Free resource · Word + Excel kit

AI Project Sponsor Security and Data Kit

Is your AI project ready for launch? In 2 hours, identify its risks, mitigate them, and make an informed decision: go, go with conditions, or no go. Twelve risks explained in client-centric language, six red lines, a decision that's signed. No jargon, no fear-mongering.

📄 Word, 49 pages📊 Excel workbook, 9 tabs🇫🇷 Up-to-date with ANSSI, OWASP and IBM 2026 standards🆓 Free

Download the kitSee the twelve risks

The scene repeats itself in every large organization. The pilot project was a success, users are clamoring for more, and the committee wants a deployment date. Then the CISO asks three questions: what data will the tool be able to read, what will the agent do on its own, and what will happen if someone hijacks it? No one around the table has the answer, and the project is back to square one for another quarter of analysis, the purpose and outcome of which the sponsor doesn't understand. Conversely, other projects go ahead without anyone asking these questions, and that's often where incidents originate.

This kit provides the client with the tools to fulfill their role without becoming a cybersecurity expert: a four-step process—awareness, assessment, mitigation, and decision—that takes place over two hours with the project manager and culminates in a written decision. It does not replace the work of the CISO; it allows them to present the project to the CISO with a pre-defined project, the right questions, and clearly assigned responsibility where it belongs: with the project leader.

1. AI has changed the threat, and your project falls within its scope.

Attackers are using AI, and AI systems themselves have become targets. In February 2026, CERT-FR observed that generative AI is integrated into all stages of the attack chain (social engineering and deepfakes, malicious code, analysis of stolen data) and that AI systems are subject to attacks specific to them: poisoning of training data, backdoors in models, and prompt injection. The facts below are those on which the kit is based, along with their source and date.

Date	Fact or figure	What this changes for a sponsor
April 2023	Samsung: Engineers paste source code and internal meeting minutes into ChatGPT; the company then restricts the use of public generative AI.	Shadow AI is born from a legitimate unmet need: banning is not enough, a validated alternative must be offered.
June 2025	EchoLeak (CVE-2025-32711), discovered by Aim Security: an email containing a hidden instruction was enough for Microsoft 365 Copilot to exfiltrate internal data without any user action. Microsoft patched it server-side before publication.	Any content that the AI ​​reads (email, document, web page) is a potentially hostile input.
2025	USENIX Security, Spracklen et al.: out of 576,000 generated code snippets, approximately 19,7% of the recommended software packages did not exist; attackers then publish malicious packages under these names (slopsquatting).	Each component that the AI ​​proposes to install must be checked before use.
4th February 2026	ANSSI and CERT-FR, summary of the 2025 threat to generative AI: central recommendation to strictly compartmentalize AI systems and sensitive environments.	The compartmentalization is decided at the project scoping stage, not after deployment.
Summer 2026	IBM, Cost of a Data Breach Report 2026: global average cost of a breach of $4,99M (+12%); more than one in four organizations has suffered an attack using AI; 43% of incidents involve shadow AI, for an average cost of $5,39M compared to $4,63M; 92% of organizations affected by an AI-related incident did not have access control over their AI tools.	Costly incidents primarily stem from a lack of rules and access rights, not from exotic attacks.
28th July 2026	Veracode, 2026 GenAI Code Security Report: AI-generated code passes security tests in only 56% of cases, 44% of tasks introduce a vulnerability, and the success rate drops to 15% for cross-site scripting. "The syntax is solved, but the security is not."	No generated code goes into production without human review or automated analysis.
September 2026	OWASP GenAI Security Project: Top 10 for LLM Applications 2026, Top 10 for Agentic Applications 2026, MCP Top 10, Agent Control Standard.	Agents and connectors now have their own risk lists: these are yours as soon as the project takes action.

The kit also specifies the deadlines that apply on the day of an incident (72 hours to notify the CNIL of a personal data breach, 24 hours for early warning of an entity subject to NIS2, 15 days for a serious incident on a high-risk system as defined by the AI ​​regulation, from December 2, 2027) and the timetable of the "Omnibus AI" regulation (Regulation (EU) 2026/1744), which postponed the high-risk obligations to December 2, 2027 for Annex III and to August 2, 2028 for Annex I, reformulated Article 4 (control of AI by staff) into an obligation of means, without deferring its application, and only granted a deadline until December 2, 2026 for the marking of content provided for by Article 50 (transparency).

