stratops.Cyber capabilities as a service
Domain · AI security

AI uses under control, without slowing your teams.

We list how AI is used in your organisation, assess the risks of each application, and put targeted controls in place, checked as uses evolve.

Describe your needAll domains
Situations

You are in the right place if…

  • Your staff use consumer AI assistants, with no rules and no visibility.
  • You are deploying an assistant connected to your internal documents, and you do not know what it might disclose.
  • A client asks how you govern AI in your services.
  • You are building an application on a language model and want to protect it.
  • Your IT charter says nothing about AI.
Our conviction

Controls must evolve as fast as AI uses.

Banning AI does not work: uses go underground. Allowing it without a framework exposes your data, your clients and your decisions to new risks: leaks through prompts, prompt injection, wrong outputs taken as true.

We start from actual uses, not from an abstract policy. Each use gets a risk level, the matching controls, and a review date.

Our approach

From the observed use to the verified control.

A living inventory, reviewed with each new tool or application.

  1. 01List the usesTools in use, data entrusted, applications built or bought, model providers.

    You getAn inventory of AI uses

  2. 02Assess the risksFor each use: data exposed, consequences of an error, attack surface specific to AI.

    You getA map of risks by use

  3. 03Define the controlsUsage rules, configurations, data segregation, human oversight, adversarial tests.

    You getProportionate controls, use by use

  4. 04Check over timeControls are tested, and the inventory reviewed with each new use.

    You getAn up-to-date register and its evidence

What the texts say

What the texts already expect.

Without waiting for AI-specific texts, data protection applies as soon as an AI system processes personal data.

  • GDPRRGPD art. 25(1) · RGPD art. 35(1)

    The controller builds data protection in by design, and carries out an impact assessment before processing likely to result in a high risk, in particular when using new technologies.12

  • GDPRRGPD art. 32(1)

    Security measures are appropriate to the risk, taking into account the state of the art.3

  • CNIL guideGuide CNIL sécurité, fiche 24, F24-PE-03 · Guide CNIL sécurité, fiche 24, F24-PE-06 · Guide CNIL sécurité, fiche 24, F24-PE-07

    The CNIL recommends checking the quality and reliability of training data to prevent poisoning, verifying the legitimacy of users of a system offered as a service, and planning audits that include human oversight.456

  • NIS 2NIS 2 art. 21(2), point (d)

    The directive lists supply chain security, relationships with suppliers included, among the measures Member States must require of entities; on our reading, model and AI service providers are part of it.7

The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.

Our engagement

The same topic, at three levels of engagement.

You choose the level; the scope and deliverables are set by contract.

Level 01

Monitor

We keep the inventory of uses up to date and check at agreed intervals that controls are in place.

Deliverables
  • Inventory of AI uses and providers
  • Recurring configuration checks
  • Watch on new attacks targeting AI
Level 02

Advise

We assess the risks of each use and recommend controls, which you decide on.

Deliverables
  • Risk analysis by use
  • AI usage policy
  • Security review of an AI application
Level 03

Drive

We run the roll-out of controls with your teams, without making the changes in your systems.

Deliverables
  • Management of the control plan
  • Tracking of new uses and their approval
  • Evidence file for your clients and auditors
Accelerators

What we bring from day one.

Use inventory grid

A short questionnaire to list tools, data entrusted and applications, without a heavy audit.

AI-specific attack scenarios

Prompt injection, leaks through prompts, poisoning, agent hijacking: described and testable.

Workshops for your teams

With the Skill Boost option, your teams learn to use AI without exposing your data.

Frequently asked questions

Before we start.

Should consumer AI assistants be banned?

Rarely. Better to offer a governed tool, set the data that must never be entrusted to it, and check the rule is applied.

Is an impact assessment mandatory for an AI project?

The GDPR requires one before processing personal data that is likely to result in a high risk, in particular with new technologies. We help you determine whether your project falls into that case, with your data protection officer.2

What about the EU AI Act?

Depending on your uses and your role, it may concern you. The text as published applies from 2 August 2026, with its own dates for some provisions, and two obligations have applied since 2 February 2025: providers and deployers take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff, and certain AI practices are prohibited. Deployers of high-risk AI systems have their own obligations, and providers design the systems that interact directly with people so that those people know they are dealing with an AI, unless this is obvious. We map your uses against the text, and examine their applicability case by case with your legal counsel or lawyer.8910111213

Should our AI applications be tested?

