GDPR, EDPB 01/2025 guidelines, AI Act, professional secrecy, eIDAS: the rules on one side, the proof on the other. Both are public.
Reversible, logged pseudonymisation within the meaning of Art. 4(5); a technical measure under Art. 32; a documented and owned AI Act positioning.
GDPR & AI Act (in French) →Our honest reading, point by point: separation of additional information, the singling-out criterion, what we don't cover yet.
EDPB 01/2025 (in French) →What "pseudonymise" really means in law, and how it differs from a document made unrecognisable to everyone, including you.
Best practice (in French) → What pseudonymise really means (in French) →FR2607944 (case file consistent over time, Mode 3) · FR2609690 (express lane).
Patents (in French) →Software that detects identities with AI on personal data falls under Annex III. We do not dodge the classification: we answer it article by article.
| Article | Obligation | Answer |
|---|---|---|
| Art. 6 + Annex III | High-risk classification of systems that identify people | Classification owned; AI capabilities documented, configurable, supervisable |
| Art. 12 | Automatic logging of events | Sealed log, SHA-256 hash-chained, strict numbering, retained locally |
| Art. 14 | Effective human oversight | Detections proposed, never imposed; every correction tracked; validation mandatory before AI transmission (lightened only on the express lane) |
| Art. 26 | Deployer obligations: compliant use, oversight, log retention | Two-level AI log (observed by the checkpoint / declared by the AI), signed PDF export |
| Art. 4 and 50 | Mastery of AI, transparency | Built-in help centre, manual, published doctrine of limits |
The question is not only "where is the data hosted" but "who was able to read the exhibit". Three regimes stack up, and apply before any pseudonymisation if the clear-text exhibit goes to a third party.
| Regime | Rule | Scope | Consequence for a checkpoint held by a third party |
|---|---|---|---|
| General secrecy | Art. 226-13 and 226-14 CP | Anyone bound by status, profession, function or mission | The data centre is a third party; a DPA is a contract, art. 226-13 is criminal law |
| Investigation and inquiry | Art. 11 CPP (Act 2021-1729) referring to art. 434-7-2 CP | Anyone taking part in the proceedings, including the court-appointed expert | Up to 3, 5 or 7 years depending on the case, triple general secrecy: an upload is a disclosure |
| Regulated professions | Art. 66-5 Act of 1971; art. 244 CPC; art. L.1110-4 and L.1111-8 CSP; art. L.511-33 CMF; ord. 45-2138 art. 21; CGFP L.121-6 | Lawyers, experts, physicians, bankers, chartered accountants, public officials | HDS hosting frames the host; it does not exempt the professional from their own secrecy obligation |
The coverage indices by language and by tier, the method note and the published limits live on the Proof page.
Six countries, three tiers, versioned and adversarial baselines: any regression blocks publication. What few vendors publish, together with what the proof does not prove yet.
See the measurements and the chain of proof →An RFC 3161 token from a qualified provider on the log anchor: legal presumption of date (eIDAS art. 42). Awaiting the key ceremony, stated as such.
The nine links →Art. 30 register, assisted DPIA, a processing sheet on every export: the GDPR pack is a licence module.
Request access