Artificial intelligence lawyer Paris: AI contracts and the AI Act

Yes, as soon as it uses the tool in its professional activity. Regulation (EU) 2024/1689 calls a deployer any person who uses an AI system under its own authority, only personal non-professional use being excluded (Article 3, point 4). An SME that opens a writing assistant to its teams, places a chatbot on its website or entrusts software with sorting requests falls into this category, even if it has designed no model. Its obligations then vary according to the use. Every company must avoid the practices prohibited by Article 5, which have applied since 2 February 2025 except for the prohibitions added by the 2026 regulation, which apply from 2 December 2026, and must take measures to develop AI literacy among the people who use the tool (Article 4, as worded following Regulation (EU) 2026/1744). The transparency obligations of Article 50 have applied since 2 August 2026: the deployer discloses, for example, deepfakes produced with the system; only the marking obligation borne by providers of generative systems placed on the market before that date benefits from a deadline until 2 December 2026. The obligations of Article 26, which concern compliance with the instructions for use, human oversight, monitoring and log retention, apply only to high-risk systems and will apply to those in Annex III from 2 December 2027, subject to the transitional regime of Article 111, paragraph 2, for systems already placed on the market or put into service, which are in principle affected only in the event of a significant change in their design. For an SME, each administrative fine is capped at the lower of the two amounts provided for, a percentage of turnover or a fixed sum (Article 99, paragraph 6). The firm lists the uses and ties each to the rule that governs it.

Six clauses call for careful reading. First, the description of the service, with the functions promised, the languages, the volumes and the integrations, because it is the yardstick against which non-performance will later be measured. Second, the service level: availability, recovery time, penalties. Third, the liability clause, which often sets a cap equal to a few months of fees and excludes indirect losses. Fourth, the fate of the data: can the supplier reuse the company's content to improve its models, where is it hosted, which subcontractors are involved. Fifth, the ownership and use of generated outputs, which are governed by the tool's terms of use. Last, the exit: term, notice period, return and deletion of the data.

General terms accepted by a click or referred to in the order form bind the company if it knew of them and accepted them; in the event of inconsistency, the special terms prevail (Article 1119 of the Civil Code). Negotiation therefore usefully takes the form of special terms or an amendment. If the SME envisages becoming itself the provider of a high-risk system that integrates a third party's tool, Article 25, paragraph 4, of the AI Act provides for a written agreement with that third party on the information, technical access and assistance needed for its compliance. This rule belongs to the Chapter III obligations, which apply to Annex III systems from 2 December 2027 (Article 113): it is better to anticipate it from the negotiation stage. The firm measures each clause against the actual intended use, then proposes the useful changes.

Often, yes, where the clause does not reach the core of the contract. The debtor is liable only for damage foreseen or foreseeable when the contract was concluded, except in the case of gross or intentional misconduct (Article 1231-3 of the Civil Code), and a clause that deprives the essential obligation of its substance is deemed unwritten (Article 1170). Two judgments show the dividing line. In a hosting dispute in which the backups had proved unusable, the Versailles Court of Appeal found that the host was in breach but applied the cap of three months of billing, holding that the limitation accepted "does not contradict its essential obligation" (our translation) (CA Versailles, 12e ch., 19 May 2022, No. 20/05106); the client obtained only €8,497.20 in damages, together with the annulment of an invoice. The decision goes against the client on the request to set aside the cap. Conversely, the Paris Court of Appeal deemed unwritten the clause that reduced a remote-monitoring company's commitment to an obligation of means, recalling that "Where the obligation not performed or imperfectly performed is the essential obligation of the contract, it is an obligation of result" (our translation) (CA Paris, pôle 5 ch. 11, 17 April 2026, No. 23/05693); it awarded €92,921.96. For an AI tool, everything depends on how the contract describes the essential service: availability, data security, functions advertised. The firm checks this wording before signature and, in a dispute, argues the enforceability and scope of the cap.

Rarely, and many companies overlook this point. Article 1171 of the Civil Code deems unwritten, in a standard-form contract, a non-negotiable clause that creates a significant imbalance. The commercial chamber nevertheless reserves this provision for contracts that fall outside the law on restrictive competition practices: "Article 1171 of the Civil Code, interpreted in the light of those preparatory works, therefore does not apply to contracts concluded by a person carrying on production, distribution or service activities, unless the application of Article L. 442-6, I, 2°, of the Commercial Code to those contracts is excluded by another provision" (our translation) (Cass. com., 23 September 2026, No. 24-20.775). It had already ruled to that effect on 13 May 2026 for a transport provider (Cass. com., 13 May 2026, No. 24-17.137). A software publisher or an AI service provider carries on a service activity. The SME then acts on the basis of Article L. 442-1, I, 2°, of the Commercial Code, which makes liable the party that subjects or attempts to subject the other party to obligations creating a significant imbalance, and requires it to compensate the loss. For equipment finance leasing concluded with a credit institution or a finance company, whose banking operations fall outside the law on restrictive practices, the Court of Cassation applies Article 1171, but it upheld a non-reciprocal termination clause on the ground that "the lack of reciprocity of the automatic termination clause for non-performance of the contract provided for in Article 12, a) of the general terms is justified by the nature of the obligations to which the parties are respectively bound" (our translation) (Cass. com., 26 January 2022, No. 20-16.782). The firm first identifies the status of the counterparty, then the basis actually available.

