The regulatory framework applicable to companies underwent structural changes in 2024 on three simultaneous fronts: governance of artificial intelligence, tax transparency of large groups, and the relationship between the European regulation on AI and the GDPR. We will revisit the technical points that concretely modify the obligations of legal and financial departments.
Relationship between the European regulation on AI and the GDPR: a dual compliance to organize
The regulation (EU) 2024/1689 on artificial intelligence does not replace the GDPR. Both frameworks must be applied jointly, which requires companies to maintain two distinct analysis grids for the same algorithmic processing.
Specifically, an AI system classified as high-risk under the European regulation remains subject to the requirements of legality, minimization, and security of the GDPR. Internal governance must therefore provide for a cross-mapping: each algorithmic use case is subject to an evaluation under the AI regulation (risk level, documentation obligations, human oversight) and an analysis under the GDPR (legal basis, retention period, rights of data subjects).
For companies wishing to consult the legal section of Développement Entreprise, this dual requirement is one of the topics to closely monitor throughout the year.
The difficulty lies in the overlapping areas. An AI compliance audit that neglects the personal data aspect exposes the company to sanctions on both fronts. We recommend appointing a single point of contact responsible for ensuring coherence between the two bodies of law, rather than compartmentalizing compliance and data protection functions.
CNIL Framework for Generative AI: Practical Obligations Since July 2024
The CNIL published its Q&A on the use of generative AI in businesses on July 18, 2024. This document goes beyond a reminder of general principles and delves into operational details.
Three concrete obligations emerge from this framework:
- Formally define the permitted and prohibited uses of generative AI within the organization, through a documented internal policy that is enforceable against employees.
- Choose the deployment mode (API, hosted solution, local model) based on the sensitivity level of the data processed, particularly customer, HR, or contractual data.
- Assess the need for a data protection impact assessment (DPIA) before any deployment involving large-scale personal data.
The most underestimated point concerns the management of prompts containing sensitive data. An employee submitting a client contract to a hosted model outside the EU potentially triggers a data transfer outside the framework. The internal policy must anticipate this scenario and provide for technical safeguards (input filtering, logging).
Country-by-Country Tax Reporting: Threshold and Implementation Timeline
Since June 22, 2024, groups with a consolidated revenue of 750 million euros are subject to the obligation to publish country-by-country tax reporting (CbCR public). This transposition into French law changes the landscape for the relevant legal and tax departments.
The public CbCR is not to be confused with existing tax declarations. It requires publication accessible to the general public, containing the distribution of profits, taxes paid, and workforce by jurisdiction. The reputational implications of this obligation extend beyond the traditional tax scope.
For groups close to the threshold, the issue of consolidating revenue over multiple fiscal years deserves particular attention. A one-time breach of the threshold can trigger the obligation without the possibility of retroactive regularization. The legal department must therefore integrate a forecast monitoring of consolidated revenue into its dashboards.
Points of Vigilance on the Scope
Subsidiaries located in non-cooperative jurisdictions as defined by the EU receive heightened scrutiny in reporting. The absence of substantial activity in a mentioned country may generate questions from investors or NGOs, even if formal compliance is met.
Simplification of Corporate Law: What the Texts Change in Practice
The normative simplification initiative undertaken by the Ministry of Justice directly impacts corporate law. The “clear law” projects aim to revise or repeal obsolete texts, with a stated goal: reduce administrative burden without undermining legal security.
Among the concrete developments, the dematerialization of financial securities and the creation of a single window for business creation formalities change internal processes. Legal departments that were still managing paper records or multi-window procedures must adapt their tools.
The working group on simplifying corporate law in difficulty, composed of eleven experts, is working to make collective procedures more readable. For SMEs and mid-sized enterprises, clarifying the thresholds for triggering preventive procedures (ad hoc mandate, conciliation) could alter the timeline for legal advisors’ intervention.
Formalities and Unique Business Register
The transition to the unique register concentrates the declarative steps previously spread across multiple bodies. This change reduces timelines but requires technical mastery of the new portal, whose initial malfunctions have been documented by the commercial court registries.
The year 2024 has thus laid down normative milestones whose effects will unfold over several fiscal years. Simultaneous compliance with the European regulation on AI, the GDPR, the new tax transparency rules, and corporate law reforms requires cross-functional coordination between legal, tax, and IT functions. Companies that still compartmentalize these issues expose themselves to regulatory blind spots that are difficult to rectify once controls are initiated.
