French Sensitive Data Threatened by Foreign Cloud LLMs

The Rise of AI in the French Public Sector: A Threat to Strategic Data?

The rapid implementation of generative artificial intelligence in French public administrations raises concerns about the security of companies' strategic data. This data, often entrusted to the state as part of various administrative processes, could pass through language models hosted on foreign clouds, posing a significant risk of leakage.

French public administrations are increasingly adopting generative AI in various forms: chatbots, writing assistants, synthesis tools, and case analysis. While these technologies promise efficiency gains, they also introduce poorly documented risks. Indeed, companies' strategic data shared with the state for compliance, public procurement, or regulatory obligations could be exposed to language models hosted abroad.

An Inter-Inspection Report Raising Questions

In April 2026, a joint report from the General Inspectorate of Finance (IGF), the General Inspectorate of Social Affairs (IGAS), and the General Inspectorate of Administration (IGA) was published. This document, available on the IGAS website, emphasizes that AI represents a major transformation lever for public action. It proposes thirteen recommendations to structure this deployment. However, the report remains silent on a crucial point for companies: the protection of their sensitive data when it passes through non-sovereign AI tools.

The report relies on a benchmark with the private sector and thirteen foreign administrations, providing a reference framework to assess productivity gains and improvements in public services through AI.

Strategic Data at Stake

French companies regularly share strategic information with the administration. This data goes far beyond simple administrative formalities and includes crucial elements for competitiveness, know-how, and compliance.

Several categories of sensitive data can be distinguished:

• Regulatory compliance data: This information is collected during inspections by the DGCCRF, labor inspections, or for environmental or health permits.
• Industrial and process data: Often shared in the context of complex public procurement or technical inspections.
• Financial and tax data: Transmitted during tax declarations or public procurement.
• Customer or beneficiary-related data: Used in systems to combat social or tax fraud.

This data is often protected by trade secrets or confidentiality clauses. Its disclosure could harm the competitiveness of the companies involved. The report notes that administrations are subject to sovereignty constraints but does not detail the consequences for companies.

Confidentiality and Leakage Risks

Public officials and agents are bound by strict confidentiality obligations, governed by professional secrecy and ethical rules. Yet, the IGF/IGAS/IGA report highlights that the unregulated use of public AI tools, or "shadow AI," could involve up to 40% of agents in local authorities. This practice exposes processed data to leakage risks, as the tools used generally offer no guarantees of confidentiality or sovereignty.

A Report Overlooking a Major Risk

The April 2026 inter-inspection report aims to assess productivity gains and improvements in public services through AI. It proposes a structured operational framework around thirteen recommendations, including securing tools, pooling infrastructures, and data governance. However, it primarily focuses on protecting users' personal data and state sovereignty, neglecting the specific risks related to companies' strategic data.

Concrete Risks of Data Leakage

Current practices in administrations create a real exposure of company data. The use of commercial cloud LLMs, for instance, poses a significant risk. Almost all conversational assistants deployed or tested are not labeled SecNumCloud 3.2, a prerequisite for processing sensitive data. This data includes information whose breach could harm public order, public safety, or the protection of intellectual property.

Annex IX of the report explicitly states that it is impossible to use operators subject to U.S. extraterritorial laws, such as the Cloud Act and FISA, for sensitive data.

Another risk concerns the use of data by the publishers themselves. Annex X of the report elaborates on the phenomenon of technological lock-in and "the illusion of sovereignty through mere hosting." Even when data is hosted in Europe, the lack of control over the software chain and exposure to the roadmaps of private publishers creates dependency. Data transmitted to cloud models may, according to the terms of use, contribute to the improvement of the models or be accessible to the authorities of the provider's home country.

Consequences for Companies and Administrations

These risks directly expose companies to losses of competitive advantage, infringements of intellectual property, or uses for economic intelligence purposes. Public officials and agents are not immune either: in the event of a leak, their liability may be engaged, especially if the tool used does not comply with security and sovereignty requirements.

Conclusion: A Necessary Reflection on Data Governance

The April 2026 inter-inspection report provides valuable contributions to the reflection on the deployment of AI in public administrations. It highlights the need for rigorous governance and pooling of infrastructures. However, it does not offer a comprehensive analysis of the systemic risks associated with using non-sovereign AI tools to process companies' strategic data.

As France and Europe seek to strengthen their technological autonomy, the protection of companies' economically and strategically important data in public AI uses must be integrated into governance policies. This requires strengthening contractual clauses with LLM providers, accelerating the availability of pooled sovereign infrastructures, and accurately mapping data flows between the private sector and public AI tools. Without this, AI, while a lever for transformation in public action, could paradoxically undermine the competitiveness of French companies.