Insights & AI security

Articles, case studies and analysis on protecting data in the age of generative AI.

Laptop, printed checklist and phone on a meeting table during a data breach review in an Australian officeFeatured
Practical Operations

Australia NDB scheme: when an AI prompt becomes an eligible data breach

NDB scheme, 30-day assessment, OAIC notification: how to handle an employee pasting personal information into an AI tool, with a practical playbook.

5 min
Customer account folders, calculator and laptop on a bank back office desk in Brazzaville
Compliance

Congo-Brazzaville banks, customer data and AI in the CEMAC zone

Credit files, statements, ID documents: how banks in Brazzaville can use generative AI without exposing their customers or their compliance standing.

5 min
Dutch town hall beside a canal with parked bicycles
Research

Netherlands Algorithm Register: transparency and AI in municipalities

The Dutch public algorithm register, its tools (IAMA, DPIA) and its limit: everyday use of generative AI by municipal staff, where residents' data can leak.

5 min
Offshore oil and gas platform in the North Sea under a grey sky
Strategy

AI and critical infrastructure in Norway: the Security Act and NSM

Oil, gas, power grids: in Norway, operational data can touch national security. How to govern generative AI under the sikkerhetsloven and NSM guidance.

5 min
Long iron ore train crossing the desert in northern Mauritania
Industry Focus

Mauritania Mining and Gas: AI, Contracts and Geological Data

Iron, gold, gas: in Mauritania, contracts, geological data and staff files sometimes end up in AI tools. Law 2017-020, the APD and the right reflexes.

5 min
Hard hat, drill core samples and laptop on a table in a mine site office in Namibia
Industry Focus

Namibia mining and fishing: protecting confidential data from AI

Drilling results, contracts, quotas and catch volumes: how mining and fishing companies in Namibia can stop confidential data leaking into generative AI.

5 min
Beach near Kololi in The Gambia with a hotel among palm trees and fishing pirogues
Practical Operations

The Gambia: Hotels, Remittances and AI, Protecting Customer Data

Coastal hotels and diaspora remittance services in The Gambia now use AI. Simple rules to protect guest and customer data under the 2025 law.

5 min
Tunisian bank advisor reviewing a printed client file at his desk
Practical Operations

Tunisian banks and insurers: managing generative AI in practice

Law 2004-63, banking Law 2016-48, BCT Circular 2021-05: how Tunisian banks and insurers can manage generative AI and protect customer data in daily work.

5 min
Avenida Paulista financial district in Sao Paulo at dusk
Behavioral Security

Brazil banks and AI: Pix fraud, social engineering and data leaks

Pix fraud, CMN Resolution 4,893/2021, bank secrecy and the LGPD: why Brazilian banks and fintechs need to manage how their staff use generative AI.

5 min
Open pit copper and cobalt mine in the Lualaba province of the DRC
Industry Focus

DRC copper and cobalt: mining traceability data meets generative AI

Supplier audits, artisanal miner registers, export quotas: in the DRC, copper and cobalt traceability data is ending up in AI prompts as well.

5 min
Zurich banking district along the Limmat river at blue hour
Industry Focus

Banking secrecy and AI in Switzerland: banks, FINMA and asset managers

Article 47 of the Banking Act, FINMA circulars and Guidance 08/2024: what Swiss banks and asset managers need to do about AI assistants used by their staff.

5 min
Developer seen from behind coding late at night by a window overlooking Stockholm
Developer Security

AI coding assistants in Sweden: API keys, secrets and source code

Copilot, CLI agents, MCP: Swedish tech teams code with AI every day. How to stop API keys, source code and personal data from leaking into AI tools.

5 min
Microfinance loan officer filling in a loan form at a branch counter in Bamako
Practical Operations

Mali Banks and Microfinance: Using AI Without Exposing Clients

Banks and microfinance institutions in Mali are adopting generative AI. WAMU secrecy, Law 2013-015, the APDP: risky habits and a practical five-step plan.

