Sécurité IA : comment sécuriser un projet d'agent IA en entreprise ?

Sécurité IA : de quoi parle-t-on en entreprise ?

La sécurité IA regroupe les mesures qui protègent les données, les accès et les actions d'un système d'intelligence artificielle utilisé dans une entreprise. Pour un assistant qui se contente de répondre, le risque principal est la fuite de données. Pour un agent IA, qui agit dans vos logiciels, il faut en plus contrôler ce qu'il a le droit de faire, tracer chacune de ses actions et pouvoir reprendre la main.

Les risques à couvrir en priorité :

• La fuite de données : un document confidentiel envoyé à un service d'IA non maîtrisé, ou restitué à un collaborateur qui ne devait pas le voir.
• Les consignes cachées : un courriel ou une page web qui contient des instructions destinées à détourner l'agent (prompt injection).
• Les droits trop larges : un agent qui utilise un compte partagé, capable de modifier bien plus que sa tâche ne l'exige.
• L'IA utilisée sans cadre : des outils ou des agents adoptés par les équipes sans que l'entreprise sache quelles données y passent.

Cet article détaille les principes de sécurité à appliquer dès la conception d'un agent IA, les normes de conformité à respecter, et la méthode qu'IT Systèmes applique pour déployer des agents IA sécurisés dans le système d'information des PME et des ETI.

Sécurité IA en PME et ETI : par où commencer ?

Une PME ou une ETI n'a pas besoin d'une équipe dédiée à la sécurité de l'IA pour encadrer ses agents. Quatre étapes suffisent pour démarrer :

1. Recenser les outils et les agents d'IA déjà utilisés, et les données qu'ils voient.
2. Donner à chaque agent sa propre identité, avec le minimum de droits nécessaires à sa tâche.
3. Journaliser chaque action de l'agent, pour pouvoir l'expliquer après coup.
4. Faire vérifier un agent existant avant de l'étendre. Chez IT Systèmes, l'audit d'agent IA dure une journée et coûte 1 500 € HT par agent, pour un agent développé par un autre prestataire ou hors de l'environnement Microsoft : droits d'accès, risques de fuite de données, résistance aux consignes cachées et traçabilité.

La méthode décrite dans la suite de cet article (réseau dédié, proxy, coffre à clés matériel, plan de réponse en 5 phases) est celle qu'IT Systèmes applique sur ses projets. Pour le volet organisation (registre des agents, responsables, règles d'usage), voir notre article sur la gouvernance des agents IA.

The 5 fundamental pillars of security for an AI agent in a business

1. End-to-end encryption of sensitive data

All data processed by the AI agent must be encrypted in transit and at rest in accordance with the most stringent security standards:

Encryption in transit:

• Minimum TLS 1.3 protocol for all communications
• IPSec VPN tunnels for inter-site connections
• Strictly validated SSL/TLS certificates
• HTTPS protocol mandatory for all APIs

Encryption at rest:

• AES-256 algorithm for storing sensitive data
• Encryption before writing to disk, decryption only at the time of use
• No sensitive data is stored in plain text
• Automatic rotation of encryption keys

Secure Encryption Key Management: Encryption keys are managed through a dedicated HSM (Hardware Security Module) or a cloud-based key management service (Azure Key Vault, AWS KMS, Google Cloud KMS). This ensures that the secrets handled by the agent (passwords, API tokens, personal data) remain protected even if a server is compromised.

2. Identity and Access Management (IAM) for the AI Agent

There are two possible situations, and they do not call for the same response.

The agent acts on behalf of a user (for example, an assistant who reads documents for the person asking the questions): it uses delegated permissions and sees only what that user is authorized to see. Authentication is handled through the company's SSO system, using standard protocols:

• SAML 2.0 for Identity Federation
• OAuth 2.0 for Delegated Authorization
• OpenID Connect for Authentication

The agent acts independently (it processes tickets, creates accounts, or modifies groups without a user behind each action): it must have its own identity, separate from human accounts, with only the minimum necessary permissions. This allows the agent to be revoked without affecting employee accounts, and its actions can be tracked in the logs. In the Microsoft environment, Microsoft Entra Agent ID provides this type of identity, along with conditional access rules, centralized logging, and agent lifecycle management. Copilot Studio agents created before this feature was enabled must be recreated; there is no automatic conversion.

