it connector by connector before you release one broadly, and start with the smallest scope that carries the task.

Use case 2: the write access that has to be permitted separately

Reading is one half. The other begins when a system is to change a record, send a message or delete an entry. This is exactly where the platform separates: reading and writing tools are not the same permission. Write access has to be released separately, and where that has not happened, the process ends with a draft instead of a posting. That is unspectacular, and it is the difference between a proposal and an accomplished fact.

The CNIL note goes in the same direction without meaning any product. It suggests ranking the possible actions per service by risk, from reading through changing and deleting to sending data out of the system, and requiring human sign-off before execution above a certain level. Alongside that it names compartmentalising the memories per agent, a separated execution environment, and a way to stop a running process at any time.1 Translated into operation that means: the question is not whether an agent may act, but which action it may complete on its own. That setting is made by the administrators, not by the model.

  1. Reading tools, released per user, role or group
  2. Writing tools, to be released separately, otherwise it stays a draft
  3. Every execution and every refusal lands in the audit log
Two classes of tools, two decisions. The second one is made by a person.

The limit: a sign-off is only worth the attention behind it. Anyone confirming twenty times a day will end up confirming everything. Human oversight does not come about because a window opens, but because few and important steps need that intermediate step while the rest are not released at all. Making that selection is work, it belongs to your organisation and cannot be bought in. The platform does not produce human oversight, it makes it demonstrable.

Use case 3: tracing what an agent actually did

Four weeks later someone comes back with a question: internal audit, a customer, a supervisory authority, or the data subject in person. The question is similar every time. Which data was drawn on, which tool was called, released by whom, and in what order? Without a log the answer is a reconstruction from memory and screenshots. With a log it is a query.

In Kisuno every tool call is in the audit log, the running record of operations, and that log can be exported. Refused calls stand there just as executed ones do, which in an audit is often the more interesting part. This is exactly the building block the CNIL note also suggests: making visible for each executed task which personal data was drawn on, which agents were involved, which third party services were called and in what chronological order.1 How that translates into policies and responsibilities is set out under Governance.

  1. One entry per call: user, tool, time, result
  2. Refused calls are in the log just like executed ones
  3. Export for internal audit, for supervisors or for a response to a data subject
The log answers what happened. Whether it was right is answered by a person.

The limit, and it is bigger than it sounds: the log shows what ran through Kisuno. What someone does alongside it in a private account with some other provider is not in there. A tool does not create a register of all AI use in the company, it only sees its own path. This is exactly where the gap left open by the official statistics sits as well. Anyone who needs a complete picture will not get around organisational work.

The limits: where this route does not fit for France

The most uncomfortable sentence first, and it concerns us. For particularly sensitive data of the French State, Article 31 of the loi SREN requires proof, and the arrêté of 12 August 2026 approving the requirements framework allows exactly two routes: a qualification from ANSSI or a certification of the European Union or of a State party to the European Economic Area agreement that the agency recognises as equivalent.4 That framework, known as SecNumCloud, itself requires under number 19.6, for protection against non-European law, that the provider’s registered office, central administration and principal place of business be located in a member state of the Union.9 Switzerland is neither a member of the European Union nor a party to the EEA. A Swiss data centre cannot meet this requirement as things stand, however well it is run. And the requirement reaches further than location. Number 19.6 letter a concerns our registered office, letter c concerns any third company outside the Union that could technically reach the data processed in the service or the technical data.9 Anyone who has to furnish this proof therefore has to examine the model path as well: the models from OpenAI (ChatGPT) and Anthropic (Claude) run in the AWS data centre in Frankfurt, and AWS is a US company, which brings the US CLOUD Act into play. For customers with higher data-protection requirements, open frontier models such as GLM, Kimi and DeepSeek are available, operated by European companies on servers in Europe; the CLOUD Act does not apply there. That holds in self-hosting just the same if you keep the AWS path. For French public administrations that fall under this duty, our managed operation in Lupfig is therefore not the right route. What remains is self-hosting: the duty attaches to obtaining a cloud service from a private provider. If you run the software yourself, that question no longer arises for us, only for the inputs you buy yourself. The LibreChat base is MIT licensed, the repository with our own extensions follows shortly, and self-hosting costs nothing with us, as set out under Self-hosting. We would rather say this ourselves than let you find it out in a tender procedure.

So that the limit does not grow larger than it is: this duty does not apply to the public sector as a whole. The implementing decree of 14 April 2026 names the administrations of the State, their operators and six groupements d’intérêt public listed by name. Local and regional authorities are not named in the decree; they therefore do not fall under this duty, and between private companies it does not apply in any case.7 Anyone supplying the French State should nonetheless read the circulars as well: circular number 6519/SG of 5 February 2026 makes digital sovereignty the second priority objective of the State’s digital procurement, after functional performance, and takes it to include independence from non-European law with extraterritorial reach.10 Whether and how that bears on your particular case is decided by the contracting authority and not by a blog article. This article is no substitute for legal advice.