5 min
Container cranes and trucks at the Port of Lomé at dusk
Industry Focus

Port of Lomé and AI: Protecting Freight Forwarder Data in Togo

Invoices, bills of lading, customs files: at the Port of Lomé, shipping documents end up in ChatGPT. How forwarders can protect client and cargo data.

5 min
Laptop, loan file, pen and security token on a bank office desk overlooking Johannesburg
Compliance

South Africa Joint Standard 2 of 2024: cyber resilience and AI in finance

South African banks and insurers: what the FSCA and Prudential Authority Joint Standard 2 of 2024 on cybersecurity means for generative AI use at work.

5 min
Hard hat, well log printout and core samples on a desk in an Algerian oil field office
Security Research

Algeria energy sector: AI, strategic data and insider risk

Oil, gas, power and large state companies: in Algeria, AI tools put strategic technical data at risk. How to reduce insider risk without banning AI.

5 min
Weaving looms and yarn cones in a textile mill in the Prato district
Security Research

Made in Italy and AI: protecting trade secrets in Italian districts

Industrial districts, fashion, textiles and furniture: how generative AI exposes technical sheets, patterns and supplier lists of Italian small firms.

5 min
Offshore oil platform and supply vessel off the coast of Gabon at dawn
Security Research

Gabon oil and gas and AI: reservoir data is leaking through prompts

Seismic, well logs, contracts: in Gabon, oil and gas subcontractors now use generative AI. Which data is at stake, and how to keep it under control.

5 min
Hand holding a smartphone showing a payment confirmation at a street kiosk in Abidjan
Industry Focus

Côte d'Ivoire Telecoms and Mobile Money: AI and Customer Data

Operators, mobile money providers and call centers in Abidjan are adopting AI. Law 2013-450, ARTCI, BCEAO: the risky uses and how to protect subscribers.

5 min
Notary office desk in Belgium with a bound deed, fountain pen, client folder and laptop
Practical Operations

Professional secrecy and generative AI in Belgium: lawyers and notaries

Belgian lawyers, notaries and accountants use generative AI. Article 352 of the new Penal Code, bar guidelines and the DPA: the rules for staying compliant.

5 min
Modern government administrative building in Cotonou with citizens walking toward the entrance
Data Sovereignty

Benin E-Government and AI: Keeping Citizen Data Sovereign

Benin has built a solid digital state. How to protect citizen data when civil servants and contractors start using generative AI in their daily work.

5 min
Over the shoulder view of a UK nurse working at a computer on a hospital ward
Industry Focus

AI and patient data in the UK: the NHS, the DSPT and Caldicott

Discharge letters, lab results: when clinical staff use generative AI, the DSPT and the Caldicott principles apply. A practical guide for NHS providers.

5 min
Passport, booking sheet, binoculars and safari hat on the reception counter of a safari lodge in Tanzania
Practical Operations

Tanzania tourism: passports, bookings and generative AI

Safari operators, Arusha lodges, Zanzibar hotels: how to protect guest passports and booking data when your staff use ChatGPT and other AI tools.

5 min
Farmer hands holding a basic phone next to a microfinance loan ledger in Madagascar
Strategy

Madagascar microfinance and mobile money: AI and rural customer data

MVola, Orange Money, microloans: generative AI is entering Malagasy microfinance. How to protect rural customers' data under Law 2014-038 and CSBF rules.

5 min
Passport and room key card on a Spanish hotel reception desk
Practical Operations

Spain hotels and AI: guest register data, passports and prompts

Royal Decree 933/2021, SES.HOSPEDAJES, reviews and guest emails: how Spanish hotels and travel agencies can use AI without leaking passports or cards.

5 min
Modern government office buildings in Diamniadio near Dakar, Senegal, in the early morning
Strategy

Senegal Public Administration and Generative AI: Protecting Government Data

New Deal Technologique, national cloud, Law 2008-12: how Senegal's public bodies can let civil servants use AI without exposing citizens' and State data.

5 min
Developer desk at night in Lagos with a laptop showing blurred code
Developer Security

Nigeria AI coding assistants: API keys, BVN test data and the NDPA

API keys, fake BVNs that turn out to be real, source code: what Lagos developers send to AI assistants, and what the NDPA 2023 expects from tech teams.