In both cases, we avoid using a shared service account with extended privileges, which makes it impossible to distinguish the agent's actions from those of other tools and impossible to restrict them.

Multifactor Authentication (MFA): For sensitive actions (modifying financial data, accessing HR data, deleting data), validation by a user authenticated via MFA is required.

Least-privilege principle: The AI agent accesses only the data and systems strictly necessary for its function. Its access rights should be reviewed regularly—for example, quarterly—as part of security governance.

3. Full traceability and immutable audit trail

Every action taken by the AI agent is recorded in a secure, immutable audit log to ensure traceability and meet compliance requirements.

Data recorded in the audit trail:

• Identity of the agent and, if applicable, the user on whose behalf the agent is acting
• Precise UTC timestamp for each request
• Exact query entered by the user
• Action performed by the AI agent on target systems
• Data accessed or modified
• Response from the AI agent to the user
• Operation status (success, failure, error)
• Target information system (ERP, CRM, HRIS)

Log Retention: The CNIL recommends retaining log data for a period of between six months and one year (Recommendation No. 2021-122). A longer retention period must be justified and documented: either due to a sector-specific legal requirement or internal control measures, for which the CNIL permits retention for up to three years in the most common cases.

These audit logs enable organizations to respond to requests to exercise GDPR rights (access, erasure, portability), comply with ISO 27001 audits, and conduct security investigations in the event of an incident.

4. Network segmentation and isolation of the AI agent

The AI agent is deployed in a segmented and secure network environment in accordance with network security best practices:

Secure network architecture:

• Dedicated, isolated VLAN for the AI agent
• Isolated subnet with strict routing rules
• Web Application Firewall (WAF)
• Restrictive incoming and outgoing filtering rules

Zero-trust security principle: The AI agent can only communicate with systems explicitly authorized in the security policy. Outbound requests pass through a secure HTTP proxy with URL filtering, SSL inspection, and blocking of malicious domains.

Isolation of Sensitive Data: Sensitive data remains within your private cloud environment (Azure, AWS, GCP) or on your on-premises infrastructure, without passing through third-party services over which you have no control.

5. Regulatory compliance and GDPR data governance

The AI agent complies with the fundamental principles of the GDPR regarding the protection of personal data:

Data Minimization: The AI agent collects and processes only the personal data strictly necessary for its business function.

Retention Period Limitation: Personal data is retained only for as long as necessary to fulfill the purposes of the processing, after which it is deleted or anonymized. This is a particular point of concern for agents equipped with persistent memory: in their July 20, 2026, memorandum on agent-based AI, the CNIL and the Council for AI and Digital Technology note that such memories increase the amount of data retained.

Guaranteed rights of individuals:

• Right of access: The user may view the personal data processed by the AI agent
• Right to erasure: deletion of data upon request, subject to the conditions set forth in the GDPR
• Right to rectification: correction of inaccurate data
• Right to portability: exporting data in a structured format

Anonymization and pseudonymization: Personal data may be pseudonymized or anonymized before being processed by the AI agent, in accordance with the principle of privacy by design.

GDPR Documentation: Data processing by the AI agent is documented in your processing record, including the purpose, legal basis, categories of data, retention period, and technical and organizational security measures.

Entities Subject to NIS2: For entities subject to the NIS2 Directive, deploying the agent is part of the required risk management measures, including business continuity planning (BCP, BCP) and resilience testing.

AI agent regulatory compliance: GDPR, NIS2, ISO 27001, AI Act

GDPR compliance (General Data Protection Regulation)

Data Protection Impact Assessment (DPIA): If the AI system processes personal data that may pose a high risk (health data, biometric data, criminal records, large-scale processing), a data protection impact assessment must be conducted prior to deployment.

GDPR security measures:

• Anonymization or pseudonymization of personal data when technically feasible
• Systematic encryption of sensitive data
• Strict access controls with the principle of least privilege
• Regular security testing and compliance audits

Rights of data subjects:

• Right of access: the user may request access to their data processed by the AI agent.
• Right to erasure: deletion of personal data upon justified request
• Right to object: the right to object to processing, and the right to human intervention in response to a fully automated decision that produces significant effects
• Right to rectification: correction of inaccurate or incomplete personal data

NIS2 compliance (Directive on the security of network and information systems)

Sectors covered by NIS2: Essential and important entities in critical sectors (health care, energy, transportation, finance, digital services, water, food, space, and public administration).