2. The four-step process, from awareness to decision

The kit follows a single thread, from assessment to signature. Each step has its own chapter in the Word document and its own tabs in the Excel workbook, which calculates the level of exposure, the relevance of the risks, the scores, and the decision. The yellow cells are to be filled in; the gray ones are pre-calculated.

Stage	What we do	What comes out of it
1. Become aware	Read the twelve risk fact sheets: the risk in one sentence, how it arises, a thought-provoking case, warning signs in your project, the question to ask yourself, and who should answer it.	A common vocabulary with the CISO and the DPO (tab "2 Risks")
2. Evaluate	Answer the ten questions in the project profile, filter the relevant risks, and rate each one based on severity × likelihood.	An exposure level from 1 to 4 and a heat map (tabs "1 Profile" and "3 Rating")
3. Mitigate	Choose risk-based measures with a designated person responsible, a defined effort, and a deadline; ask questions of the CISO, DPO, and vendor	A plan of measures and residual risks (tabs "4 Mitigation" and "8 Supplier")
4. Decide	Check the six red lines, apply the decision grid, and ensure you are prepared for the incident.	Go, conditional go or no go, and a decision sheet to sign (tabs "5 Red Lines", "6 Decision" and "7 Incidents")

3. The twelve risks a sponsor should know

Each risk is described in a one-page fact sheet, written for a decision-maker, not a specialist. Not all risks apply to every project: the project profile indicates which ones are relevant to yours. Here are the twelve risks, along with the question the toolkit asks you to consider.

Risque	In one sentence	The question to ask yourself
R1. Data leakage via prompts	Employees paste confidential data (contracts, code, customer data, personal data) into an AI tool which stores or reuses it.	What data will go into the tool, and where will it go?
R2. Oversharing	AI finds and summarizes documents that the user technically has access to but should not see: poorly protected HR files, salaries, reorganization plans, sites open to "everyone".	Are our access rights secure before we plug in an AI that reads everything?
R3. Shadow AI around the project	Unvalidated AI tools or agents are being used in parallel, or the project itself is slipping out of the control of the IT department.	What are my teams already using, and why?
R4. Prompt injection	A hidden instruction in an email, document, web page or ticket can hijack AI: exfiltration, unwanted actions, disinformation.	What content that the AI ​​will read is not under our control?
R5. Agent exceeding their mandate	An agent performs irreversible actions (send, delete, pay, modify) without validation, or chains tools beyond the intended scope.	What is the agent authorized to do, and who presses the button?
R6. Vulnerable generated code	Code produced by an assistant is put into production without review or analysis.	Who reviews, who tests, and how do we know if a code comes from AI?
R7. AI Supply Chain	Uncontrolled software packages, MCP servers and third-party connectors, downloaded models, AI browser extensions enter the project without oversight.	What third-party components are involved in the project, and who has verified them?
R8. Supplier and data	Data reuse for model training, non-EU location, prompt retention, subcontractors, reversibility, dependency.	Do I have the contract and written responses from the supplier on these five points?
R9. Impact Hallucination	A false but plausible answer is used for a customer, legal, financial, medical, or HR decision without human verification.	Where would an AI error really hurt, and who checks before acting?
R10. Fraud and deepfakes	Impersonation of a manager, supplier or customer by a generated voice or video, personalized phishing.	Can our validation procedures (payment, change of bank details, access) withstand a perfect voice or video?
R11. Invisible Incident	No logging of prompts, responses and actions: no one would know that a leak or diversion had taken place, nor could they prove it.	If an incident were to happen tomorrow, what would we see, and who would be notified?
R12. Non-conformity	Personal data without legal basis or information, obligations of the AI ​​regulation, regulated sectors, social dialogue forgotten.	Have my DPO and my lawyer seen the project?