5 min
Over-the-shoulder view of a woman working on a laptop in an NGO office in Conakry
Behavioral Security

AI and Staff Behaviour in Guinea: Why Training Is Not Enough

In Guinea, AI data leaks come from busy employees, not hackers. Why awareness training fails and how a nudge at the moment of risk changes habits.

5 min
Hospital nursing station desk with a laptop, patient folders and a stethoscope
Industry Focus

Generative AI in French hospitals: medical secrecy, HDS and the CNIL

Reports, letters, translations: when clinicians and clinics in France use generative AI, medical secrecy, HDS certification and the GDPR all still apply.

5 min
Engineering drawing of a machined part with a digital caliper on a workshop desk
Strategy

Trade secrets and AI in Germany: the GeschGehG for the Mittelstand

Drawings, supplier prices, process data: Germany's GeschGehG only protects secrets that are actively guarded. How the Mittelstand can control generative AI.

5 min
Laptop, clipboard with registration forms and beneficiary case files on a table in an NGO field office in Uganda
Research

NGOs in Uganda: protecting beneficiary data from AI tools

Refugees, case notes, distribution lists: what Uganda's 2019 Act and the PDPO require from NGOs and aid agencies that use ChatGPT and generative AI.

5 min
Team meeting in a Sydney office overlooking the harbour and the Harbour Bridge
Research

Australia and generative AI: what the OAIC and the Privacy Act require

The Privacy Act 1988, the APPs, OAIC guidance on AI products, the 2024 reforms, TFNs and Medicare numbers: what Australian organisations need to know.

5 min
Colleagues talking in a bright office in Oslo with a view of the fjord
Behavioral Security

AI in Norway: when workplace trust leads employees to overshare

In Norway, a high-trust culture speeds up AI adoption and oversharing alike. GDPR via the EEA, Datatilsynet: how to guide employees instead of banning AI.

5 min
Mauritanian professionals working together on a laptop in an office in Nouakchott
Regulation

Mauritania Law 2017-020: APD Rules and Generative AI Risks

In Mauritania, Law 2017-020 applies to generative AI. The APD, the national AI strategy, mining, banking and telecoms: the risks and the right reflexes.

5 min
Management team meeting in an office in Brazzaville, Republic of the Congo
Strategy

Congo-Brazzaville Law 29-2019 and AI: building governance that holds

Brazzaville and Pointe-Noire: how companies in the Republic of the Congo can govern ChatGPT and Copilot use under Law 29-2019 on personal data protection.

5 min
Gambian professionals working in an office in Banjul
Research

The Gambia's New Data Protection Law and AI: Why Act Now

The Gambia finally has a personal data law. What it provides, the ECOWAS framework and why companies should govern AI use before the regulator is ready.

5 min
Namibian managers in a meeting in a Windhoek office with the city and hills in the background
Strategy

Namibia AI governance: getting ready before the data protection law

Data Protection Bill, Article 13 of the Constitution, shadow AI: why Namibian companies should start governing how their teams use AI tools right now.

5 min
Two colleagues talking at their laptops in a canal house office in Amsterdam
Security Research

AI chatbot data breaches in the Netherlands: lessons from the Dutch AP

A GP practice, a telecom firm, the municipality of Eindhoven: chatbot data breaches reported to the Dutch AP, what the law requires and how to prevent them.

5 min
Software engineers working together in an office on Avenida Paulista in Sao Paulo
Technical Deep-Dive

Brazil LGPD: detecting CPF and other identifiers before they reach AI

LGPD, the ANPD, PL 2338/2023 and Brazilian identifiers: how to detect and anonymise CPF, CNPJ or CNS numbers before they reach generative AI tools.

5 min
Malian colleagues discussing work around a laptop in an office in Bamako
Data Sovereignty

Mali Law 2013-015: APDP and Data Sovereignty in the Age of AI

In Mali, every prompt sent to an AI tool can move data out of the country. Law 2013-015, the APDP and transfer rules: how to keep control of your data.