NIS2 security requirements:

• Cyber Risk Management with Formal Risk Analysis and Mitigation Plan
• Documented and tested security incident response plan
• Regular cyber resilience tests (penetration tests, crisis exercises, continuity tests)
• Reporting of significant incidents to the regulatory authority (ANSSI in France), with an early warning within 24 hours

ISO 27001 compliance (Information security management)

Information Security Management System (ISMS): The deployment of an AI agent is part of a documented security policy that has been audited in accordance with the ISO 27001 standard.

ISO 27001 security controls applied:

• Asset Management: Inventory of data and systems connected to the AI agent, and a registry of the agents themselves
• Data classification: public, internal, confidential, sensitive data
• Access controls: authentication, authorization, rights review
• Cryptography: encryption, key management, digital signatures
• Network Security: Segmentation, Firewalls, Intrusion Detection (IDS/IPS)

AI Act Compliance (European Regulation on Artificial Intelligence)

Risk Classification: The European AI Regulation (Regulation (EU) 2024/1689) classifies systems according to their risk level. Manyenterprise AI applications, such as customer support or document processing, fall under the minimal risk category. The high-risk uses listed in Annex III (hiring, creditworthiness assessment, access to certain essential services) are subject to stricter requirements.

Important Dates:

• Effective February 2, 2025: Requirement to train staff who use AI
• Effective August 2, 2026: Under the transparency requirements of Section 50, anyone interacting with an agent must be aware that it is an AI
• December 2, 2027: Implementation of the requirements specific to high-risk systems set forth in Annex III, postponed to this date by Regulation (EU) 2026/1744

Documentation: For high-risk systems, the regulation specifically requires technical documentation, logkeeping, and human oversight. For other agents, maintaining a log (purpose, data used, person responsible, level of autonomy) remains a best practice for governance, which facilitates any subsequent audit.

Regular security tests and audits of the AI agent

Security testing before going live

Before an AI agent goes live, thorough security testing is required to identify and fix vulnerabilities:

Penetration testing (pentests): Simulation of real-world attacks by cybersecurity experts to identify exploitable vulnerabilities (SQL injection, XSS, CSRF, privilege escalation).

Injection tests specific to IA agents:

• Prompt injection: attempts to manipulate the agent's behavior through malicious requests or content
• SQL injection: injection of malicious SQL code into queries
• Command injection: execution of unauthorized system commands

The ANSSI guide “Security Recommendations for Generative AI Systems” does not specifically address agents, but several of its recommendations apply directly to them: control the AI system’s interactions with business applications, limit automated actions when the AI processes uncontrolled inputs, and log processing activities.

Fuzzing tests for robustness: Sending malformed, random, or extreme inputs to verify that the AI agent correctly handles errors without exposing sensitive information.

Load and Resilience Testing: Validation of the AI agent's behavior under heavy load and in degraded conditions.

Regular security audits after deployment

After the system goes live, regular security audits—for example, quarterly— verify that the measures remain effective and that publicly disclosed vulnerabilities (CVEs) are patched promptly.

Automated scanning: Professional vulnerability scanners (such as Qualys, Nessus, or OpenVAS) detect known vulnerabilities in the AI agent's infrastructure.

Manual Code and Architecture Reviews: Security experts examine the code and architecture to identify logical vulnerabilities that scanners miss.

Security incident management and response plan

AI agent security incident response plan

In the event of a security incident involving the AI agent (attempted intrusion, data breach, abnormal behavior, account compromise), a formalized response plan is immediately activated:

Phase 1 - Detection and isolation (0-1 hour):

• Incident detection via security monitoring (SIEM, IDS/IPS)
• Immediate isolation of the IA agent to limit spread
• Blocking suspicious access attempts and revoking the agent's tokens and identity if necessary

Phase 2 - Forensic analysis (1-4 hours):

• Forensic Analysis of Audit Logs
• Identification of the root cause of the incident
• Assessment of the impact and potentially compromised data

Phase 3 - Correction and remediation (4-24 hours):

