Hugging Face has landed one of three spots in the CNIL’s new Enhanced Support program, beating out more than 40 candidates for direct guidance from France’s data protection authority. The program targets companies with “strong potential for economic development” that need help navigating GDPR obligations — a recognition that AI development and privacy compliance are increasingly tangled in ways regulators can’t ignore.
The selection isn’t a surprise if you’ve tracked Hugging Face’s record on privacy. The company hosted the BigScience Workshop, a collaboration with hundreds of researchers across multiple countries, which became the first large language model training effort to make privacy a visible priority. They tackled it from three angles: data selection and governance, data processing, and model sharing. More recently, the BigCode project co-hosted with ServiceNow built pseudonymization tools that other teams can now reuse.
For Hugging Face, the CNIL partnership is partly about turning internal best practices into something the broader ML community can follow. The company frames it as a way to “push GDPR compliance forward and provide clarity for our community of users” — a real gap right now. Most developers working with open models have little practical guidance on what compliance looks like at each stage of the AI pipeline.
The broader context here matters. As EU regulators ramp up scrutiny of AI systems under GDPR and the incoming AI Act, platforms that host models and datasets sit in an awkward middle ground. Hugging Face’s willingness to tackle privacy head-on — rather than litigate first and comply later — puts it in a different category from some US counterparts. Whether this regulatory goodwill translates into a competitive advantage remains to be seen, but for European developers it signals that compliance help is finally coming from someone who actually builds the technology.