5 min
Civil servants working in a Swedish municipal office in Stockholm
Industry Focus

AI in the Swedish public sector: municipalities, IMY and secrecy

Swedish municipalities are adopting generative AI. IMY, offentlighetsprincipen and OSL: the real risks of pasting citizen data into an AI assistant at work.

5 min
Employees working in an office in the Gombe district of Kinshasa, DR Congo
Regulation

DRC Digital Code 2023 and AI: the new rules on personal data

Telecoms, mobile money, mining: what the DRC's 2023 Digital Code requires from companies that use ChatGPT or Copilot on customer data, and how to prepare.

5 min
Togolese professionals in a meeting room in Lomé overlooking the seafront
Regulation

Togo Law 2019-014 and AI: What the IPDCP Expects from Companies

The IPDCP has been active since March 2025. What Togo's Law 2019-014 requires from companies that use ChatGPT, Copilot or Gemini with personal data.

5 min
Young Tunisian software engineers talking on an office terrace in Les Berges du Lac, Tunis
Regulation

Tunisia Law 2004-63 and AI: the challenge for offshore developers

Copilot, Claude Code, ChatGPT: offshore teams in Tunisia now code with AI on their clients' data. What Organic Law 2004-63 and the INPDP say, and what to do.

5 min
South African software engineers reviewing code in a Johannesburg office with the Sandton skyline
Technical Deep-Dive

South African ID numbers and POPIA: detect and anonymise before AI

Date of birth, gender, citizenship: what a South African ID number reveals, and how to detect and anonymise it before it reaches ChatGPT or other AI tools.

6 min
Finance professionals talking in an office overlooking Lake Zurich
Data Sovereignty

Swiss nFADP and generative AI: sovereignty, transfers and secrecy

The FDPIC says the revised FADP applies to AI. Transfers abroad, banking secrecy, professional secrecy: how Swiss firms can use ChatGPT and stay in control.

5 min
Colleagues reviewing a document on a laptop in a historic office building in Milan
Compliance

Italy: what the Garante and Law 132/2025 mean for employers using AI

ChatGPT limited in 2023, a 15 million euro fine for OpenAI, then Law 132/2025: what Italy now expects from employers whose staff use generative AI.

5 min
Ivorian professionals working in an office tower in the Plateau district of Abidjan
Compliance

Côte d'Ivoire Law 2013-450: ARTCI Compliance for Generative AI

In Côte d'Ivoire, generative AI falls under Law 2013-450. Declaration, authorization, transfers, correspondent: what ARTCI expects from companies in 2026.

5 min
Professionals working in an office in the City of London
Regulation

AI in the UK: UK GDPR, the ICO and the EU AI Act in practice

UK GDPR, the Data (Use and Access) Act 2025, ICO guidance and the EU AI Act: what UK firms using AI and selling into the EU need to know about prompts and data.

5 min
Business team reviewing documents in an office in Libreville, Gabon
Data Sovereignty

Gabon Law 001/2011 and AI: where is your teams' data really going?

Oil, banking, government: in Gabon, every prompt sent to ChatGPT is a transfer out of the country. What Law 001/2011 and the APDPVP say, and what to do.

5 min
Tanzanian professionals working on laptops in a Dar es Salaam office overlooking the harbour
Regulation

Tanzania Personal Data Protection Act 2022, PDPC and AI at work

PDPC registration, transfers abroad, automated decisions: what Tanzania's Personal Data Protection Act 2022 means for companies whose teams use AI tools.

5 min
Beninese professionals working in an open-plan office in Cotonou
Practical Operations

Benin Digital Code and AI: A Practical Checklist for Companies

Law 2017-20, APDP, register, transfers: a 10-point checklist to use ChatGPT and Copilot in Benin without exposing customer data or breaking the rules.

5 min
Board members of a Belgian company meeting in a Brussels office
Strategy

Generative AI in Belgium: GDPR, NIS2 and board level AI governance

AI translation across French, Dutch and English, the GDPR, Belgium's NIS2 law and the CCB: what Belgian boards must demand to keep generative AI under control.