  1. What we limit: which tool is called, by whom, reading or writing
  2. What we make demonstrable: every call, every sign-off, every refusal in the log
  3. What we do not prevent: a malicious tool server and instructions hidden in content
  4. Where we are out: with a duty that requires a qualification from the EU or the EEA
Four statements, two of them uncomfortable. We would rather list them ourselves than hear them come back at us.

A second sentence is literally true and still leads astray. It is correct that no large American provider holds this qualification under its own name. Concluding from that that American technology is therefore ruled out would be wrong. Since 17 December 2025 the PREMI3NS offering from S3NS has been qualified, a joint venture of Thales and Google Cloud that builds on Google technology.11 The route through a French company that licenses the technology and takes responsibility for running it is open, and it is being taken. Anyone claiming in a tender or a sales conversation that US technology is off the table will be proved wrong. That applies to us as much as to everyone else, and it is a reason not to play that card.

One caveat belongs with the CNIL note, and we expressly let it stand. The note is exploratory. It is not a recommendation, not a guideline and not a binding framework, and it does not announce one either. It names the Model Context Protocol exactly once, in a footnote, as an example of a widespread exchange protocol, and draws no conclusion from it, neither for nor against any particular approach.1 Anyone quoting it as confirmation for a product decision is stretching it. We read it as what it is: a description of the risks the competent authority is currently working with, and a collection of building blocks that nobody has decided on yet.

Finally the technical limit, and it is the hardest. Our platform does not detect a malicious tool server. Nor does it prevent prompt injection, an instruction hidden in a document, a message or a web page that a model misreads as a task while reading it. What it does is narrower and more honest. It limits the blast radius, because a tool that is not released is not called and write access needs a second decision, and it makes the process auditable, because every call is in the log. Source references in a knowledge base likewise do not stop a model from claiming something false, they only make it checkable. An offer that promises you security at this point instead of limitation and evidence deserves a closer look; what we do and what we do not do is set out under Security and Trust. And once more, because this section has been much about law: this article is no substitute for legal advice.

Frequently asked questions about agentic AI, tool permissions and France

What does the CNIL note of 20 July 2026 say about agentic AI?

In it the CNIL and the Conseil de l’IA et du Numérique describe how agentic AI is built and which risks for personal data follow from that. Presenting the note, the CNIL sums up the finding in two phrases: that personal data circulates between numerous services, and that a real risk of losing control over one’s own data arises from it. As possible building blocks the note names, among others, traceability per task, a risk ranking of the possible actions and human sign-off before critical steps. The note is expressly exploratory and therefore neither a recommendation nor a binding framework. This article is no substitute for legal advice.

Does Kisuno meet Article 31 of the loi SREN?

In managed operation it does not, and we would rather say so ourselves. The proof can only be furnished through a qualification from ANSSI or a certification issued in the EU or the EEA and recognised as equivalent by the agency, and Switzerland belongs neither to the Union nor to the European Economic Area. For bodies that fall under this duty, what remains is self-hosting: the duty attaches to obtaining a cloud service from a private provider. The LibreChat base is MIT licensed, the repository with our own extensions follows shortly, and what that means in operation is set out under Self-hosting.

Does this duty also apply to local authorities and to private companies?

No. The implementing decree names the administrations of the State, their operators and six groupements d’intérêt public listed by name. Local and regional authorities are not named in the decree; they therefore do not fall under this duty, and between private companies it does not apply in any case. Sovereignty still turns up in tenders there, but usually as an award criterion and not as a ground for exclusion. What applies in your procedure is in your tender documents and not in this article.

What does the MCP version of 28 July 2026 change in practice?

It makes the transport stateless: the opening handshake and the session identifier fall away, and every request carries its own details with it. For operation that mainly means tool servers are easier to run behind a load balancer, because no session is tied to a particular instance. On top of that come a hardened authorisation and an orderly extension regime; managed authorisation for enterprises is kept there as an extension of its own. Which version is used in your environment is something we settle case by case. Permissions per tool and an entry in the log do not depend on any particular protocol version.

How is an agent stopped from changing or sending something?

Reading and writing tools are separate permissions. Write access has to be permitted separately, otherwise the process ends with a draft. Permissions apply in the order user, role, group, server default, and a tool that is not released does not appear in the plan. Executed and refused calls both stand in the audit log, which you can export.

Does this show us all the AI use in our company?

No, and that expectation could not be met either. What runs through Kisuno becomes visible, not what happens alongside it in private accounts. How large that gap is cannot be pinned down cleanly: the official statistics expressly do not count individual use by employees, which is why surveys among employees land on considerably higher figures than surveys among companies. A register of all the AI systems in use does not come out of this by itself, that remains organisational work.

Does this protect against prompt injection?

No. Prompt injection means that an instruction is hidden in a document, a message or a web page and a model misreads it as a task while reading. No permission management helps against that, and we do not claim otherwise. What the platform does is limit the blast radius and make the process auditable: a tool that is not released is not called, write access needs a second decision, and every call is in the log. The same goes for a malicious tool server: the platform cannot detect it, what it can do is limit the damage it causes.