4. Assess and reduce: profile, rating, measures and questions to ask

The assessment starts with the project itself, not a list of threats. Ten questions describe its profile: the data processed, the users, what the AI ​​does (read, write, recommend, act independently), the hosting, the content it reads, the code, third-party components, the impact of an error, logging, and governance. Each answer is worth 0 to 3 points; the total, out of 30, gives an exposure level from 1 (low) to 4 (critical) and indicates which risks are relevant. Each risk is then rated by severity and likelihood on a scale of 1 to 4, based on default values ​​that you adjust, and the spreadsheet places all twelve on a heat map.

To mitigate risks, the toolkit offers around sixty ready-to-implement measures, each with an assigned person, effort level, and deadline. For an agent, for example: reduced privileges, human validation before any irreversible action, a whitelist of tools and actions, a sandbox for testing, and a log of each action with an emergency stop. Two thematic guides go further: the ten rules of AI-generated code, and eight steps for preparing data before deploying a Microsoft 365 Copilot-type enterprise assistant (inventory of over-sharing, Restricted Content Discovery on sensitive sites, sensitivity labels, DLP rules, cleaning up links open to "everyone," Purview DSPM for AI, piloting a 50-person team within a defined scope, and reviewing reports before deployment).

The client doesn't have to find the answers alone: ​​they must ask the right questions to the right people. The kit provides ten for the CISO, ten for the DPO, and twenty-five for the supplier, rated out of 50 in the "8 Supplier" tab: from 40 to 50, the supplier is solid; from 25 to 39, clauses need to be negotiated before signing; below 25, it's a red line to discuss with the CISO.

5. Decide: six red lines and a go grid, conditional go, no go

The decision is not an average of scores. Six red lines apply to all projects, regardless of their size: a single failure to meet one is enough to make the decision "no go".

Red line	What must be true before the go
L1. Data	No secret, classified or sensitive data as defined by the GDPR is sent to a service that has not been qualified by the CISO and the DPO.
L2. Agents	No agent can perform an irreversible action (external sending, deletion, payment, modification of reference data) without human validation.
L3. Supplier	The supplier has committed in writing not to reuse our data to train its models, or the opt-out option is enabled and verified.
L4. Logging	Prompts, responses, and actions are logged, and someone is designated to review them.
L5. Incident	An incident response plan exists for this project: quick reference guides, contacts, notification tree.
L6. Critical Risks	Every critical risk after mitigation has a designated person responsible who accepts it in writing.

Decision	When	What follows
No go	At least one red line is not lifted, or a critical residual risk is not accepted.	Reduce the scope (less data, fewer users, read-only instead of action) or change the solution (enterprise version, EU hosting, different provider), then repeat the process.
Go under certain conditions	All red lines have been lifted, but at least one high or critical residual risk remains acceptable.	The conditions are the remaining dated measures, with a review milestone at most 90 days.
Go	All red lines have been lifted and no residual risk exceeds the moderate level.	90-day review, five indicators to monitor, reassessment with each extension of the scope.

The decision is formalized on a one-page document: exposure level, number of risks per level before and after mitigation, status of red lines, decision, conditions and deadlines, residual risks accepted and by whom, and review date. The sponsor signs it; the CISO and the DPO add their opinions.

6. Be prepared for the incident: the condition for going

An AI project isn't ready if it doesn't know what to do when something goes wrong. The kit provides six half-page quick reference guides, built on the CoSAI AI-adapted incident response cycle (detect, contain, notify, inform, learn): data leak via a prompt, prompt injection or AI hijacking, an agent acting outside its mandate, vulnerable AI-generated code discovered in production, a hallucination leading to a harmful decision, and fraud via deepfake or impersonation. It also includes a one-hour tabletop exercise before deployment, with six participants (sponsor, CISO, DPO, CIO, business stakeholders, and communications representatives), five questions to answer, and a one-page report.