5 min
Algerian professionals walking along a boulevard of white buildings in central Algiers
Compliance

Algeria Law 18-07 and generative AI: what the ANPDP expects from companies

Prior declaration, authorization for transfers, a mandatory DPO: what Law 18-07 and the ANPDP mean when your teams in Algeria use ChatGPT, Copilot or Gemini.

5 min
Team of Spanish professionals working together in a Madrid office
Strategy

Spain and the AI Act: what AESIA and the AEPD expect from companies

Spain created AESIA, the EU's first national AI supervisory agency. What companies must prepare, with the AEPD and the LOPDGDD, as the AI Act phases in.

5 min
Bank employees reviewing a customer file together in an office in Dakar, Senegal
Industry Focus

Senegal Banks and Fintechs: Generative AI and Banking Secrecy

Banks, microfinance and mobile money players in Senegal are adopting generative AI. WAMU banking secrecy, Law 2008-12, the CDP: risks and a clear plan.

5 min
Works council meeting in a Munich office discussing generative AI
Practical Operations

Generative AI in Germany: rolling it out with the works council

In Germany, generative AI goes through the Betriebsrat. BetrVG, DSK guidance, GDPR: how to build a solid works agreement and fit AI DLP into it from day one.

5 min
Guinean professionals working in an office in Conakry overlooking the Atlantic
Strategy

Guinea Law L/2016/037: Build AI Governance Before the Regulator Does

Mining, telecoms, services: AI is already inside Guinean companies. What Law L/2016/037 requires and how to get organized before the authority is ready.

5 min
Team of professionals discussing generative AI use in a Paris office
Regulation

Generative AI and the CNIL: what companies in France must do

ChatGPT at work, DPIAs, internal policy, choosing the tool: what the CNIL expects from French companies using generative AI, and how to comply in practice.

5 min
Fintech team at work in an office in Lagos, Nigeria
Compliance

Nigeria NDPA 2023 and generative AI: what fintech teams need to know

NDPA 2023, the NDPC's GAID directive, BVN and NIN: how Nigerian fintechs and banks can use ChatGPT or Copilot without exposing their customers' data.

5 min
Ugandan office workers discussing a project around a laptop in a Kampala office
Compliance

Uganda Data Protection Act 2019 and AI: a PDPO compliance guide

NIN, mobile money, ChatGPT: what Uganda's Data Protection and Privacy Act 2019 and the PDPO expect from companies whose teams use generative AI at work.

5 min
Malagasy office workers walking on a hillside street in Antananarivo, Madagascar
Data Sovereignty

Madagascar Law 2014-038 and AI: protecting client data in offshoring

Call centers and BPOs in Antananarivo handle French client data with AI tools. What Law 2014-038, the CMIL and the GDPR require, and how to act on it today.

5 min
Two colleagues in a Dakar office reviewing a document about personal data compliance
Compliance

Senegal Law 2008-12 and Generative AI: A Compliance Guide for Businesses

ChatGPT, Copilot, Gemini: your teams in Senegal already use AI. What Law 2008-12 and the CDP require, the risky situations and a concrete action plan.

5 min
Professional in a Dakar office using an AI assistant protected by a data loss prevention shield
Compliance

Generative AI in West Africa: How to Protect Your Sensitive Data

Senegal, Côte d'Ivoire, Benin: every prompt sent to ChatGPT can become an unlawful data transfer. Legal framework, real risks and how AI DLP helps.

5 min
A 90-day timeline poster showing five rollout phases for AI DLP, from pilot install to org-wide Block mode, with metrics and stakeholder conversations marked on each week.
Practical Operations

From Monitor to Block: A 90-Day Rollout Playbook for AI DLP

A week-by-week 90-day rollout for AI DLP in a 500-person company. Who does what, what success looks like, what to say to HR, legal, the CFO and the executive sponsor.

