Risks and governance
AI Act, GDPR, algorithmic bias, hallucinations, guardrails, digital sovereignty. The vocabulary to distinguish experimentation from responsible production.
- AI ActThe AI Act is European Regulation 2024/1689, the world's first legal framework to classify AI systems by risk level and to impose differentiated obligations: prohibition for unacceptable uses, strict requirements for high-risk systems, transparency for the rest.
- AI Act for leadersThe AI Act, in force since 1 August 2024, sorts AI systems by level of risk, and the Digital Omnibus postponed the high-risk obligations until the end of 2027. This delay does not excuse a leadership team from mapping its AI uses, training people (Article 4), keeping records and naming an owner.
- AI carbon footprintThe AI carbon footprint is the set of greenhouse gas emissions related to its life cycle: model training, component manufacturing, data centre operation, and inference at usage. It is becoming a significant consumption item on a global scale.
- AI governance in the CAC 40 (2026 study)In their fiscal 2025 universal registration documents, all 40 CAC 40 companies describe uses of artificial intelligence and 38 set out an AI strategy. Yet only 19 mention an AI policy or charter, 9 say they have made it public, and 14 name an executive body in charge of steering AI (WYP.agency study, October 2026).
- AI literacy (Article 4)AI literacy means the skills, knowledge and understanding that allow people to use AI systems in an informed way and to be aware of their opportunities, risks and possible harms. Since 2 February 2025, Article 4 of the AI Act has required every organisation that provides or deploys AI to take measures to develop it among its staff, without prescribing a standard training course or a certificate.
- AI sycophancyAI sycophancy is the tendency of a generative AI model to tailor its answers to agree with the user, sometimes at the expense of accuracy. It stems partly from training on human preferences, which rewards pleasing answers more than correct ones.
- AI-generated content labelling (Article 50)AI-generated content labelling refers to the signals, machine-readable (invisible watermark, metadata) or human-readable (label, notice), showing that an image, video, audio or text was produced or altered by AI. Article 50 of the AI Act has required it since 2 August 2026: providers technically mark the outputs of their generative systems, and organisations publishing deepfakes or certain public-interest texts must disclose it.
- Algorithmic biasAn algorithmic bias is a systematic deviation in an AI model, inherited from training data, design choices, or deployment context, that produces unfair or erroneous decisions to the detriment of a population group or a type of case.
- AlignmentAlignment is the set of techniques that aim to steer the behaviour of an AI model towards the goals and human values of its user or publisher. It turns a raw model, capable of producing anything, into a useful, honest assistant that refuses requests contrary to the rules set.
- Auditing AI maturityAuditing AI maturity means measuring what is actually used, what data flows through it and what framework exists, then placing the organisation between denial, prohibition, framing and governance. Without an inventory of usage, an organisation cannot claim it controls its AI risks.
- Bringing shadow AI under controlBringing shadow AI under control means writing a readable AI policy, providing an approved and properly hosted tool, and having a person review every high-stakes output. Train before you sanction.
- DeepfakeA deepfake is an image, sound or video generated or manipulated by AI that resembles a real person, place or event and can be mistaken for authentic. In Europe, the AI Act requires such content to be disclosed as artificial. In France, Article 226-8 of the Criminal Code punishes its dissemination without consent and without a mention.
- Delegating to AI agentsAn AI agent is not a tool you launch, it is a decision you delegate. Until the delegation doctrine is written, every agent built draws the line in place of the decision-maker, and the sum of those default, scattered choices is the company's real AI policy.
- Digital OmnibusThe Digital Omnibus is a package simplifying EU digital rules, presented by the European Commission on 19 November 2025. Its AI part, Regulation (EU) 2026/1744, in force since 27 July 2026, postpones the AI Act's high-risk obligations to 2 December 2027, while its data part, which would amend the GDPR, is still under negotiation as of 14 October 2026.
- Digital sovereigntyDigital sovereignty is the capacity of a company or a state to control its data, its infrastructure, and its AI tools, independently of foreign jurisdictions. It conditions confidentiality, regulatory compliance, and resilience to access disruptions dictated by external political decisions.
- Explainable AI (XAI)Explainable AI (XAI) covers the methods that make it possible to understand why an AI system produced a given result, and to explain it to the person concerned. In Europe it is also a legal requirement: since the CJEU judgment of 27 February 2025, a person subject to an automated decision can demand an explanation of the procedure and principles actually applied.
- Frugal AIFrugal AI refers to an AI service whose necessity compared with a less resource-intensive solution has been demonstrated, which applies good practices to reduce its environmental impact, and whose uses have been questioned to stay within planetary boundaries. This is the definition of AFNOR Spec 2314, a French framework published in June 2024 and free to download.
- GDPR and AIGDPR governs all personal-data processing by an AI system operated in the European Union or targeting people located there. Four obligations apply as priorities: explicit purpose, data minimisation, access and opposition rights, and impact assessment for high-risk processing.
- GuardrailsGuardrails are technical control layers, added at the input or output of an AI model, that detect and block undesirable behaviours: malicious prompts, data leaks, forbidden content. They are distinct from alignment, which acts on the model's default behaviour itself.
- Human in the loopHuman in the loop refers to a mode of operation in which a person approves, corrects or rejects each decision of an AI system before it takes effect. It differs from human on the loop, where the AI acts alone under the supervision of a human able to intervene, and from human out of the loop, where no human intervenes during operation.
- ISO/IEC 42001ISO/IEC 42001 is the international standard, published in December 2023 by ISO and IEC, that sets the requirements for an artificial intelligence management system (AIMS): policy, roles, risk and impact assessment, controls and continual improvement. It is voluntary and certifiable, but it is not a harmonised standard under the AI Act: an ISO 42001 certificate does not create a presumption of conformity with the EU regulation.
- Making generative AI legally safeBanning generative AI pushes use into the shadows, and leaving it alone exposes the company. A written charter, a validated tool and human review of outputs cover the GDPR, the AI Act and the company's liability without slowing anyone down.
- Prompt injectionPrompt injection is an attack that slips instructions into the text an AI processes in order to hijack its behaviour: ignore its instructions, disclose data, trigger an action. Ranked the top risk for LLM-based applications by OWASP (LLM01:2025), it mainly targets assistants and agents that read external content: web pages, emails, documents, CVs.
- Red teamingRed teaming, borrowed from cybersecurity, is the practice of testing an AI system by simulating adverse usage attempts: rule bypassing, sensitive-data extraction, forbidden-content generation. It aims to identify vulnerabilities before a malicious actor exploits them in production.
- Responsible AIResponsible AI is a way of designing, buying and using AI that respects verifiable principles: fairness, respect for rights and privacy, transparency, robustness, clearly assigned accountability and environmental restraint. The international reference is the five OECD AI Principles, adopted in May 2019 and revised in May 2024.
- Shadow AI Barometer 2026In 2026, the ungoverned use of generative AI at work is no longer marginal. Two-thirds of office professionals who use AI for work have done so with a tool they believed was not permitted, and 88% have shared work information with a public AI tool: emails, meeting notes, customer data.
- Training dataTraining data is the set of texts, images, code, and other content used to train an AI model. Its composition determines what the model knows, what it ignores, its biases, and its legal risks. A major part of current AI litigation concerns their provenance and lawfulness.