Notes on AI that actually helps.

What we learn building AI tools for real businesses — written in plain language, with real examples. No hype, no names.

Business & compliance

21 July 2026·5 min read

Prompt injection: the security risk that comes with giving an AI agent access to outside content

An agent that reads an email, a web page or a document to complete a task is also reading whatever instructions someone slipped into that content. Prompt injection is the security problem that comes with agent autonomy — and it has no complete fix yet.

Read →

Business & compliance

21 July 2026·5 min read

Why an agent should see less data, not more: minimization as a design rule, not a compliance afterthought

The instinct when building an agent is to give it broad access "just in case it needs it." Research on what large models retain from what they process shows why that instinct is exactly backwards.

Read →

Business & compliance

20 July 2026·5 min read

AI at work: French courts keep suspending rollouts over missing works-council consultation — what it means for your SMB

On May 21, 2026, the Paris Court of Appeal confirmed the suspension of an internal AI writing assistant and company-wide ChatGPT use for lack of prior works-council (CSE) consultation, calling it an “manifestly unlawful disturbance.” Two more 2026 rulings build the same line. Here is what actually triggers the obligation, and the checklist before you roll out an AI tool.

Read →

Business & compliance

18 July 2026·4 min read

E-invoicing: Bercy promises leniency for SMBs acting in good faith — what it actually means before September 1

On July 10, 2026, minister David Amiel announced the tax authorities will not automatically fine SMBs facing technical hiccups when e-invoicing becomes mandatory — provided they document the issue and fix it. Here is what this leniency covers, what it does not, and what to do before September 1.

Read →

Business & compliance

15 July 2026·4 min read

23 sanctions in six months: the CNIL is speeding up its fast-track procedure, often over a single complaint

The CNIL has issued 23 sanctions since January 2026 through its simplified procedure, totaling €133,750 — 19 of them triggered by an individual complaint. Video surveillance, non-compliant cookie banners, and unanswered access or erasure requests are the main grounds. What actually starts one of these cases, and how to stay off the list.

Read →

Business & compliance

14 July 2026·4 min read

CNIL email tracking pixels: the grace period ends today, July 14, 2026

The three-month window the CNIL gave organizations to disclose tracking pixels in their marketing emails closes today, the date the authority said it would start auditing. What its recommendation (adopted March 12, published April 14, 2026) actually requires, and what to check in your newsletter tool before tonight.

Read →