Yes, where the client is not itself a specialist. Article 1112-1 of the Civil Code requires the disclosure of decisive information that the other party legitimately does not know, and the parties can neither limit nor exclude this duty. The courts derive from it a duty of advice specific to IT contracts. The Lyon Court of Appeal recalls that "an IT service provider is bound by a duty of information and advice towards a client with no competence in the field" (our translation) (CA Lyon, 3e ch. A, 28 May 2025, No. 21/08394); it upheld the annulment of a software package contract signed without the provider having found out about the needs, while rejecting the damages claimed for economic loss. The Nanterre economic activities court held that a software publisher "had to ensure that the software was properly suited to the needs expressed, even if they were only verbal" (our translation) (TAE Nanterre, 3e ch., 27 November 2025, No. 2025F00432) and ordered termination with reimbursement of the invoices. This obligation does not relieve the client of the need to express its needs, and a written record makes them easier to prove. For an AI tool, these needs concern language, sector, data volume, confidentiality and integration with existing software. The firm helps to formalise them before signing, then relies on those documents if the tool proves unsuitable.

The choice depends on what the company can prove. If its consent was vitiated, for example by a mistake about the essential qualities of the service (Article 1132 of the Civil Code), annulment can be sought; a breach of the duty of information leads to it only if the conditions for defects of consent are met (Article 1112-1, last paragraph). The Paris Court of Appeal thus annulled the sale of a videoconferencing solution that was incompatible with the firewalls of the buyer's clients, noting that "in the absence of specifications, it was for the company Abaques to find out" (our translation) (CA Paris, pôle 5 ch. 10, 18 June 2026, No. 23/07694); it found that the finance lease that depended on it had lapsed. If the supplier did not deliver what it owed, whether the tool was unsuitable from signature or malfunctioned afterwards, the route is that of non-performance: suspension of one's own performance, price reduction, termination and damages (Article 1217), termination requiring a sufficiently serious non-performance (Article 1224). In both cases, the evidence is built during performance: tickets, dated screenshots, minutes, written exchanges. If the technical cause is disputed, an investigative measure before trial may be requested where there is a legitimate reason to preserve or establish evidence of the facts (Article 145 of the Code of Civil Procedure). The firm generally starts with a formal notice that sets out the grievances and the period for remedy.

First, what the contract provides, which must be reread before terminating, within the limits of mandatory rules. Many general terms provide for a possible export during the contract, then permanent deletion on the effective date of termination. The Paris Court of Appeal refused an expert assessment requested by a company whose backups had been deleted: the contract announced this deletion, placed no archiving duty on the provider, and the client, having been informed, had "had several months to organise, through its new provider, the transfer of all its backed-up data" (our translation) (CA Paris, pôle 1 ch. 2, 9 April 2026, No. 25/11299). The decision goes against the client, who was also ordered to pay €5,000 in procedural costs. Where the service is a data processing service within the meaning of the Data Act (Regulation (EU) 2023/2854), applicable since 12 September 2025, the contract must provide for a period of at least thirty days for retrieving the data, then their complete erasure once the switch of provider is completed (Article 25, paragraph 2, points g and h). For an AI tool, the question widens: do conversation histories, uploaded documents, settings and agents built on the platform have a usable export format? Does the supplier keep copies, and has it used them for its models? Where personal data is involved, the processing contract provides that, at the end of the service, the processor deletes or returns them, at the choice of the controller, and destroys existing copies (Article 28, paragraph 3, point g, of the GDPR). The firm has a precise reversibility clause negotiated and, at the end of the contract, organises the export before any notice is given, then checks the agreed return or deletion at the end of the service.

Often, where it processes on the company's behalf the personal data the company entrusts to it: emails, customer files, applications, recordings. The controller may then use only a processor providing sufficient guarantees, and the relationship is governed by a contract that sets out the subject matter, duration, nature and purpose of the processing, the categories of data and of individuals, and that requires the processor to act only on documented instructions, including for transfers outside the Union (Article 28 of the GDPR). The processor does not engage another processor without the controller's written authorisation. The difficulty specific to AI lies in reuse: a processor that itself determines the purposes and means of processing, in breach of the regulation, is considered a controller in respect of that processing (Article 28, paragraph 10). Settings that allow the supplier to use the company's content to improve its models therefore deserve separate scrutiny. Where a use is likely to result in a high risk to individuals, the impact assessment of Article 35 of the GDPR is required; Regulation (EU) 2026/1744 allows a deployer that is bound to carry out a fundamental rights impact assessment to refer to the relevant sections of that assessment. The firm checks the processing agreement proposed by the supplier, the reuse options and the list of sub-processors.

