Menu

Free test

Which AI for your data?

Every AI has an operator, and so a body of law that applies to your data. Tick what you or your teams would like to entrust to an AI: for each type of data, you see which AI fits, what deserves attention and what good practice looks like. Your answers never leave your screen.

  • American or Chinese AI

    ChatGPT, Copilot, Gemini, Claude, the DeepSeek app… Often very capable and ready to use. The company running the service remains subject to the law of its country, whatever the contract and wherever the data is hosted.

  • European AI

    A service run and hosted in Europe by a European company, and so under European law: Mistral, or the AI offerings of Scaleway, OVHcloud and IONOS. The model itself can come from elsewhere, even from China.

  • Private AI

    An open model (Mistral, Llama, Qwen, DeepSeek…) running on your servers or in a SecNumCloud-qualified cloud, without your data ever leaving it.

Communication and knowledge

  • Any AI

    What deserves attention: AI can make up facts with total confidence.

    Good practice: Proofread before publishing.

  • Any AI

    What deserves attention: AI may quote an outdated version of a standard or make up a legal provision.

    Good practice: Check the source before relying on the answer.

  • Any AI

    What deserves attention: A “non-confidential” text often contains a customer’s name or a figure.

    Good practice: Reread it before pasting.

  • Any AI

    What deserves attention: Add “on our side, server X running version Y” and the question becomes a map of your system for an attacker.

    Good practice: Keep it generic: no server names, addresses or versions.

Internal documents

  • European AI

    What deserves attention: By default, most free AI services train on your conversations. And a service run outside Europe remains subject to the law of its country, even on a business plan: its authorities can request your documents.

    Good practice: A European AI, with training switched off in the settings: this is possible even on the free plan.

  • European AI

    What deserves attention: A share link can become public: in 2025, shared ChatGPT conversations showed up in search engines.

    Good practice: A European AI, training switched off, no names or sensitive figures, and no share links.

  • European AI

    What deserves attention: In 2023, a Samsung engineer sent confidential source code to ChatGPT. Samsung then banned these tools for its employees.

    Good practice: A European or private AI, training switched off, and never any keys or passwords in the code.

Data about people

  • European AI

    What deserves attention: A few cross-referenced details are enough to identify a customer: failed anonymisation is still a personal data leak.

    Good practice: Make sure the anonymisation is real, then use a European AI.

  • European AI

    What deserves attention: With a service run outside Europe, this data remains subject to the law of its country, even when hosted in Europe. And if it leaks, you are the one accountable to the data protection authority.

    Good practice: A European AI on a business plan, with a GDPR-compliant data processing agreement.

  • Private AI

    What deserves attention: A fine from the data protection authority and serious harm to the person concerned.

    Good practice: A private AI, with a certified health data host for health data (HDS in France), and a GDPR impact assessment before any processing.

Secrets and contracts

  • Private AI

    What deserves attention: One stolen account is enough: the history becomes a catalogue of your secrets. More than 100,000 stolen ChatGPT accounts were found in 2023.

    Good practice: A private AI, in a SecNumCloud-qualified cloud, or only on your own servers if your sector is sensitive.

  • Private AI

    What deserves attention: Breach of contract: penalties and a lost customer, even if nothing leaked.

    Good practice: Reread your contracts: most forbid passing these documents on to a third party, AI services included.

  • Private AI

    What deserves attention: Your prices in a competitor’s hands after an account is compromised, or requested by the authorities of the operator’s country when it is outside Europe.

    Good practice: A private AI, in a SecNumCloud-qualified cloud, or only on your own servers if your sector is sensitive.

Access

  • Never

    What deserves attention: The secret is copied into a history you no longer control.

    Good practice: Never, in any AI. Already done? Change it right away.

Going further

Are your teams already using AI?

Let’s take stock in 30 minutes: what can stay on consumer tools, what should move to a European or private AI, and the rules to give your teams.

Get in touch