An AI that works for you needs memory. The GDPR wants to know where it sleeps.
Stéphane Commenge, with Claude ·
The Fact
In July 2026, the CNIL and the Conseil de l'IA et du numérique (France's AI and Digital Council) published an exploratory note on AI agents. It sees a risk of the user losing control over their personal data, and almost every GDPR principle shaken up.
The Signal
An agent no longer just answers questions: it reads your emails, sorts your files, chains actions together. To do that, it retains.
The note doesn't ask us to do without memory. It asks us to keep it under control: partitioned, limited, perishable, verifiable.
The Action
Before opening your emails or files to an agent, write three lines:
1) What it can read.
2) What it can do without you.
3) What it keeps afterward.
A line left empty? You've found your first job to tackle.
Series "AI memory", episode 2
This past summer, the CNIL and the Conseil de l'IA et du numérique (CIANum) published sixteen pages on AI agents. Not exactly beach reading.
One sentence is enough to sum them up: "a loss of user control over their personal data".
I had asked myself the same question, on a smaller scale. On September 22, I wanted Mycelora to sort my own emails. I ruled out any model that doesn't run at Scaleway, the hosting provider I had chosen. Less simple. More peace of mind. Before knowing what the AI would retain, I wanted to know where that data would sleep.
An exploratory note, not a sanction
Its title: "IA agentique et protection des données personnelles : équation à inconnues multiples pour les utilisateurs" (agentic AI and personal data protection: an equation with multiple unknowns for users). The page presenting it is dated July 20, 2026. In a CIANum series, it follows a note from February and a note on cybersecurity in April.
A small aside: the note is exploratory. It sanctions no one, it forbids nothing. It also points out that the European AI Act, whose full application is planned for 2027, has no rules specific to agents. It is still uncharted territory.
An agent is an AI you no longer just ask questions. You give it tasks. Read your emails, sort your files, prepare a reply, chain actions together. To do that, it retains. That memory is what worries the note.
GDPR principles put to the test
The note goes through them. Almost all are shaken up.
Purpose limitation. A general-purpose agent does a bit of everything. The precise goal of the processing becomes blurry.
Lawfulness. The more the agent acts alone, the more the link to the legal basis stretches.
Data minimization. The agent takes your emails, your files, your history. Good luck proving what it actually needed.
Accuracy. A hallucination that enters memory doesn't stay put. It spreads from one agent to another, from one memory to another, with no alert.
Transparency. An agent's outputs are hard to explain.
Storage limitation. Memories multiply and scatter. Who knows how long each one keeps what?
Data subject rights. The user doesn't know which agent kept what. Rectifying or erasing becomes a scavenger hunt.
Automated decision-making. The note recalls the SCHUFA ruling of the Court of Justice of the European Union of December 7, 2023: a purely formal human validation is not enough.
Back to episode 1
The study "The Algorithmic Self-Portrait", accepted at the ACM Web 2026 conference, had opened up ChatGPT's memory: 96% of memories created by the AI itself, 28% containing personal data within the meaning of the GDPR. We detailed it in episode 1: what your AI remembers about you.
The study shows a memory that fills itself. The note says why that's a legal problem, not just a comfort problem.
What the note proposes
Not to do without memory. To keep it under control. Its recommendations are aimed first at designers: a memory partitioned by agent and by processing ("each agent should have a dedicated and isolated memory"), a limited size, information that expires automatically, regular replacement with more recent data, and a comparison between memories to check their consistency.
On the user side: choose the data that is accessible, choose the actions to validate, have an emergency stop button, trace each task.
The note gives no figure for duration. Principles, no time limit.
A tip, before entrusting your files
Before opening your emails or files to an agent, write three lines on a sheet of paper: what it can read, what it can do without you, what it keeps afterward. A line left empty? You've found your first job to tackle.
If a client asked you tomorrow what your AI knows about them, what would you answer? What you dictated to it, what it inferred, what it copied from an email?
What I'm building with Mycelora
Every memory tool must ask itself these questions, Mycelora included. I'm not answering in place of the CNIL. I made choices, here they are.
Filed by project. Each file has its own space. Partitioning by project, not a memory per agent, since the same memory serves several AIs.
Visible. Every memory can be read, corrected, archived. The whole thing can be exported.
Perishable. Every memory can carry its own expiry condition.
A known place. Database and functions in Paris at Scaleway, AI models at Scaleway.
The beta is open: mycelora.ai
Next episode
Context is not memory. An AI can have ten million tokens in front of it and still miss what's essential. We'll see why.
Sources
- CNIL and Conseil de l'IA et du numérique, "IA agentique et protection des données personnelles : équation à inconnues multiples pour les utilisateurs", exploratory note: cnil.fr/sites/default/files/2026-07/ia-cianum-cnil.pdf
- CNIL presentation page, dated July 20, 2026: cnil.fr/fr/ia-agentique-cnil-cianum-note
- Dash, Das, Kirsten, Wu, Karnam, Gummadi, Holz, Zafar, Zannettou, "The Algorithmic Self-Portrait: Deconstructing Memory in ChatGPT", The ACM Web Conference 2026: arxiv.org/abs/2602.01450
- Quotations from the CNIL note are our translation.