In summary
- Céos, an assistant in French and English, answers data-protection questions from the Authority’s documents.
- Three tools guided within the conversation: data-breach notification, records and impact assessment (DPIA).
- A security audit that brought known dependency vulnerabilities down from 13 to 0.
- A three-day training course on AI and cybersecurity, with its own exercise platform.
Many questions, demanding texts
A data-protection authority receives the same questions from very different audiences: individuals, companies, data protection officers. The answers exist, but they are spread across the law, rulings, guides and forms.
The project had to make these texts accessible in plain language, without ever making the assistant say what the documents do not say.
Céos, a RAG assistant on the Authority’s website
We built the assistant end to end: a document base dedicated to the APDP, a search and generation engine on a dedicated instance, and a conversation interface integrated into the WordPress site as a plugin.
Answers appear as they are generated, in French or English. The history stays in the visitor’s browser, and the visitor can rate each answer; this feedback can be viewed in the site administration and is used to correct the base.
The Authority’s team configures the assistant from the WordPress administration: activation, pages concerned, welcome message, advanced functions.
Compliance tools within the conversation
The assistant does not merely answer. When the conversation concerns a data breach, it offers the notification form: 29 questions explained one by one, a unique reference and an export ready to submit.
The impact assessment follows the same principle. A 14-step path begins by checking whether a DPIA is necessary, then assesses the risks with an impact × likelihood rating and flags the cases that require prior consultation. The draft resumes where it was left off and exports to PDF.
Security and confidentiality verified, not assumed
The answers entered in the impact assessment stay in the browser. AI assistance is optional, disabled by default, triggered only by a click, and the user sees what will be sent before sending. An automated test checks that no data leaves outside this case.
On the site side, exchanges with the plugin are protected by tokens, rate limits, a closed list of endpoints and checking of uploaded files.
The dependency audit identified 13 known vulnerabilities, including one critical and four high. All were fixed, and a library that could not be patched was removed.
Three days of training in AI and cybersecurity
We designed and ran a private three-day training course for the Authority’s teams. It covers generative AI and how Céos works, impact assessment, digital hygiene, phishing, open-source research and incident response.
The training relies on a platform built for the occasion: 25 course modules, 226 assessment questions, hands-on exercises, investigations to solve in the browser and a two-hour crisis unit played as a team.
The trainer projects the slideshow onto all workstations, launches polls and tracks the group’s progress. Each participant leaves with a skills passport and a certificate. All scenarios, identities and incidents used are fictional.