Compliance and GDPR

Update November 2, 2026 — Le Chat is now Vibe. As of May 28, 2026, Le Chat has been rebranded as Vibe (still at chat.mistral.ai): a single agent for work and code, carrying over your conversations, settings, and subscriptions. The legacy Le Chat experience remains accessible in Chat mode; in Work mode, agents are now skills (invoked with @), memories serve as the knowledge base, and deep search is the Deep Research skill. Plans are now named Mistral Free, Pro, Team, and Enterprise. This lesson uses the name Vibe; note that some menus described here may have changed names or locations.

Compliance by Design

Compliance isn’t an afterthought for Mistral Enterprise: every feature and data flow is architected to meet GDPR, the European AI Act, and sector-specific regulations. This lesson targets DPOs, compliance officers, and executive leadership. Here are the guarantees you can present to an auditor, and the work that remains on your end.

Mistral AI acts as a data processor under GDPR, while your organization remains the data controller. Mistral processes data solely according to your instructions. A Data Processing Agreement (DPA) formalizes mutual obligations. You retain full control over processed data, and Mistral cannot use it to train its models. When an employee submits a client report to Vibe, your organization is accountable for that processing decision, while Mistral is accountable for compliant execution.

The legal basis rests on your organization’s legitimate interest: productivity and employee assistance. If third-party personal data is processed, your DPO must evaluate the legal basis case by case. A customer service team pasting named exchanges into Vibe faces a different scenario than a team rephrasing an internal memo.

Mistral provides tools to exercise data subject rights: the right of access via user conversation exports, the right to erasure via deletion on request (immediate under zero-retention, since nothing exists beyond the session), the right to portability via standard-format exports, and the right to object via individual access deactivation. Designate internally who will handle these requests from day one.

Data Hosting and Localization

Data is processed and stored exclusively in European Union datacenters. Primary servers are located in France with Scaleway and OVHcloud, with redundancy in the Netherlands and Germany. No transfers outside the EU occur: neither Privacy Shield nor Standard Contractual Clauses are invoked for production data. This removes the chapter that typically takes the longest to audit from your file.

These datacenters hold ISO 27001 certification for information security and SOC 2 Type II for security, availability, and confidentiality controls. Health sector deployments add HDS certification, while the most sensitive deployments are pursuing ANSSI SecNumCloud qualification (the French National Cybersecurity Agency). Request these attestations early: reviewing them occupies a substantial portion of your CISO’s workload.

The European AI Act

The AI Act, rolling out progressively since 2024, classifies AI systems by risk level. Used as a general-purpose assistance tool, Mistral Enterprise generally falls under “limited risk”: transparency obligations (users must know they are interacting with an AI), no mandatory prior conformity assessment (unlike high-risk systems), and provision of technical documentation.

This classification depends on usage, not the product itself. Deployed in regulated contexts like recruitment, credit scoring, or judicial decisions, it triggers additional obligations. Mistral provides the technical documentation required for these assessments. An HR team considering automated resume screening must address this before experimentation, not after the tool becomes habitual.

What Mistral Does and Does Not Do with Your Data

Your prompts are sent to the model in real time to generate a response. This data is never used to improve models. No third party accesses it, including Mistral partners. Under zero-retention, data is purged at the end of each session. This is the inverse of a consumer service, which is why you should ban consumer tools internally once Mistral Enterprise is live.

Certain metadata is retained even under zero-retention because the service cannot function without it: token volume for billing, session timestamps for audit logs, and user IDs for access control. Conversation content is never included in this metadata. This is the distinction you will need to explain most often internally.

Sector-Specific Requirements

In finance, deployment aligns with MiFID II compliance for decision documentation, requires interaction archiving if mandated by regulators, and imposes separation between production and test environments. In healthcare, HDS hosting is available, compliance with the Public Health Code applies, and no health data processing occurs on shared infrastructure. In the public sector, compliance with the General Security Referential (RGS) is required, SecNumCloud hosting is undergoing qualification, and the setup is compatible with the state’s “Cloud First” doctrine.

Your DPO’s Roadmap

Complete these six actions before launching the service:

Update the record of processing activities
Conduct a Data Protection Impact Assessment (DPIA) if sensitive data is processed
Sign the DPA with Mistral AI
Inform employees via an information notice
Define a retention policy adapted to your sector
Train users on best practices, starting with not entering unnecessary personal data

This last point is the hardest to enforce because no setting solves it. It requires clear, repeated instructions illustrated with examples drawn from your own business lines.

Key Takeaways

Mistral acts as a GDPR processor with a formalized DPA and a contractual commitment not to use data for training
100% EU hosting with ISO 27001, SOC 2, and HDS certifications; SecNumCloud qualification in progress
The AI Act classifies Mistral Enterprise as limited risk for general use; additional obligations apply to high-risk use cases
Your DPO must complete a DPIA and update the record of processing activities before any deployment