Generative AI governance in the enterprise: roles, rules, logs and costs
The six workstreams of a generative AI governance that holds up in operation: roles, usage policy, model catalogue, access rights, traceability and cost control.
Read the guide
Security & compliance
Proof, not promises.
Every action is recorded in a SHA-256 hash-chained audit trail, verifiable end to end. Sovereign, traceable, deployed on your premises. Touch one line and the chain knows.
- On-premise
- AI Act & GDPR by design
- SHA-256 audit
- No raw prompts in the log
Audit log · SHA-256 chain
Chain verified
Change a single line: the whole chain breaks, and the log proves it.
Our scope
What SmartAGT handles, end to end.
Security is not a toggle: it is wired into the product.
A glimpse of the foundation, not an exhaustive list.
Compliance
Aligned with the frameworks that matter.
An honest posture, pitched at the level a first CISO read needs. The control-by-control detail lives in the compliance pack, on request.
By design / aligned3
EU AI Act
Logging, transparency, human oversight (Art. 12/13/14). Art. 50 in progress.
GDPR
Minimisation, right to erasure, encryption, pseudonymisation. Vendor = processor.
NIST CSF 2.0
Govern, Identify, Protect, Detect. Maturity framework, not certifiable.
Aligned · Certification roadmap3
ISO/IEC 27001Roadmap
Technically aligned; certification in preparation (ISMS, SoA, COFRAC audit).
ISO/IEC 42001Roadmap
Model lifecycle and human oversight in place. Certification planned.
ISO/IEC 27701Roadmap
Privacy extension of the ISMS, aligned. Prerequisite: 27001 certification.
Host responsibility1
HDS / SecNumCloudHost-managed
Deployable on qualified infrastructure; certification on the host side.
SmartAGT is not yet third-party certified: technical alignment is in place, certification is on the roadmap.
Sovereignty
No matter the model, your data stays sovereign.
SmartAGT runs inside your infrastructure. You can use a local model, with no external transfer, or a SaaS model. In SaaS mode, the content needed for the request is sent to the chosen provider; direct identifiers can be pseudonymised before sending.
SaaS LLM
100% local
Your infrastructure
SmartAGT
User
SmartAGT
On-premise providers
SaaS providers
In 100% local mode, nothing ever leaves your infrastructure: the model runs on your side. The request content is sent to the chosen provider. Direct identifiers can be pseudonymised before sending.
The agent wants to run
email.send to 312 recipients. Side-effect action.
Approval required
Confirm sending the email?
Tool email.send “WRITE level” 312 recipients. Nothing is sent without your approval.
Human control
AI proposes. A human decides.
By default, every side-effect action is paused before execution: the nature of the action decides, not the model. The operator approves or refuses, and the decision is recorded.
-
Deterministic pause
Write actions stop dead. The action's level triggers the pause, not the model's judgement.
-
Preview card
The operator sees exactly what is about to happen before confirming.
-
Recorded decision
Approval or rejection lands in the audit chain, with the human actor.
Further reading
Data sovereignty and generative AI: what sovereign AI really guarantees
What sovereign AI guarantees and what it does not, the laws that apply, how to map a project's data flows, and the questions to ask a vendor.
Read the guideOn-premise generative AI in the enterprise
What sovereign really means, the five layers of an internal platform, what it costs line by line, the four most common pitfalls, and a decision grid for on-premise, SaaS and hybrid.
Read the guideThe Cloud Act and generative AI: what is really exposed
The Cloud Act targets the entity operating a service, not the address of the data centre. What is really exposed in a generative AI project, what is not, and the checks to make.
Read the guideOn-premise, SaaS or hybrid AI: choosing use case by use case
Classify your use cases by the data they handle, recognise when SaaS is enough and when on-premise is a must, and build a hybrid setup that does not rely on users' goodwill.
Read the guideAI Act obligations for businesses that deploy AI
Deployer or provider, the timetable after the 2026 omnibus, what already applies to any business using AI, and what changes when a use is high-risk.
Read the guide
Sealed chain · SHA-256
The full, granular truth,