What you risk, concretely

  1. Your company data can be handed over to foreign authorities

    An American service must hand over to the American courts the data they request, even when hosted in Europe (CLOUD Act). A Chinese service must cooperate with its country’s intelligence services. Asked under oath by the French Senate whether it could guarantee otherwise, Microsoft France answered: “No, I cannot guarantee that, but, again, it has never happened so far.”

  2. Your company depends on decisions made elsewhere

    Europe depends heavily on the United States and China: infrastructure, chips (GPUs) and most AI models, proprietary and open alike, come from these two countries. One political decision is enough to cut you off from your tool: in June 2026, Washington barred foreign users, Europeans included, from Anthropic’s most advanced models.

  3. Your company answers for it: penalty, lost customer

    If there is a leak, or a use that breaches the GDPR, your company answers to the data protection authority, your customers or your professional body: a fine, a broken contract, a lost customer. Many contracts already forbid entrusting a customer’s documents to a third party, AI services included.

What has already happened

Recent facts, with their source.

  • 2023

    Samsung bans ChatGPT for its employees

    After an engineer sent confidential source code to ChatGPT, Samsung banned these tools for its employees.

    Source: Forbes, 2 May 2023

  • January 2025

    A DeepSeek database was open to anyone on the internet

    Researchers found conversation histories and secret keys in it, with no password. DeepSeek closed it once warned.

    Source: Wiz, 29 January 2025

  • January 2025

    Italy blocks the DeepSeek app

    The Italian data protection authority blocks the app over concerns about personal data.

    Source: Verdict, 31 January 2025

  • August 2025

    ChatGPT conversations show up on Google

    Conversations shared by their users became findable on search engines. OpenAI removed the feature.

    Source: Malwarebytes, 1 August 2025

  • August 2025

    A French judge cut off from his accounts by US sanctions

    Nicolas Guillou, a judge at the International Criminal Court: Amazon, Airbnb and PayPal accounts closed, Visa and Mastercard cards disabled.

    Source: L’ADN, 22 January 2026

  • June 2026

    Washington restricts access to Anthropic’s models

    Foreign users, Europeans included, lose access to the most advanced models. The European Commission reacts.

    Source: Euronews, 14 June 2026

See six concrete situations: the risk, what you bear, otherwise the solution

These tools have real strengths: they are often ready to use and already built into your software. There is no need to change everything overnight. Here are six concrete situations: the risk, what your company knowingly bears, and the solution if it does not want to bear it. The choice is yours.

  1. Risk 1

    Another body of law applies to your data

    For an American service, the CLOUD Act and FISA allow the authorities to obtain your data from the provider, even when it is hosted in Europe, without you necessarily being told. For a Chinese service, the National Intelligence Law requires the company to cooperate with its country’s intelligence services, and the DeepSeek app stores your conversations on servers in China.

    You bear

    Having entrusted your customers’ data to a service whose law you do not control, without being able to guarantee who can access it.

    Otherwise, the solution

    Entrust your sensitive data to a European or private AI

    The free test tells you which data. Entrust it to a European AI such as Mistral, or to a private AI on your servers or in a SecNumCloud-qualified cloud. The DGSI, France’s domestic intelligence service, recommends a French or local AI. Sinovatech delivers it turnkey.

  2. Risk 2

    A service cut off overnight

    In June 2026, Washington barred foreign users, Europeans included, from Anthropic’s most advanced models. A US political decision can deprive you of a tool you depend on.

    You bear

    Your tools going down, teams blocked and customers waiting while you find another solution.

    Otherwise, the solution

    Prepare an exit route

    Export your data and documents regularly, and keep a European AI ready to take over. If a service is cut off, your business carries on.

  3. Risk 3

    Confidential documents getting out

    The DGSI reports the case of a multinational where employees translated confidential documents with a foreign consumer AI, without their management’s approval.

    You bear

    Confidential documents leaving the company, with the risk of a customer terminating its contract.

    Otherwise, the solution

    Give your teams clear rules

    A one-page policy: which data goes into which tool, and what is forbidden everywhere. Provide a company-approved tool rather than letting everyone use a free personal account, as the DGSI recommends.

  4. Risk 4

    Your conversations reused or exposed

    Depending on the plan and settings, your conversations may be used to train models or be reviewed by the provider. And a stolen account exposes the whole history: more than 100,000 stolen ChatGPT accounts were found in 2023.

    You bear

    Internal exchanges read, reused or made public, and a whole history exposed if an account is stolen.

    Otherwise, the solution

    Fix your account settings today

    Switch off training on your data, delete share links you no longer need and turn on two-factor authentication for every AI account.

  5. Risk 5

    Mistakes taken at face value

    An AI can make up a source, a figure or a court ruling, and some models are biased from their training onwards. The DGSI reports the case of a company that followed a foreign AI’s opinion of its business partners without checking it.

    You bear

    A wrong decision or piece of advice given to a customer on the strength of an AI, with the liability that comes with it.

    Otherwise, the solution

    Check before you decide

    Any answer used to decide, price or advise is reviewed by a competent person. The DGSI recommends never basing a decision on AI alone.

  6. Risk 6

    Your liability on the line

    If there is a leak, or a use that breaches the GDPR or the EU AI Act, you are the first to answer for it to the data protection authority, your customers or your professional body.

    You bear

    A fine from the data protection authority, and having to account to your customers and your professional body.

    Otherwise, the solution

    Get compliant

    Sign a data processing agreement with each provider, tell your customers and employees how you use AI, and train your teams, as the EU AI Act requires.

Our approach

That is why a French or European AI

  • One body of law: yours

    Your AI is run by a European company: your data falls under French and European law, with the GDPR as the framework. No foreign law to keep an eye on.

  • Answers for your customers

    Tenders, confidentiality clauses, prime contractors’ requirements: knowing where your data is and who can access it lets you answer without hesitation.

  • An AI that fits your business

    An open model, installed on your premises or in a qualified cloud, plugs into your documents and tools without anything leaving your perimeter. We set it up with you, turnkey.

Take the free test

See in two minutes which of your company’s data is concerned.

Are your teams already using AI?

Let’s take stock in 30 minutes: what can stay on consumer tools, what should move to a European or private AI, and the rules to give your teams.

Get in touch