Master your risks, prove your compliance
Risk analysis, GDPR compliance, ISO 27001 and ISO 42001 certification. We turn your regulatory obligations into a competitive advantage.
- Risk Analysis
- GDPR Compliance
- SO 27001 Certification
- AI Governance
- Audit & Gap Analysis
- Documentation & Policies
Three frameworks, one unified expertise
Each standard addresses distinct challenges. We master their articulation to avoid redundancy and maximize the value of every compliance project.
GDPR requires any organization processing EU citizens' data to guarantee its protection. Non-compliance exposes to severe financial penalties and lasting reputational damage.
- Data processing mapping
- Processing register drafting / audit
- Data Protection Impact Assessment (DPIA) for sensitive processing
- Privacy policy & legal notices
- Data breach management procedures
- Sub-processor contract audit (DPA)
- Team training on GDPR reflexes
The world's leading standard for information security. It structures your organization's security governance through an auditable ISMS, a guarantee of trust for your clients and partners.
- Gap analysis vs ISO 27001:2022
- ISMS scope definition
- Risk analysis and treatment (ISO 27005)
- ISMS policy, procedures and policies drafting
- Risk treatment plan (POA&M)
- Internal compliance audit
- Certification audit preparation
The first international standard for AI management systems (published in 2023). It governs the development and responsible use of AI: transparency, bias, algorithmic governance.
- Inventory of AI systems in use
- AI risk assessment (bias, opacity, security)
- AI system governance policy
- Alignment with the European AI Act
- Human oversight procedures (HITL)
- Required technical documentation
- ISO 42001 certification preparation
Know where you really stand
Before any compliance project, we conduct an objective assessment of your current situation. Not to scare you, to build a realistic, prioritized plan.
-
Structured questionnaire
Interviews with business, IT and management stakeholders covering the 93 ISO 27001 controls and GDPR obligations.
-
Gap mapping
Clear visualization of compliant, partial and non-compliant areas with scoring per control and per domain.
-
Prioritized roadmap
Sequenced action plan over 3, 6 and 12 months with estimated effort, indicative cost and impact on residual risk level.
End-to-end support
We don't just deliver documents, we accompany you all the way to certification or operational compliance.
Which standard for which challenge?
The three frameworks complement each other and share synergies. Our integrated approach saves you from duplicating efforts.
| Criteria | GDPR | ISO 27001 | ISO 42001 |
|---|---|---|---|
| Legal obligation in EU | ● Mandatory | ○ Voluntary | ○ Voluntary* |
| Main focus | Personal data protection | Information security | AI system governance |
| Penalty for non-compliance | Up to 20 M€ or 4% of turnover | Loss of certification | AI Act risk (forthcoming) |
| Certification available | ○ No (compliance) | ● Yes (third-party audit) | ● Yes (third-party audit) |
| Analyse des risques requise | ● DPIA | ● ISO 27005 | ● AI risks |
| Synergies with other standards | Strong with ISO 27001 | Strong with GDPR & ISO 42001 | Strong with ISO 27001 |
| Time to compliance | 3 to 6 months | 6 to 18 months | 6 to 12 months |
| Who is concerned | Any org. processing EU data | Any organization (voluntary) | Any org. using or developing AI |
* The European AI Act makes certain AI obligations mandatory depending on the risk level of systems.
ISO 42001: The standard governing responsible AI
Published in December 2023, ISO 42001 is the first international standard for artificial intelligence management systems. It arrives as the European AI Act imposes new obligations on organizations using or developing AI systems.
Why you are likely concerned
If your organization uses AI-based tools, even market SaaS solutions, you are potentially within the scope of the AI Act and ISO 42001.
- You use ChatGPT, Copilot or similar tools
- You have scoring or recommendation algorithms
- You automate HR, credit or access decisions
- You develop AI features for your clients
- Your clients or contractors are subject to the AI Act
- You want to differentiate on ethical AI
Your sector has its own obligations
Regulatory requirements vary by industry. Our expertise covers the most exposed sectors.
Deliverables that stay with your teams
We produce actionable documents, not audit reports stored in a drawer. Each deliverable is designed to be maintained and evolve with your organization.
Gap analysis report
Detailed assessment of your current compliance level by domain, with scoring, gap visualization and action prioritization. Executive + technical format.
GDPR processing register
Complete and up-to-date register of personal data processing, with legal bases, retention periods, sub-processors and security measures, ready for a CNIL inspection.
AI governance file
AI system inventory, AI Act classification, ethical use policies, human oversight procedures, the foundation of your ISO 42001 compliance.
ISMS & security policies
Information Security Policy and its thematic policies (access control, classification, incident management, business continuity) written and adapted to your context.
Risk analysis (ISO 27005)
Complete risk register, prioritized treatment plan, Statement of Applicability (SoA) and progress tracking, the core of the ISO 27001 certification file.
Compliance roadmap
Sequenced action plan over 3, 6 and 12 months with estimated workloads, indicative budget, responsible parties and monitoring indicators. Includes management dashboard.