Situation	Who notifies whom	Time limit
Personal data breach	The DPO notifies the CNIL (GDPR, Article 33), and the data subjects if the risk is high.	72 hours after becoming aware of it
Incident in an entity subject to NIS2	The entity informs ANSSI	Early warning within 24 hours, notification within 72 hours, final report within one month
Serious incident on a high-risk system (AI regulation, article 73, applicable from 2 December 2027)	The system provider informs the market surveillance authority	15 days; 10 days in case of death; 2 days for a critical infrastructure disruption or a large-scale breach
In all cases	Supplier, cyber insurer, management, communication; filing a complaint in case of fraud	According to the quick reference guides

7. What the kit contains

The Word document has 49 pages: the user manual, with what the kit does not replace; step 1, the twelve risk sheets; step 2, the project profile in ten questions, the filter of relevant risks and the severity × likelihood rating; step 3, the measures per risk, the ten rules of the generated code, the preparation of data before an enterprise assistant such as Microsoft 365 Copilot, the ten questions to the CISO, the ten questions to the DPO and the twenty-five questions to the supplier; step 4, the six red lines, the decision grid, the decision sheet to be signed and the "ready for incident" condition (six quick reference sheets, notification tree, table exercise); the post-go phase (90-day review, five indicators, reassessment triggers). Six annexes complete the guide: the note to the management committee ready to adapt, the thirty-point checklist, twelve frequently asked questions, the glossary of twenty-five terms, the dated sources and a page to go further.

The Excel workbook "Tools of the kit" has nine tabs, in the order of the process: "0 Instructions for use" (the process, the color legend, the warning); "1 Profile" (the ten questions in drop-down lists and the calculated level of exposure); "2 Risks" (the twelve risks and their calculated relevance); "3 Rating" (severity, likelihood, score, level and 4 × 4 heat map); "4 Mitigation" (about sixty pre-filled measures with responsible party, effort, deadline, status, and the residual per risk); "5 Red lines"; "6 Decision" (the calculated decision with its reason, then the form to be completed); "7 Incidents" (the register of incidents and notifications); "8 Supplier" (the twenty-five questions scored out of 50 and their interpretation).

The kit, part by part: what each part contains and what it's for. The templates to fill out are in the Word document and the Excel workbook.

Part 1. Why this kit

1.4 Why it's the client's business

The CISO analyzes threats, chooses protections, and monitors, but three decisions remain outside their control. The scope: what data the AI ​​can read, for which users, and whether it can act. Written acceptance of the residual risk, because no measure can eliminate risk entirely. Coordination: according to IBM, only 19% of organizations report coordination between governance and security.

Part 3. Step 2: Evaluate

From score to exposure level

The profile score, from 0 to 30, gives four levels: from 0 to 7, low, the six red lines still to be checked; from 8 to 14, moderate, the CISO and the DPO being informed at a minimum; from 15 to 21, high, the likelihood of each relevant risk being raised by one point and a restricted pilot planned before extension; from 22 to 30, critical, with a formal risk analysis by the CISO before any decision.

Four tips for getting a good rating

Rate what can reasonably happen, not the worst imaginable; rate the current situation, without the planned measures, which count in step 3 in the residual risk; justify in one line each deviation from the default value; have the rating reviewed by the CISO, who knows the past incidents and the actual state of the protections.

3.4 Read the heat map

The map places each risk in a 4x4 grid, with severity in rows and likelihood in columns, ranging from green to red. It is read starting from the top right corner, where the critical risks to be addressed first are located. The objective of step 3 is to shift the risks down and to the left: the measures primarily reduce likelihood, and sometimes severity.

Part 4. Step 3: Mitigate

For each of the twelve risks, the toolkit proposes measures with a designated person responsible and an effort level (low, medium, or high); those addressing high and critical risks are prioritized. A risk that remains critical after mitigation requires written acceptance from a designated person responsible.

R1 · Data leakage via prompts

Provide an enterprise version of the tool, publish a written "what never sticks" rule, implement sensitivity labels and DLP rules, brief all users 30 minutes before access is granted, and review usage quarterly. The rule includes six categories: personal data, identifiers and secrets, source code, unpublished financial data, strategy documents, and information subject to legal secrecy or confidentiality agreements.

R2 · Sharing

You don't connect an AI that reads everything based on access rights that no one has reviewed: inventory of sites and folders that are too open, temporary restriction of sensitive sites (Restricted Content Discovery in Microsoft 365), correction of rights by site owners with a deadline, sensitivity labels on HR, finance and management content, pilot on a specific scope before any extension.

