Law 1.565 in practice: what it means for AI in a Monaco company
Monaco’s data-protection law applies to almost every AI system a company uses, because an inbox assistant reads personal data by definition. The practical duties (purpose, description, minimisation, security, rights) and how a well-built system meets each one. Not legal advice.
We are builders, not lawyers, and your counsel has the last word. But we build under this law every week, and here is what it asks of a system in practice.
It applies to you
Law 1.565, aligned with European standards and supervised by the APDP, governs the processing of personal data in Monaco. An assistant that reads your inbox processes names, addresses and sometimes much more; a system that extracts data from invoices processes supplier contacts. There is no AI exemption and no small-company exemption. The good news: the duties are concrete and a well-built system meets them by design.
Purpose and minimisation
Each processing needs a stated purpose and should use no more data than the purpose needs. In practice: the assistant is given access to the mailboxes and folders the task needs, and nothing else; it extracts the fields the task needs, and nothing else. “Give the AI everything and see what it finds” is both bad engineering and a breach.
Description, security, rights
You must be able to describe the processing: what data, for what, where it goes, for how long, who can see it. We write that description for every system and hand it to you; your counsel or DPO decides which formality it triggers. Security means access control, a vault for secrets, EU hosting by default, and contracts with the model providers that exclude training and retention. Rights mean that when a person asks what you hold on them, the log and the data in your own tools let you answer.
The public chatbot problem
The most common breach we see is not a built system; it is an employee pasting a client email into a free chatbot to get a reply. The data leaves Monaco, may be retained and may be used for training, with no purpose, no description and no control. A half-day training and a written rule fix this faster than any technology, and an assistant inside the company’s own tools removes the temptation.
Two questions.
Do you act as our DPO?
No. We write the technical description and build the controls; your DPO or counsel owns the compliance decisions.
Is EU hosting enough for Monaco?
Monaco’s framework treats EU transfers favourably; the description names the location and the contractual terms so your counsel can confirm for your case.
Related.
AI and Monaco’s data-protection law
Monaco’s data-protection law of 3 December 2024 (Law 1.565), supervised by the APDP, applies to every automation that reads an email, a file or a calendar. This page is how we build so that it does, in plain words. It is practical guidance, not legal advice.
AI and compliance in Monaco
Monaco has its own data-protection law, its own authority, and a demanding anti-money-laundering framework for its regulated professions. None of it forbids AI. All of it shapes how an AI system must be built. This page says how, in plain words.
AI training for teams in Monaco
Most AI training is a tour of tools. Ours is a working session: your team brings the emails, documents and reports they struggle with, and leaves with a way of handling each one, and the rules for what must never go into a public chatbot.
Start with a 30-minute call. Keep what it finds.
You tell us where the hours go. We tell you which two or three tasks to automate first, in a short written note. Free, in English or French.