Part of the AI Regulation News hub.
The CNIL has released a new version of Genmod, a demonstrator that maps the genealogy of open-weight AI models so that a model which memorised personal data can be traced to the derivative models that may also retain it
An erasure request against a model is hard enough. The CNIL is working on the question underneath it: if a model memorised someone's data and fifty models were fine-tuned from it, which of those inherited the problem, and how would anyone know.
Bottom line: Not a rule, an enforcement action or guidance. It is an updated version of a demonstrator built by the CNIL's AI department with its Digital Innovation Laboratory, first released in November 2025, which lets a user trace a model's ancestors and descendants across the open-weight ecosystem.
Who this affects: Anyone handling data subject rights requests that touch AI models, teams fine-tuning or redistributing open-weight models, and privacy counsel assessing downstream exposure from a base model.
Issue date: 26 August 2026. The original demonstrator was released in November 2025.
What changed: The tool now has an English interface, a faster graph engine, visible search progress, and a rebuilt data pipeline that refreshes the model graph weekly from public HuggingFace data, with the data update date shown in the application.
Analysis: The interesting part is the stated purpose rather than the release notes. The CNIL says the traceability is useful for studying the consequences of models memorising training data, and specifically for identifying, from a model that has memorised personal data, the other models in its genealogy that may also have retained it. That is a regulator building the evidence layer for a rights problem it has not yet resolved.
Primary sources: CNIL announcement, English · CNIL announcement, French · The Genmod demonstrator · LINC project: experimenting with rights-exercise scenarios
- Instrument
- Genmod demonstrator, updated version, with accompanying CNIL announcement
- Authority
- Commission nationale de l'informatique et des libertes, AI department with the Digital Innovation Laboratory (LINC)
- Jurisdiction
- France. The underlying rights questions are GDPR questions and are not confined to France.
- Status
- Published 26 August 2026. An experimental demonstrator, expressly described as continuing an experiment.
- Bindingness
- None. This is a tool and an announcement. It creates no obligation, states no CNIL position on the underlying legal questions, and should not be cited as guidance.
- Stated purpose
- Studying the consequences of AI models memorising training data, and facilitating study of how rights under the GDPR can be exercised
- Data source
- Public data on models and datasets available on HuggingFace, rebuilt into a graph refreshed weekly
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Primary source
- https://www.cnil.fr/en/ai-cnil-updates-its-traceability-tool-open-weights-ai-models
The problem the tool is built around
An open-weight model can be downloaded, modified, fine-tuned with new data, or combined with other models and then released again. The CNIL notes that a single model, naming Kimi K3, Mistral Medium and LLaMa as examples, can give rise to numerous derivative models.
Genmod lets a user explore those connections, tracing a model's ancestors, being the models it originated from, and its descendants, being the models it contributed to.
The CNIL states why that matters. The traceability is particularly useful for studying the consequences of AI models memorising training data, because it makes it possible to identify, starting from a model that has memorised personal data, other models in its genealogy that may also have retained this information.
It then connects that to rights: in particular, the CNIL says, this facilitates the study of how rights under the GDPR can be exercised.
Why the genealogy question is the hard part
Most published discussion of data subject rights against AI models stops at a single model: whether personal data persists in the weights, whether erasure is technically possible, and what a controller must do in response to a request.
The genealogy question sits downstream of all of that and is rarely addressed. If a base model memorised personal data and dozens of teams fine-tuned derivatives from it, the same information may persist in models held by controllers who never processed the original data set and may not know the lineage of what they deployed.
That creates a practical problem for every participant. A data subject cannot enumerate the derivatives. A controller running a fine-tuned model may not know what its base model absorbed. And a regulator assessing whether a remedy was effective has no obvious way to establish the scope of what needed remedying.
A public genealogy graph does not solve any of that. What it does is make the question empirical rather than theoretical, which is the necessary first step before anyone can say what a proportionate response looks like.
What actually changed in this release
The application is now usable in both French and English through a language toggle, which matters for a tool whose subject matter is not confined to France.