R3 · Shadow AI around the project

Regulate rather than prohibit, in five steps: identify uses without sanction by an open declaration for 15 days, offer a validated alternative at least as good, publish a catalogue of authorized tools with a response to any request within 10 working days, detect residual uses by the network and the browser (CASB, filtering), then communicate the rule and measure.

R4 · Prompt injection

We cannot prevent an attacker from writing an email; we can limit what AI does with it. Treat all content read by AI as untrusted, limit sources to the bare minimum, prohibit automated actions triggered by read content, filter output before it reaches another system, and require the provider to describe its defenses and its remediation timeframe.

MCP Agents and Servers

The client formalizes the agent's mandate: action by action, specifying what the agent can do independently, after human validation, or never. By default, any irreversible action requires validation or is prohibited. Additional features include a dedicated account with task-specific permissions, a whitelist of MCP tools and servers registered with the IT department, a sandbox environment, a log with emergency shutdown, and a review process for each extension.

The 10 rules of generated code

Competent human review before merging, automated security analysis (SAST) and dependency analysis (SCA), no secrets in prompts or code, checking each dependency against slopsquatting, security instruction file provided to the wizard (OpenSSF), AI code tracing, targeted tests on cross-site scripting and log injection, no access to production data, enterprise version, developer training.

R7 · AI Supply Chain

Nothing enters the project without being inventoried and verified: inventory of MCP servers, extensions, models and packages; register of approved connectors, the others being blocked; verification of packages before installation; monitoring of component vulnerabilities; models and MCP servers only from sources signed or validated by the IT department.

R8 · Supplier and data

What is not written is not guaranteed: the 25-question questionnaire is returned in writing before signing; the contract provides for non-reuse of data, EU location, the retention period of prompts, notification of incident within 48 hours, audit, reversibility and deletion at the end of the contract; the supplier is reviewed annually.

R9 · Impact Hallucination

AI provides information or recommendations; beyond a certain threshold, a human makes the final decision. Map the decisions where AI intervenes (information, recommendation, decision), require human validation beyond a certain amount or impact threshold, display the sources and level of confidence, test the quality on a sample before deployment and then monthly, and train users to verify.

R10 · Fraud and deepfakes

No voice, no video, no email alone is enough to trigger a payment or access: double validation off-channel by calling back a known number, oral password or code for urgent requests from the manager, awareness of deepfakes with concrete examples, one-click reporting, semi-annual fraud attempt exercise.

R11 · Invisible Incident

See, alert, know who to call: log prompts, responses, agent actions and data access for a defined period with the DPO, set up alerts on abnormal volumes, exfiltrations and out-of-scope actions, identify an on-call contact for the tool, prepare quick reference guides and hold a tabletop exercise before the go.

4.3 The 10 questions to ask the CISO

Ten questions for a first one-hour meeting, with what a solid answer contains: analysis according to the organization's risk methodology (e.g., EBIOS RM), accessible data and rights, injection protection, logging, leak plan, agent compartmentalization, vendor evaluation, shadow AI detection, pre-production testing, and what the CISO needs from the sponsor.

4.4 The 10 questions to ask the DPO

The legal basis, the need for an impact assessment, the role of the supplier (subcontractor or joint controller), the hosting and storage of data, including prompts, the information of individuals, requests for access or erasure, the retention period of logs, automated decisions, notification to the CNIL within 72 hours and the blocking points, to be known at the scoping stage rather than on the eve of the go.

4.5 The 25 questions to ask the supplier

Questions on data, security, AI security, traceability, incidents, continuity, reversibility, compliance, agents, and governance must be submitted in writing with supporting evidence before signature: an oral answer will not count. A grade does not replace judgment: a "No" to question 1, regarding data reuse for training, carries more weight than several "Partial" answers on governance.

Part 5. Step 4: Decide

5.7 The written exercise

One hour, six participants, and a fictional scenario (leak by a provocateur or unauthorized agent) before the go-ahead: this determines whether the L5 red line is lifted. Five questions to address: how is the leak discovered and how quickly, who decides to cut and how, what data is affected, who to notify and within what timeframe, and what is communicated and to whom. The deliverable is a one-page report outlining three actions.

