The Ministry of Labour and Solidarity, the French Association of Data Protection Correspondents (AFCDP), and the National Commission on Informatics and Liberty (CNIL) have published the results of a 2025 study on the evolution of the role of data protection officer (DPO) in the face of artificial intelligence and the AI Regulation (AI Act).

The survey, conducted by the Agency for Adult Vocational Training (Afpa), confirms the diversity of DPO profiles, with 79% working internally and 85% part-time. It reveals that 70% of organizations use or plan to use artificial intelligence, mostly generative AI systems (81%) acquired from external providers. However, AI governance remains poorly structured, with less than a quarter of entities having a formal policy and only 31% having started their preparation for the AI Act. More than half of DPOs are already involved in AI projects, which mostly process personal data.

Although the AI Act does not mention the DPO, the study shows a strong willingness among DPOs to engage with the subject: 55% of DPOs believe the regulation already falls within their scope and 71% wish to expand their missions to include compliance with this text. However, a lack of mastery is observed, with only 27% of DPOs declaring good knowledge of the regulation and 85% having received no specific training. Respondents acknowledge the need to acquire new skills and tools to address aspects of the AI Act beyond GDPR compliance. The CNIL has indicated that it will continue to support professionals on these issues.