• Correction of the identified security flaw
• Implementation of the necessary fixes
• Correction validation tests

Phase 4 - Notification and communication (24-72 hours):

• Notification to the CNIL within 72 hours if personal data is compromised and the breach poses a risk to individuals (GDPR)
• Transparent communication with stakeholders (management, affected users)
• Complete documentation of the incident in the violation log

Phase 5 - Continuous improvement:

• Post-Incident Analysis
• Update of safety procedures
• Strengthening preventive measures

Crisis exercises and continuing education

Crisis simulation exercises (tabletop exercises) should be conducted regularly—ideally every six months— to test the teams’ responsiveness to a major incident involving the AI agent.

Continuing education for teams:

• Regular awareness training on cyber risks specific to AI agents
• Training in Emerging Attack Techniques (Prompt Injection, Data Poisoning)
• Sharing best practices in security and feedback

Pour aller plus loin sur chaque sujet : sécuriser MCP en entreprise (les connecteurs entre l'agent et vos outils), Microsoft Entra Agent ID (l'identité propre de chaque agent), superviser un agent IA en production (indicateurs et seuils de reprise en main) et gouvernance des agents IA (registre et responsables).

Frequently asked questions about AI agent security

What is the difference between a secure AI agent and a standard chatbot?

A secure AI agent encrypts data in transit (TLS 1.3) and at rest (AES-256), authenticates via the company’s SSO, using delegated permissions when acting on behalf of a user or its own identity when acting independently, and logs each of its actions. Unlike consumer-facing chatbots, sensitive data remains within your environment (private cloud or on-premises).

How long does it take to deploy a GDPR-compliant AI agent?

The timeline depends primarily on the sensitivity of the data being processed. A support agent handling non-sensitive data can be deployed more quickly than one processing HR, health, or financial data, which may require an impact assessment, comprehensive penetration testing, and approval from the DPO. GDPR documentation can be prepared in parallel with development.

What are the costs of ensuring an AI agent is compliant with security requirements?

Chez IT Systèmes, un agent IA coûte à partir de 5 000 € HT pour un agent monotâche, et jusqu'à 30 000 € HT pour une solution multi-agents. Pour un agent déjà en place, l'audit d'agent IA coûte 1 500 € HT par agent. Le budget de sécurité dépend du périmètre (analyse d'impact si le traitement présente un risque élevé, tests d'intrusion, journalisation, documentation de conformité) et se chiffre au cas par cas. À mettre en regard : en cas de manquement au RGPD, les amendes peuvent atteindre 20 millions d'euros ou 4 % du chiffre d'affaires annuel mondial.

Can an AI agent be hacked via malicious prompts?

Oui, l'injection de consignes malveillantes (prompt injection) est une menace réelle, d'autant plus pour un agent qui lit des contenus externes (courriels, documents, pages web). Les protections à combiner : validation stricte des entrées, isolation des contextes, liste blanche des actions autorisées, confirmation humaine pour les actions sensibles et surveillance des journaux au quotidien. Chaque tentative est enregistrée dans l'audit trail. Des tests d'intrusion spécifiques sont à prévoir régulièrement.

How can you demonstrate compliance during a CNIL audit?

By producing the record of processing activities, the impact assessment if the processing poses a high risk, the technical documentation (architecture, data flows, safeguards), subcontracting agreements, and audit logs, which are retained for a defined and documented period (between six months and one year, as recommended by the CNIL, or longer if required by law).

Internal links and additional resources

→ Understanding: Agent-Based AI: Definition, How It Works, and Business Applications

→ Leveraging Agents Over the Long Term: Agent-Based Infrastructure Operator: Definition, Role, and Selection Criteria

→ Find out: What ROI can you expect from an AI agent project in your company? - What productivity gains can you expect from AI agents?

→ Learn more: AI agents for businesses

→ Methodology: How to integrate an AI agent into your existing information system?

→ Which Solution to Choose: AI Agent vs. Chatbot—What Are the Differences for Businesses?

Sources: CNIL, Recommendation No. 2021-122 on logging; CNIL and the Council for AI and Digital Technology, note on agent-based AI, July 20, 2026; Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744; ANSSI, Security Recommendations for a Generative AI System; Microsoft Learn, Microsoft Entra Agent ID documentation.