Where the company has at least fifty employees, the introduction of new technologies is among the matters on which the social and economic committee is informed and consulted (Article L. 2312-8 of the Labour Code). The Paris Court of Appeal upheld the suspension of an internal writing assistant and of ChatGPT until the end of the consultation, holding that "It matters little that AI tools had previously been used by the employees themselves, since no prior consultation had taken place" (our translation) (CA Paris, pôle 1 ch. 2, 21 May 2026, No. 25/13232); the employer was also ordered to pay an interim award of €5,000. The Paris judicial court, ruling under the accelerated procedure on the merits, found for the employer on another question, that of the expert: it annulled the resolution by which a CSE appointed an expert on the roll-out of Copilot, presented as a four-month trial open to volunteers, holding that "an increase in productivity cannot in itself be regarded as generating risks to the health and safety of employees" (our translation) (TJ Paris, procédure accélérée au fond, 10 February 2026, No. 25/57412). The court required the CSE to establish a major project within the meaning of Article L. 2315-94, which it had not done. The two decisions complement each other without contradicting each other. The SME is well advised to describe the tool, its uses, the posts concerned and the timetable, then to open the consultation before the tool is made available. The firm prepares this information document and the timetable for the procedure.

The classification changes when the company ceases merely to use the tool. Regulation (EU) 2024/1689 treats as a provider the party that develops, or has developed, an AI system and then places it on the market, or puts it into service, under its own name or brand, whether for consideration or not (Article 3, point 3). An SME that has a service provider build a bespoke tool from an existing model, then operates it under its own brand, may therefore become a provider. Article 25 adds three cases specific to high-risk systems: marketing under its own name a high-risk system already on the market, making a substantial modification to a high-risk system that remains high-risk, or changing the intended purpose of a system that was not high-risk, even a general-purpose one, so that it becomes so. These rules appear in Chapter III, Section 3, which will apply to Annex III systems from 2 December 2027 (Article 113). A company that connects a general-purpose assistant to the shortlisting of applications in order to offer it to its clients may fall within this last case. In such cases, the initial provider will cease to be considered the provider of that system. As worded following Regulation (EU) 2026/1744, it will have to cooperate with the new provider by making sufficient technical documentation available, informing it of known limitations and failure modes and giving it targeted technical access, unless it had clearly excluded this transformation. The contract concluded with it should therefore provide for these elements before the project. The firm reviews the classification at each change of use.

The Regulation requires neither a degree nor a certification. As worded following Regulation (EU) 2026/1744, in force since 27 July 2026, Article 4 requires providers and deployers to take measures to develop the AI literacy of their staff and of other persons who operate or use the systems on their behalf. These measures take into account each person's technical knowledge, experience and training, the context of use and the persons in respect of whom the system will be used. The text specifies that it does not require a given level of literacy to be reached by each individual. The Commission and the Member States support these efforts, in particular those of SMEs, and the Commission publishes practical examples on an information platform. In practice, an SME documents proportionate actions: an introductory session, instructions on confidential and personal data, rules for checking outputs before any external use, appointment of a point of contact. These documents are also useful before the CSE and in a dispute with a client to whom an erroneous output was sent. They show that the company supervised the use rather than merely endured it. The firm drafts the usage charter and the AI literacy plan suited to the size of the company and the tools it uses.

Yes, on two grounds. The first concerns the software or the integrated model: the Court of Cassation holds that "where its copyright has been infringed, the holder, who does not benefit from the guarantees provided for in Articles 7 and 13 of Directive 2004/48 if it acts on the basis of contractual liability, is entitled to bring an action for infringement" (our translation) (Cass. 1re civ., 5 October 2022, No. 21-15.386). Where the software is protected by copyright and exceeding the licence, whether as to the number of users, commercial use or redistribution, infringes those rights, the SME is therefore exposed to an infringement action and not only to a contractual claim. The judgment concerns a computer program; it does not rule on the protection of an AI model. The second ground concerns generated content. The urgent applications judge of the Paris judicial court ordered a host to disclose the identification data of the publisher of a video channel that broadcast an AI-generated voice presented as that of an actor, noting that it was ruling "in the absence of a special law or of European or French case law characterising, or excluding the characterisation as, reproduction of the use of performers' performances to generate a voice by artificial intelligence" (our translation) (TJ Paris, réf., 2 July 2026, No. 26/53258); the action for infringement of neighbouring rights was not manifestly bound to fail. This evidence-gathering measure does not decide the merits. For a company that produces advertisements, voices or visuals with a generative tool, prudence means checking the tool's terms of use, the authorisations of the persons reproduced and the disclosure required by Article 50 of the AI Act for deepfakes. The firm checks these points before broadcast.