The context
One action, three separate frameworks
Agencies handle everything fraudsters look for: IDs, bank details, tax notices, signing dates. Account takeover has become the number one threat for businesses, and transfer fraud has nearly doubled. These attacks are not always sophisticated: a reused password is often enough.
In France in 2025, account takeover accounted for 21% of assistance requests from businesses and associations (+52% year on year). Cases involving transfer fraud rose by +93% compared with 2024. — Cybermalveillance.gouv.fr
With AI, access also becomes an internal question. On a personal account, the chat history follows the employee when they leave the agency. And an assistant connected to the CRM can open files that should never be disclosed.
Three frameworks answer three different questions:
| Framework | Question | What it governs | Agency example |
|---|---|---|---|
| GDPR | Am I allowed to process this data, and how? | Personal data: legal basis, purpose, retention period, processors | Pasting a seller's ID document into a tool with no contract in place |
| Hacking risk | Can this data be stolen or misused? | Security of accounts and systems | A reused password that opens both the CRM and the AI chat history |
| AI Act | Does the AI tool meet its obligations, and is it used properly? | AI systems: transparency, high-risk uses, staff training | A chatbot that does not disclose it is an AI |
A single action can fall under all three at once. Treating them separately leaves a blind spot.
GDPR
GDPR: control what goes into the tool
Whatever you paste into an AI tool is still personal data. GDPR does not create new rules for AI, but all of its principles apply.
Security
Hacking risk: protect the data itself
GDPR says what you are allowed to do with data received from a client or prospect. Hacking raises a different question: how do you protect that same data? It does not require any mistake by the user. It exploits weaknesses, sometimes basic ones.
A password reused across several services is enough to open a mailbox, a CRM and, with them, the history of conversations with an AI assistant — which may hold names, amounts and signing dates. That is the raw material for a convincing transfer fraud.
With AI, the threat also moves inside the agency: an assistant plugged into the CRM sees whatever the account using it can see. If everyone can access everything, so can the AI.
Two measures cover most of the risk: strong authentication (two-factor) on email, CRM and the AI tool, and role-based access control — each employee, and each AI agent, only opens the files they need.
AI Act
The AI Act: govern the tool and how it is used
Adopted in 2024, the EU regulation on artificial intelligence applies in stages. Its transparency obligations have been in force since 2 August 2026. Four points directly concern agencies.
Back to 6:45 pm
Where the three overlap
Back to the opening scene. One action, three separate failures:
Take action
Three steps for Monday morning
AI saves teams real time. The goal is not to ban it, but to know what goes in, who has access, and who is accountable.
Further reading
Sources and references
- Inria × datacraftSummary on generative AI in companies (FR)
- Cybermalveillance.gouv.frTop 10 cyber threats targeting professionals in 2025 (FR)
- ANSSISecurity recommendations for a generative AI system (FR)
- CNILReference framework for rental management (FR)
- CNILManaging personal data in a co-ownership building (FR)
- CNILQ&A on using a generative AI system (FR)
- European CommissionEuropean approach to artificial intelligence
Deploy AI in your agency, within a compliant framework
Optai maps your current AI usage, identifies GDPR, security and AI Act risks, and deploys AI agents calibrated for your agency — on SOC 2, ISO 27001 and ISO/IEC 42001 infrastructure, with Zero Data Retention and no training on your data. 30 minutes, no commitment.