Yes, those that are exposed or handle sensitive data: attempts at prompt injection, data extraction or hijacking, and a check of the guardrails. We scope these tests and help you choose the provider who carries them out, on a scope authorised in writing, then track the fixes.

Start with the inventory of your uses.

Describe your organisation’s AI tools and projects. We come back to you with a scoping proposal.

Describe your need
Sources

The excerpts quoted.

Exact text, in its original language, from the frameworks extracted from the official text.

Show the 13 excerpts quoted
  1. 1RGPD art. 25(1)32016R0679-a25-p1
    Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
    Version
    CELEX 32016R0679 — ELI reg/2016/679
    Official text
  2. 2RGPD art. 35(1)32016R0679-a35-p1
    Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
    Version
    CELEX 32016R0679 — ELI reg/2016/679
    Official text
  3. 3RGPD art. 32(1)32016R0679-a32-p1
    Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
    Version
    CELEX 32016R0679 — ELI reg/2016/679
    Official text
  4. 4Guide CNIL sécurité, fiche 24, F24-PE-03F24-PE-03
    Vérifier la qualité des données et des annotations, la présence possible de biais, la fiabilité des sources de données, notamment afin d’éviter que les données ne puissent être manipulées par un tiers (ex. : empoisonnement).
    Normative force
    recommendation (soft law)
    Source
    Guide pratique RGPD — Sécurité des données personnelles
    Version
    2024 (mise à jour 2026)
    Official text
  5. 5Guide CNIL sécurité, fiche 24, F24-PE-06F24-PE-06
    Vérifier la légitimité des utilisateurs du système lorsque celui-ci est rendu disponible en tant que service, afin d’éviter une tentative d’attaque telle qu’une attaque par inversion de modèle ou par déni de service.
    Normative force
    recommendation (soft law)
    Source
    Guide pratique RGPD — Sécurité des données personnelles
    Version
    2024 (mise à jour 2026)
    Official text
  6. 6Guide CNIL sécurité, fiche 24, F24-PE-07F24-PE-07
    Prévoir un plan d’audit du système, portant sur les éléments logiciels, matériels, et sur les mesures organisationnelles telles que les procédures de supervision humaine du système d’IA.
    Normative force
    recommendation (soft law)
    Source
    Guide pratique RGPD — Sécurité des données personnelles
    Version
    2024 (mise à jour 2026)
    Official text
  7. 7NIS 2 art. 21(2), point (d)32022L2555-a21-p2-4
    supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;
    Normative force
    EU law to be transposed (directive): not directly applicable, requires national transposition
    Source
    Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
    Version
    CELEX 32022L2555 — ELI dir/2022/2555
    Official text
  8. 8AI Act art. 11332024R1689-a113-p0
    This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . It shall apply from 2 August 2026. However:
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)
    Version
    CELEX 32024R1689 — ELI reg/2024/1689
    Official text
  9. 9AI Act art. 113, point (a)32024R1689-a113-p0-1
    Chapters I and II shall apply from 2 February 2025;
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)
    Version
    CELEX 32024R1689 — ELI reg/2024/1689
    Official text
  10. 10AI Act art. 432024R1689-a4-p0
    Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)
    Version
    CELEX 32024R1689 — ELI reg/2024/1689
    Official text
  11. 11AI Act art. 5(1)32024R1689-a5-p1
    The following AI practices shall be prohibited:
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)
    Version
    CELEX 32024R1689 — ELI reg/2024/1689
    Official text
  12. 12AI Act art. 26(1)32024R1689-a26-p1
    Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)
    Version
    CELEX 32024R1689 — ELI reg/2024/1689
    Official text
  13. 13AI Act art. 50(1)32024R1689-a50-p1
    Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. This obligation shall not apply to AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, unless those systems are available for the public to report a criminal offence.
    Normative force
    directly applicable EU law (regulation, level 1)
    Source
    Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)
    Version
    CELEX 32024R1689 — ELI reg/2024/1689
    Official text