The questions we get askedand what we actually answer.
Eight topics we handle in assessments and in projects. We address them candidly, limits included — because a vendor that never reports a difficulty has one they're keeping from you.
What's holding AI back isn't the technology
“Why do my AI projects stall, when the tools are right there?”
This is the conclusion of a survey of nearly 1,000 executives by Grant Thornton: 46% of them say AI underperforms — and they don't blame the technology, but controls and compliance that haven't kept up. 78% are not certain they could pass an AI governance audit in 90 days. In other words: they cannot demonstrate what their AI does, or who is accountable for it. PwC measures the same effect from the other end: the highest-performing companies automate 2.8 times more decisions — while having more governance, not less.
Your teams already use AI. You don't know which.
“Have my employees started using AI without telling me?”
67% of employees use AI tools at work. But only 12% of organizations can name ALL the tools in use (Gartner). More than one employee in two uses tools their employer did not provide. And among those using AI without their employer's knowledge, 75% have already sent sensitive data to a public tool — a contract, a financial statement, a client list that left for a third party's servers. This is not a hypothetical risk: it's a measured observation.
74% of AI's value goes to 20% of companies
“Can I still catch up with those who started ahead?”
AI doesn't spread evenly: it concentrates. According to PwC, 74% of the economic value created by AI is captured by 20% of companies. BCG measures a 9-point gap in shareholder returns between the 6% of true leaders and the median. And the gap is widening: leaders learn faster, because they are already used to converting their experiments into production. So it isn't a question of budget: it's a question of method.
Why 95% of AI projects don't deliver
“Many talk about it, few get there. What makes the difference?”
The figure is well known to anyone who has looked: according to MIT, 95% of generative AI projects never reach production. Gartner goes further — more than 40% of agentic AI projects will be outright canceled by the end of 2027. And of the thousands of vendors claiming to be agentic AI, Gartner estimates that only about 130 truly are. The rest is what it calls "agent washing": renaming a chatbot to sell it for more.
AI errors: how we detect and handle them
“An AI that gets things wrong can cost me dearly. How am I protected?”
An AI generates the plausible, not the true. It can invent a legal reference, a figure, a name — with perfect confidence. This is what's called a hallucination, and it's the most concrete risk of any AI project. The problem isn't that it happens: it's that it happens without anyone seeing it.
Getting your teams to adopt AI
“The tool is there, but nobody uses it. How do we avoid that?”
This is the best-documented cause of failure: 95% of AI projects never reach production, not for lack of technology, but because they stay as projects without buy-in from the people who were supposed to use them. A tool a team works around is a dead tool, whatever its quality.
AI and GDPR: what it really involves
“I want to use AI, but I have to protect the data. Concretely?”
"We are GDPR compliant" means nothing on its own. The question isn't whether you are on paper, but whether you know where your data goes, who accesses it, how long it is kept, and what you can prove. It's as much an architecture topic as a documents topic.
Who decides when AI gets it wrong?
“If an agent makes a mistake, who is accountable, and how do you prove it?”
This is the question everyone who has already deployed AI asks in the executive committee: when a machine decides, who answers? Without a framework, every incident becomes a debate. With a framework, it becomes a handled case. The difference isn't technical: it's organizational.
What a running AI really costs
“Beyond the setup, what does it cost me each month?”
People often talk about the project cost, rarely about the operating cost. Yet an AI runs every day: it consumes compute, it produces logs, it needs monitoring. The most underestimated line item is neither hardware nor licenses: it's the human time spent supervising and adjusting.
The cost of inaction
“What if I wait another six months?”
The question always asked is "how much does it cost?". Rarely "how much does doing nothing cost me?". Yet it's the same sum: the hours spent on tasks others have automated, the missed calls, the lead times that stretch with volume. Meanwhile, the competition moves forward.
Open source or proprietary: don't lock yourself in
“Will I depend on one vendor forever?”
This is a legitimate concern, and rarely addressed: if your AI runs on a proprietary platform, what happens when its rates change, when it shuts down, or when it changes its terms? What locks you in isn't the choice of a tool: it's not having planned how to get out.
RAG: why your AI needs to know your company
“An AI that only knows the web — what use is that for my business?”
An AI model on its own only knows what it learned during training: the web, books, articles. Your customer history, your rates, your internal procedures, your contracts — it doesn't know them. Asked about your company, it will answer confidently… by making things up. That's exactly the problem RAG solves.
AI and jobs: talking about it frankly
“Will AI eliminate jobs at my company?”
This is the question executives ask themselves without always voicing it — and the one teams dread. The honest answer is nuanced: AI absorbs tasks, not professions. What disappears are repetitive actions; what remains is judgment, relationships and accountability. But denying the question would be lying.
Your antivirus sees what it already knows. Not what's attacking you.
“Why aren't the classic tools enough anymore?”
An antivirus, a firewall or an endpoint tool work by signature: they recognize what they have already seen. Yet most successful intrusions use no executable malware — they connect with legitimate credentials, often obtained through phishing or a leak. From the classic tools' point of view, the attacker is a normal user connecting at the right hours from an ordinary address. The behavior, though, is abnormal: it doesn't look like the usual usage of that account.
NIS2 and SMBs: what really concerns you
“Am I covered, and what do I risk if I do nothing?”
NIS2 considerably widens the scope of the European directive on the security of network and information systems: entire industries are now covered, and subcontractors of large companies often are too, indirectly, through their contracts. Many SMBs discover the issue not through a text, but through a request from a client or their insurer. So the question isn't "am I on the list?" but "could I prove it if asked?".
An AI agent has access rights. Who watches what it does with them?
“Can my AI agents become a security risk?”
An AI agent connected to your tools has an account, rights and access to data — exactly like an employee. Except that nobody asks it to lower its voice in the meeting room, and few companies know how to delegate its rights precisely. Access that's too broad, an instruction hijacked by malicious content, an agent still running after being forgotten: these are real incidents, and they aren't in the classic frameworks.
These are the topics we systematically cover in an assessment. If yours isn't listed, it's probably one we handle too.
Raise your case