Laurent C.

Case 1 — Multi-country B2C AI Platform

Scoping of Go/No-Go and GDPR + AI Act compliance trajectory (with governance, DSA if applicable). Review of scope of obligations/commitments (regulatory + contractual), batching of actions, evidence plan and governance.

Deliverables: prioritized roadmap, evidentiary file, compliance documentation, processes (validation / change control / incident).

Result: stabilized trajectory and deployable deliverables.

Case 2 — B2C AI Platform

Validation of feasibility conditions (applicable law, constraints, risks, business impacts) then operational security (T&Cs, privacy, cookies/trackers, GDPR roles, subcontracting, cloud/contracts).

Deliverables: Go/No-Go feasibility note, deployable documents, remediation plan and trajectory.

Result: feasibility validated, clear prioritization and secure execution framework.

Case 3 — Healthcare Facility / Cloud

Major incident (loss / unavailability of medical data). Qualification, evidentiary documentation, breach management and CNIL notifications, contribution to remediation plan.

"Rebound" advice: securing the choice and legal framework of new providers (requirements, responsibilities, continuity).

Result: incident managed, consolidated documentation, new provider framework operational.

Lawyer (Paris Bar), DPO, ex-CNIL: I support business units and executives (IT/security, legal, compliance, product/data) on GDPR & data governance, AI/AI Act, cybersecurity, IT contracts, platforms (DSA/DMA).

Implementation-oriented approach: risk assessment, arbitration and compliance trajectories, with actionable deliverables (DPIA, clauses/contracts, policies, documentation, action plans).

Entry point: Go/NoGo Pack (2–3 days), then execution in batches if needed.

Head of the "IT and Liberties" department within a pioneering digital law firm: files with a strong technical component (data/IT/platforms), compliance and contracting, "risk & delivery" culture.

This experience now fuels my approach: decision → trajectory → actionable deliverables, in articulation with the French Data Protection Act / GDPR.