Your developers produce faster with coding assistants and agents. We identify the risks specific to these workflows and put suitable controls in place, without curbing productivity.
A coding assistant produces in seconds what a developer wrote in an hour, flaws included. An agent acting in your repositories holds rights no intern would have. Controls designed for a human pace no longer keep up.
So we adapt controls to this new pace: rules on the data entrusted, limited rights for agents, automatic checks in the delivery pipeline and human review focused where it matters.
We start from how your teams actually use AI, tool by tool.
You getA map of development workflows
You getRisks ranked by workflow
You getVerified controls in the tools and the pipeline
You getIndicators shared with the team
The texts do not tell code written by a human from code produced by an AI: development requirements apply to both.
Financial entities test and approve systems before use, including the quality of software developed internally, with source code reviews covering static and dynamic testing.12
The manufacturer of a product with digital elements exercises due diligence when integrating third-party components, including open source; on our reading, this also covers dependencies an assistant suggests.3
The directive lists security in system development and maintenance among the measures Member States must require of entities.4
The CNIL recommends complete tests before each release, no secrets in version control, and a code review or non-regression test before any move to production.567
The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.
You choose the level; the scope and deliverables are set by contract.
At agreed intervals, we check the configuration of tools and agents, and that automatic controls run.
DeliverablesWe assess your development workflows and recommend rules and controls, which you decide on.
DeliverablesWe support the roll-out of controls with your teams, without making the changes in your systems.
DeliverablesExcluded data, protected secrets, limited agent rights: a starting configuration for Claude Code and Codex, with what it takes to deploy it across the fleet and verify that it applies.
Analyses of secrets, dependencies and code, blocking where needed, to plug into your CI/CD.
With the Skill Boost option, your developers learn to review generated code effectively and spot its typical flaws.
No. They bring a real gain. But you need tools and settings that protect your code and secrets, and controls adapted to the volume produced.
Its author does not review it with the same attention, and it reproduces common patterns, flaws included. Hence the value of automatic analyses and targeted human review.
The minimum needed: dedicated branches, no merge without human review, no access to production secrets, logged actions. We set these rules with you.
They are necessary, not sufficient. A configuration file the user can edit protects nothing; a setting deployed to workstations does not apply to sessions started in the cloud; and the same option is not enforced the same way on Windows, WSL and macOS. So we verify each setting by attempting what it should forbid.
Yes, after review. An extension (skill, MCP server, plugin) acts with the agent’s rights. Before installation, we look at what it reads, runs and downloads, and whether its safeguards actually hold what they claim.
Yes, to analyse and write faster. Each output is reviewed by an expert before it reaches you, and we apply to our own tools the rules we recommend to you.
Describe your development tools and how they are used. We come back to you with a scoping proposal.
Exact text, in its original language, from the frameworks extracted from the official text.
32024R1774-a16-p2Financial entities shall develop, document, and implement an ICT systems’ acquisition, development, and maintenance procedure for the testing and approval of all ICT systems prior to their use and after maintenance, in accordance with Article 8(2), point (b), points (v), (vi) and (vii). The level of testing shall be commensurate to the criticality of the business procedures and ICT assets concerned. The testing shall be designed to verify that new ICT systems are adequate to perform as intended, including the quality of the software developed internally. Central counterparties shall, in addition to the requirements laid down in the first subparagraph, involve, as appropriate, in the design and conduct of the testing referred to in the first subparagraph:32024R1774-a16-p3The procedure referred to in paragraph 2 shall contain the performance of source code reviews covering both static and dynamic testing. That testing shall contain security testing for internet-exposed systems and applications in accordance with Article 8(2), point (b), points (v), (vi) and (vii). Financial entities shall:32024R2847-a13-p5For the purpose of complying with paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product with digital elements, including when integrating components of free and open-source software that have not been made available on the market in the course of a commercial activity.32022L2555-a21-p2-5security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;F11-PE-06Réaliser des tests complets (ex. : unitaires, d’intégration, fonctionnels, de sécurité) avant la mise à disposition ou la mise à jour d’un produit. Lors d’une mise à jour, s’assurer que les tests utilisés sont toujours adaptés.F11-PE-08Veiller à l’absence de secrets (d’authentification ou de chiffrement) lors du dépôt de code dans un outil de gestion de versions (ex. : Git ou svn). Changer les secrets lors du passage en production.F11-PE-09Effectuer un test de non-régression et/ou une revue de code avant tout passage en production d’une mise à jour pour éviter l’apparition de sources de violation de données personnelles.