8 min
European Union and United States flags rendered as a circuit board, with a padlock at the boundary representing data sovereignty in AI DLP.
Strategy

Sovereign AI: Why European CISOs Are Rejecting US-Cloud DLP

Schrems II, FISA 702, the CLOUD Act and CNIL enforcement have changed the math. A practical guide to deciding when a US-hosted AI DLP vendor is no longer acceptable.

7 min
European Union flag overlaid with a digital clock and circuit pattern, illustrating the NIS2 24-hour incident reporting deadline.
Compliance

NIS2 Has Teeth: How the New Directive Changes AI Data Handling

NIS2 forces a 24-hour CSIRT warning when an employee leaks data into ChatGPT. Here is who is in scope, what counts as a significant incident, and what evidence you must produce.

7 min
An empty corporate training room with a presentation slide that reads 100 percent completion, illustrating the gap between awareness training and real AI security behavior
Behavioral Security

Why AI Security Training Doesn't Work (and What Actually Does)

Annual awareness modules don't change behavior at the moment someone pastes a customer list into ChatGPT. Here is what behavioral science says actually moves the needle.

6 min
Terminal window showing a Claude Code session reading a .env file with secret values being intercepted by Zeuslock CLI.
Developer Security

CLI-Driven AI: How Claude Code, Cursor, and Copilot CLI Expose Your Secrets

Agentic CLI tools read your files and ship them to a cloud LLM. Here are the concrete leak vectors and how to scan the read path, not just the write path.

7 min
Diagram of a Model Context Protocol exchange between a host application and a tool server with a DLP inspection layer wrapping the stdio pipe.
Emerging Tech

The Hidden Threat in MCP Servers: Why MCP Needs Its Own DLP Layer

Model Context Protocol is the new wire format between agents and tools. Browser DLP cannot see it. Here is what an MCP-aware DLP layer actually looks like.

8 min
Stylised diagram of prompt injection attack vectors flowing into an AI agent through chat, documents, tool outputs, and persistent memory
Security Research

Prompt Injection: The Top 5 Attack Patterns Hitting AI Agents in 2026

A field-level breakdown of the five prompt injection patterns we are seeing most against production AI agents in 2026, with detection signatures and concrete mitigations.

9 min
Side-by-side comparison of a credit card redacted with XXXX versus a format-preserving rewrite that keeps the Visa prefix and last four digits visible
Technical Deep-Dive

Format-Preserving Anonymization: Why XXXX Breaks Your AI Pipeline

Replacing 4532-1488-0343-6467 with XXXX-XXXX-XXXX-XXXX is the laziest possible redaction and it silently breaks every downstream LLM answer. Here is what to do instead.

8 min
A compliance officer reviewing a 12-item EU AI Act and GDPR Article 32 checklist on a dashboard showing AI interaction audit logs.
Compliance

EU AI Act + GDPR Article 32: A 12-Item Compliance Checklist

Regulators do not ask if you have AI policies. They ask for evidence those policies are followed. A 12-item checklist mapping the EU AI Act to GDPR Article 32, with the artifacts auditors actually want.

7 min
A close-up of a developer's terminal with a stack trace highlighted, suggesting a sensitive credential about to be pasted into an AI assistant.
Customer Stories

The Anatomy of an AI Data Leak: Three Stories from Our Telemetry

Three real, anonymized AI data leaks from our customer telemetry: AWS keys in Copilot, customer PII in ChatGPT, and proprietary code in Claude. What we saw, what fired, what changed.

8 min
Diagram showing a TLS 1.3 encrypted browser session to ChatGPT bypassing a corporate gateway DLP appliance.
Technical Deep-Dive

Why Email DLP Fails on ChatGPT (and what works instead)

Legacy proxy and gateway DLP cannot read encrypted browser traffic to ChatGPT, Claude or Gemini. Here is why, and the only architecture that does.

7 min
Dark control-room dashboard showing a fleet of unsanctioned generative AI tools accessed from corporate browsers, with sensitive-data hit-rate indicators rising.
Research

The Real Cost of Shadow AI in 2026

European CISOs underestimate shadow AI volume by 4 to 6 times. Here is what the data actually says, and the three metrics you should be measuring this quarter.

7 min