What does it cost, and what is different when self-hosting?

The managed instance costs CHF 7 (EUR 7.50) per person per month, through the end of the current month with 50 percent off on a twelve-month term, that is CHF 3.50 (EUR 3.75). Testing is free and not limited in time: every new account starts with a starting credit of CHF 50 (EUR 55) for model usage, with no payment details. Operation runs in the ISO 27001 certified data centres of Green in Lupfig; that certification is the one held by the data centres and not ours. When self-hosting you determine the whole chain yourself and pay nothing for the software: the LibreChat base is MIT licensed, the repository with our own extensions follows shortly. All details are on the pricing page.

Walk through one of your own workflows

Bring a process that today runs across several programs, and we will go through it step by step: which tool, which sign-off, which entry in the log, and at which point a person decides. Or sign up and try it out yourself.

Book a live demo Get started

Sources

All figures, quotations and legal references in this article come from the following sources, last checked in September 2026. The surveys relate to different populations, and we have stated in the text in each case which one is meant.

  1. CNIL and Conseil de l’IA et du Numérique, note “IA agentique et protection des données personnelles: équation à inconnues multiples pour les utilisateurs”, published on 20 July 2026. The quoted wordings “la circulation de données personnelles entre de nombreux services” and “un risque réel de perte de maîtrise sur ses données personnelles” are in the accompanying CNIL statement; the building blocks on traceability, risk ranking and human sign-off are in section IV of the note, the mention of the Model Context Protocol in its footnote 2: cnil.fr
  2. Model Context Protocol, specification in version 2026-07-28, published on 28 July 2026, with a stateless protocol core, the removal of initialize and of the session identifier, hardened authorisation and the extensions field in the client and server capabilities: modelcontextprotocol.io. Managed authorisation for enterprises is listed as an extension of its own in the overview of extensions: modelcontextprotocol.io
  3. DGEFP and CNIL, in partnership with AFCDP and Afpa, Observatoire des DPO, 2025 survey “Les DPO à l’heure de l’IA”, run by Afpa, online questionnaire from 5 to 21 November 2025, 2,390 responding data protection officers, results published on 3 July 2026: 6% of organisations very well prepared for the AI Act, 27% with good knowledge of the text of the regulation, 85% without any training of their own on artificial intelligence: cnil.fr
  4. Arrêté du 12 août 2026 portant approbation du référentiel d’exigences relatif aux prestataires de services d’informatique en nuage, the French order approving the cloud requirements framework, Article 2 on proof through a qualification from ANSSI or a certification from the European Union or the European Economic Area that the agency recognises as equivalent; what it approves is the SecNumCloud requirements framework in version 3.2, the one footnote 9 refers to: legifrance.gouv.fr
  5. Insee, Insee Première number 2120, “Les technologies de l’information et de la communication dans les entreprises en 2025”, published on 21 July 2026 by the French national statistics office, around 11,000 companies surveyed from a population of some 194,000 companies with ten or more employees. The methodology section records that the answers do not as a rule include occasional and individual use by employees: insee.fr
  6. Ifop for Julhiet Sterwen, Baromètre Phygital Workplace 2026, 1,003 employees surveyed in French companies with 1,000 staff or more, presented in April 2026. Survey commissioned by a consultancy; the figures used here follow the reporting of the trade press: themedialeader.com
  7. Décret n° 2026-272 du 14 avril 2026 relatif à la protection des données d’une sensibilité particulière des administrations, opérateurs et groupements d’intérêt public de l’Etat traitées par un service d’informatique en nuage fourni par un prestataire privé, the implementing decree issued under Article 31 of the loi SREN of 21 May 2024; Article 1 of the decree names the six groupements d’intérêt public, Article 2 the ten areas of requirements: legifrance.gouv.fr. The list of data categories, that is public order, public security, the health or life of people and the protection of intellectual property, is in Article 31 of the loi SREN itself: legifrance.gouv.fr
  8. CNIL, record of sanctions and corrective measures for 2025, published on 9 February 2026: 83 sanctions, 78 of them fines, with a total of 486,839,500 euros: cnil.fr
  9. ANSSI, “Prestataires de services d’informatique en nuage (SecNumCloud), référentiel d’exigences”, the French cloud requirements framework, version 3.2, requirement 19.6 letter a on protection against non-European law: “Le siège statutaire, administration centrale et principal établissement du prestataire doivent être établis au sein d’un État membre de l’Union Européenne.”; letter c of the same requirement covers recourse to a third company established outside the Union and requires that it have no technical means of reaching the data processed in the service, technical data included: cyber.gouv.fr
  10. Circulaire n° 6519/SG du 5 février 2026 relative à la commande publique numérique, the French circular on digital public procurement, with digital sovereignty as the second priority objective after functional performance and independence from non-European law with extraterritorial reach as one of its components: legifrance.gouv.fr
  11. Thales, statement on the SecNumCloud 3.2 qualification for the PREMI3NS offering from S3NS, the joint venture of Thales and Google Cloud, granted on 17 December 2025: thalesgroup.com