Part 6. After the go

6.1 The 90-day review

No later than 90 days after the go, an hour with the sponsor, the CISO, the DPO and a user representative: conditions of the go met or not, reading of the five indicators, incidents and lessons, evolution of the scope, then decision confirmed, adjusted or suspended and date of the next review.

6.2 Five indicators to monitor

The percentage of trained users, the number of incidents and reports, the proportion of agent actions validated by a human, the number of shadow tools detected and rectified, and the processing time for a tool request (commitment of 10 business days) are all metrics to be tracked. A project that receives no reports in three months is rarely an incident-free project; it's more often a project where no one knows who to report to.

6.3 When to repeat the route

Steps 2 to 4 are repeated with each expansion of the scope (especially the transition from reading to action), with each change of supplier or model, after any significant incident or public incident on a comparable tool, with each new regulation (high risk obligations of the AI Act, French law transposing NIS2), and every six months.

Appendices. Ready-to-adapt templates

Appendix A. Note to the Management Committee

A page dedicated to three decisions that fall under the committee's purview: the scope, the resources for security measures, and the acceptance of the remaining risks. It presents three IBM 2026 figures, the project evaluation with the toolkit, what the committee must arbitrate, and the cost of inaction: a shadow AI that is progressing, data leaks, and an improvised incident response.

Appendix B. 30-Point Checklist

The thirty most important measures of the kit, divided by stage. An item not checked on the eve of the go-ahead must be either a condition dated at the go-ahead, or an accepted residual risk.

8. Frequently Asked Questions

Is banning consumer AI enough?

No. According to IBM's 2026 report, the proportion of incidents involving shadow AI has doubled to 43%, with an average cost of $5,39 million compared to $4,63 million for other types of incidents. Shadow AI arises from a legitimate unmet need: the solution is to offer a validated alternative, a catalog of authorized tools, and a fast-track request process, following the principle of "regulate rather than prohibit."

Is the enterprise version of Microsoft 365 Copilot secure by default?

It's secure on Microsoft's side, but it inherits your access rights: anything a user can technically open, Copilot can retrieve and summarize. Hence the importance of addressing over-sharing before deployment. The EchoLeak vulnerability of 2025, patched by Microsoft, also demonstrated that the content read by the assistant can be malicious.

Is a no-go a failure?

No, it's a documented decision. The toolkit offers two alternatives: reduce the scope (less data, fewer users, read-only instead of actionable) or change the solution (enterprise version, EU hosting, different provider), then repeat the process. A "no go" at the scoping stage is much less costly than an incident after deployment.

Do you need a CISO to use this kit?

No: it is written for the client. But it does not replace the risk analysis of the CISO; it prepares the discussion with him, thanks to the ten questions to ask him, and the decision sheet includes his opinion alongside that of the DPO.

How does this differ from the GDPR kit?

Le sponsor's GDPR kit This kit addresses the compliance of personal data processing: legal basis, impact assessment, and informing individuals. It also covers the security of the project and all its data: leaks, prompt injection, agents, code, vendors, and incidents. The risk of non-compliance (R12) explicitly refers to the GDPR kit, to the AI Act kit and AI and Social Dialogue Kit.

And what about an agent acting alone?

This is the case where the L2 red line matters most: no irreversible action without human validation. The kit adds the fewest privileges (the agent only has the rights for their task), a whitelist of tools and actions, a sandbox for testing, a log of each action with emergency stop, and a scope review with each expansion.

Who signs the decision form?

The sponsor, because the decision rests with them. The CISO and the DPO provide their input, and each critical risk, even after mitigation, must be accepted in writing by a designated manager.

What should be done if the supplier does not respond to the questionnaire?

A lack of response is worth zero points in the "8 Supplier" tab. Below 25 out of 50 is a red line to be discussed with the CISO, and without a written commitment not to reuse the data for training, the L3 red line is not lifted.