The graph exploration engine was optimised, and the CNIL reports that a search with no depth limit now takes around twenty seconds on average. The interface shows search progress and, where it can be estimated, the time remaining, and multiple searches can run at once with queue position visible during busy periods.
The data pipeline was rebuilt. A new process reconstructs the demonstrator's database from public data on models and datasets available on HuggingFace, which allows the graph to refresh weekly so that it tracks a fast-moving ecosystem. The date the data was last updated is now shown in the application.
Presentation changes round it out: the most downloaded models are prioritised in search suggestions, detailed results are sorted by download count by default, and the layout was revised for consistency across current browsers and screen sizes.
How to read this, and how not to
This is not guidance and should not be cited as though the CNIL had taken a position. The announcement is careful to describe the release as continuing an experiment around traceability of open-weight models.
It also sits inside a larger LINC project on experimenting with rights-exercise scenarios to inform the CNIL's position, which is the honest description of where this work is: informing a position not yet taken.
The practical value now is diligence. A team adopting an open-weight model can trace what it descends from, which is a reasonable input into a data protection impact assessment and into any assessment of what a base model may carry.
The forward-looking value is that a regulator is assembling the factual apparatus for lineage-based reasoning about model provenance. Where a regulator builds an evidence tool before adopting a position, the tool is usually a fair indication of the questions the eventual position will ask.
Two things are worth taking from this. First, the substantive point: the CNIL is treating model genealogy as material to data protection rights, on the stated basis that from a model which has memorised personal data one can identify other models in its genealogy that may also have retained it. If that reasoning holds, exposure from a base model does not stop at the organisation that trained it, and a team running a fine-tuned derivative inherits a question it may not know it has. Second, the status: this is a demonstrator and an experiment, not guidance, and the CNIL says so. It creates no obligation and states no position. The practical use today is diligence on what a model descends from, and the signal worth watching is that a regulator is building the evidence layer before adopting a position, which usually indicates the questions that position will eventually ask. The tool is public, and the graph now refreshes weekly from public HuggingFace data.
Source File
https://www.cnil.fr/en/ai-cnil-updates-its-traceability-tool-open-weights-ai-models
Open the CNIL announcement and confirm four things: the headline that the CNIL updates its traceability tool for open-weights AI models, dated 26 August 2026; the description of Genmod as developed by the CNIL's AI department with the Digital Innovation Laboratory and initially released in November 2025; the passage stating that the traceability makes it possible to identify, starting from a model that has memorized personal data, other models in its genealogy that may also have retained this information, and that this facilitates the study of how rights under the GDPR can be exercised; and the release notes describing the weekly refresh rebuilt from public HuggingFace data.
It makes it possible to identify, starting from a model that has memorized personal data, other models in its "genealogy" that may also have retained this information. CNIL, AI: the CNIL updates its traceability tool for open-weights AI models, 26 August 2026
FAQ
Is this a new CNIL rule or guidance?
No. It is an updated demonstrator and an announcement about it. The CNIL describes it as continuing an experiment, it states no position on the underlying legal questions, and it creates no obligation.
What does Genmod actually do?
It maps the genealogy of open-weight AI models, letting a user trace a model's ancestors, being the models it originated from, and its descendants, being the models it contributed to.
Why does the CNIL connect this to data protection?
Because of training data memorisation. The CNIL says the traceability makes it possible to identify, from a model that has memorised personal data, other models in its genealogy that may also have retained that information, which in turn facilitates study of how GDPR rights can be exercised.
What changed in this version?
An English interface alongside French, a faster graph engine with unlimited-depth searches taking around twenty seconds on average, visible search progress and queue position, a rebuilt pipeline refreshing the graph weekly from public HuggingFace data with the update date displayed, and presentation improvements.
Where does the data come from?
Public data on models and datasets available on HuggingFace, reconstructed into the graph the demonstrator uses.
Does this mean derivative models inherit legal exposure?
The CNIL does not say that, and this tool does not decide it. What the CNIL says is that models in a genealogy may also have retained memorised information, which is a factual proposition the tool helps investigate rather than a legal conclusion.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.