AI and data in business.
Taking an AI tool from idea to dependable use: scoping, technical choices, security, data protection and team support, without overengineering.
You are probably in one of these situations.
Most AI projects stall on data, security or adoption, rarely on the model. Those are the three points I address from day one.
- Your teams use generative AI with no shared rules.
- You want an internal assistant, but confidentiality holds you back.
- A prototype works in a demo and does not reach production.
What I actually do.
Scoping
Prioritised use cases, choice between tool, API or hosted solution, costs estimated.
Data
Quality, minimisation, hosting matched to sensitivity.
Security
LLM-specific risks handled: injection, data leakage, permissions.
Production
Tests, acceptance criteria, human oversight, drift monitoring.
Usage and training
Usage policy and team training.
Deliverables
| Ref. | Deliverable |
|---|---|
| D1 | Prioritised AI roadmap |
| D2 | Architecture and security memo |
| D3 | Data protection impact assessment, where needed |
| D4 | Test plan and acceptance criteria |
| D5 | Usage policy and training material |
Standards and acts
| AI Act (EU) 2024/1689 | Prohibited practices, transparency, AI literacy, high-risk uses |
|---|---|
| GDPR | Personal data protection |
| ISO/IEC 42001 | Artificial intelligence management system |
| ISO/IEC 23894 | AI risk management |
| OWASP Top 10 LLM | Security of LLM applications |
| ANSSI | Security recommendations for a generative AI system |
Frequently asked questions
Do we need to host a model ourselves?
Not necessarily: an API with the right safeguards is often enough. Sensitive data can justify dedicated hosting.
Does the AI Act apply to an internal tool?
Partly: whoever builds the tool is its provider. For most internal tools, that mainly means transparency and training.
A project to move forward? Let's talk.
Three lines are enough: the topic, the stage, the deadline. Reply within two business days.
Use the contact form →Please do not send confidential documentation before a non-disclosure agreement has been signed.