In January 1978, the French legislature enacted the Loi Informatique et Libertés, the statute that would govern computing and data from that point on. Its first article placed four values beyond the reach of any computing system, in this sequence: human identity, human rights, privacy, and individual and public freedoms. That sequence was a choice. Human identity came before privacy because the legislators who wrote the law understood (years before the internet, mobile computing, or anything we would now call artificial intelligence) that the deeper risk of digital technology was not to personal information but to the person.
Some almost 20 years ago, working as the employers' representative for UNIDIS in national branch negotiations for the French paper industry, I found myself at a table where that law still set the terms. We were producing a "charte informatique": informatics charter governing what computer systems could legitimately know about the workers who used them, written in the shadow of Article 1. The question of what a system could record about a person was already, in French law, a question about human identity itself.
I did not have the philosophical vocabulary for it then (practitioners rarely pause to name the thing they are doing). It found me later, in the growing gap between what the technology could do and what any existing framework (legal, ethical, or contractual) could account for: systems that do not simply process information but generate, decide, and act on behalf of the human who deployed them. The stakes embedded in a 1978 law had not shrunk. They had grown into something the law's authors could not have imagined: not what the system could do to our information, but what it could do to who we are
What the French tradition offers (and this is what I find myself carrying into Australian governance conversations) is not a set of answers; it is a habit of asking what a technology does to the conditions of human self-determination before asking what it does to productivity or risk, and of treating human dignity not as a constraint on AI deployment but as the criterion by which the deployment is assessed from the outset.
This does not require importing French philosophy wholesale, or establishing a national council of techno-critics (the French solution to everything), or adding a seventh practice to the six essential practices in Australia's Guidance for AI Adoption (October 2025). It requires something simpler and harder: that the people in the room (board members, governance professionals, senior executives) arrive with a question that precedes risk exposure: what AI could do to the capacity of the people inside their organisations to remain the authors of what they do.
There is no compliance framework for that question; it falls to the person in the room.
The question itself is not new.
In 1978, a French legislature declared that computing must not undermine human identity. Generative and agentic AI have turned that declaration back into a question that Australia's governance frameworks have not yet made their own.
That question is the one I find myself reaching for first. If this article persuades anyone in that room to reach for it too, before the risk register is opened, it will have done what it set out to do.