9. Going further

This kit is the "security" counterpart to the other kits from the sponsor: the sponsor's GDPR kit for the compliance of personal data, the AI Act kit from the sponsor for AI mastery, transparency and high risk, the AI and Social Dialogue Kit for the information and consultation of staff representatives, the frugal AI kit for the project's environmental footprint and the responsible AI kit for bias, transparency, and human oversight. To identify and address unauthorized uses of AI, the Shadow AI kit It offers an anonymous survey, an aggregated technical diagnosis, and a 90-day exit plan. AI Systems Governance Kit provides the register of systems and agents on which the 90-day review and reassessments are based. Organizations that want to prepare the decision with their CISO, DPO, and business stakeholders in half a day can rely on the mission Governing your agents and the AI training in companies.

Read also : GDPR Kit for AI Project Sponsors, Sponsor's AI Act Kit: The 2026-2027 Roadmap, AI toolkit and social dialogue of the AI ​​project sponsor et AI systems governance: the 2026 toolkit.

The entire series of free kits. To drive adoption: AI charter template, AI training plan template, AI Ambassadors Kit, Manager's toolkit for dealing with AI, Adoption Roadmap Kit, AI maturity grid, AI Measurement and ROI Kit, AI Governance Kit, Gift Sets Cowork, Copilot Studio kit, Claude Skills kit et Vibe coding kitFor the AI ​​project sponsor: AI Act kit, GDPR kit, Shadow AI kit, AI and Social Dialogue Kit, frugal AI kit, AI Sovereignty Kit et responsible AI kitBy profession: AI HR kit, AI marketing kit, AI finance kit, AI kit for lawyers, AI kit for salespeople, AI toolkit for project managers, AI innovator kit et communicator's AI kit.

10. Sources

The figures and positions cited on this page and in the kit are based on the following dated sources. Information current as of October 2026.

• IBM, Cost of a Data Breach Report 2026summer 2026 (602 violations analyzed in 17 sectors, from March 2025 to February 2026).
• Veracode, 2026 GenAI Code Security Report, July 28, 2026.
• ANSSI and CERT-FR, Generative AI in the face of cyberattacks: a summary of the threat in 2025 (CERTFR-2026-CTI-001), February 4, 2026.
• ANSSI, Security recommendations for a generative AI system, April 29, 2024; ANSSI and BSI, AI Coding Assistants, October 4, 2024; ANSSI, Developing trust in AI through a cyber risk approach, February 7, 2025; ANSSI and BSI, Design Principles for LLM-based Systems with Zero Trust, August 11, 2025; ANSSI, Evaluation methods for products integrating AI (MEPIA), July 15, 2026.
• NIST, CVE-2025-32711 (EchoLeak)Microsoft 365 Copilot, June 2025, discovered by Aim Security.
• Samsung restricts the use of public generative AI after engineers pasted source code and internal meeting minutes into it, April 2023.
• J. Spracklen et al. (University of Texas at San Antonio), We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs, USENIX Security 2025.
• OWASP GenAI Security Project : Top 10 for LLM Applications 2026 (September 2026), Top 10 for Agentic Applications 2026, OWASP MCP Top 10, Agent Control Standard (September 2026).
• Coalition for Secure AI (CoSAI)AI Incident Response Framework v1.0, October 30, 2025; OpenSSF, Security-Focused Guide for AI Code Assistant Instructions, August 1, 2025.
• Microsoft, Microsoft 365 Copilot blueprint for oversharing (Microsoft Learn); CNIL, How to deploy generative AI?, July 18, 2024.
• ETSI EN 304 223, Securing Artificial Intelligence: Baseline Cyber ​​Security Requirements for AI Models and Systems, 2025; Cloud Security Alliance, AI Controls Matrix v1.1, July 2026; NIST, Cyber ​​AI Profile (IR 8596, draft), December 2025; ISO/IEC 42001 and ISO/IEC 27001 standards.
• European Union, Regulation (EU) 2016/679 (GDPR), article 33; NIS2 directive; regulation (EU) 2024/1689 on artificial intelligence, articles 4, 50 and 73, as amended by regulation (EU) 2026/1744 (“Omnibus AI”), in force on 27 July 2026.