Nexora
when AI reveals the limits of fragmented governance
The company name and certain details have been changed to protect the client's confidentiality.
Executive summary:
Before integrating artificial intelligence into its operations monitoring platform, Nexora had robust but siloed risk management systems. The lack of a consolidated view made it impossible to take coordinated decisions in the face of multi-dimensional risks. By establishing multidisciplinary governance, a shared risk register and controls built in from the design stage, Nexora rolled out its AI system without any compliance breaches, whilst reducing decision-making time by 40 % and data exposure by 35 %.
Introduction
Nexora is a mid-sized European technology company. It offers its clients an operations monitoring platform capable of detecting anomalies, reporting incidents and helping teams anticipate service interruptions.
The company was not starting from scratch. It already had a risk management team, a Chief Information Security Officer (CISO), a Data Protection Officer (DPO) and several monitoring tools. Operational incidents were tracked, system access was controlled, and personal data processing activities were documented.
Taken separately, each of these mechanisms seemed satisfactory. But it was precisely this appearance of solidity that long masked a structural vulnerability: these mechanisms operated in silos.
The problem
A subtle yet profound fragmentation
Each of Nexora's functions had its own indicators, vocabulary and escalation procedures. The operational teams monitored service continuity. Cybersecurity handled vulnerabilities and technical incidents. The DPO intervened on personal data processing. The data team measured model performance.
None of these devices communicated with each other. None provided a consolidated, company-wide view of risk. This fragmentation remained relatively discreet, until the day Nexora decided to integrate artificial intelligence into its platform.
A project that exposes the flaws in the organisation
The new system was designed to analyse large volumes of data in real time in order to detect unusual patterns and anticipate certain operational incidents. At first, the project seemed essentially technical. However, several questions quickly arose.
Certain data used to train the model contained information relating to users, employees or customers. Technical logs could reveal individual behaviours. The system also had to access several internal applications, thereby increasing the attack surface.
Each of these questions was known to a team. None of them was examined as a whole.
The same event, four different but uncoordinated readings
During a test, the system flagged the activity of several users as anomalous. The operations team saw this as a potentially useful alert. The data team sought to find out whether the model was sufficiently accurate. Cybersecurity considered the hypothesis of a compromised account. The DPO questioned the justification for behavioural analysis.
These readings were not contradictory. They described different dimensions of the same event: an operational risk, a model risk, a cybersecurity risk and a privacy risk. Handled in four separate channels, they could lead to inconsistent decisions, or even create significant blind spots.
The main risk was therefore not the lack of expertise. It lay in the absence of a mechanism allowing the expertise to be linked together.
The solution
Nexora realised that integrating AI into its operations could not be governed as an isolated project. The company implemented a structured approach based on four key decisions.
Bring together responsibilities around a shared risk
Nexora has put together a multidisciplinary team bringing together business lines, data, cybersecurity, legal, data protection and risk management. Far from diluting responsibilities, this structure has formalised them: every risk has been assigned an owner, every control a manager, and every major decision a clearly identified authority.
The team drew up a joint mapping document (system purpose, data used, technical dependencies, individuals potentially affected, foreseeable risks) feeding into a shared register. From then on, teams no longer merely sought to find out whether their own control was satisfactory. They had to determine whether the overall risk was sufficiently under control to authorise moving on to the next stage.
Data protection by design
Nexora examined the data genuinely necessary for the system to function. Certain variables were deleted, others aggregated or pseudonymised. Retention periods were defined according to actual needs, access was restricted to authorised personnel, and test data was separated from the production environment.
This approach is in line with the GDPR principle of data minimisation and the CNIL's recommendations: defining precisely the purpose of the system, the expected results and the strictly necessary data prior to any development. A data protection impact assessment was conducted not as a document produced at the end of the project, but as a design aid tool.
3. Design cybersecurity with the system, not around it
Cybersecurity was not added as an afterthought. The team analysed the risks specific to the entire lifecycle (tampering with training data, input manipulation, excessive access, compromise of third-party components) and integrated measures from the design stage: access control based on the principle of least privilege, environment segregation, model version traceability, monitoring of unusual behaviour, and joint procedures for incident qualification and escalation.
This approach aligns with the NIST Cybersecurity Framework 2.0, which ties cybersecurity to overall enterprise risk governance.
Train, test and monitor over time
Nexora has implemented training tailored to the various roles: developers have been trained in security and data protection by design requirements; operational users in interpreting results and reporting anomalies; and decision-makers in the system's limitations and suspension conditions.
Before deployment, a limited pilot made it possible to test not only the performance of the model, but also the flows of information between teams: could an alert be transmitted quickly to the relevant functions? Did the organisation know who could suspend the system?
Following deployment, monitoring gathered technical and organisational indicators: model performance, false positives, security incidents, complaints, unexpected uses and the effectiveness of corrective measures.
Results
Nexora's governance overhaul has produced measurable and lasting results:
- a 40 % reduction in decision-making time, achieved by eliminating conflicting approvals between departments; ;
- a 35 % reduction in data exposure, achieved through data minimisation and the principles of protection by design; ;
- complete traceability of design decisions, controls and risk trade-offs, with documented ownership and accountability at each phase; ;
- no compliance violations during the deployment of the AI system; ;
- a consolidated view of operational, cybersecurity, privacy and technical risks in a single shared register; ;
- a successful transition from siloed incident management to a coordinated response, enabling simultaneous assessments across technical, security, privacy and operational dimensions.
Conclusion
Nexora's experience illustrates a reality that many organisations discover when integrating AI into their operations: having robust controls is not enough if these controls do not communicate with one another.
The most important outcome is not the creation of an additional committee. It is the establishment of a common decision-making process: a shared vocabulary, a unified register, validation points at each stage of the lifecycle, and traceability of trade-offs. This organisation does not eliminate all risks. It makes it possible to see them, link them together and make informed decisions.
As Nexora's AI systems mature, this governance infrastructure provides a foundation upon which the company can build to expand its capabilities while maintaining control over its risks. The defining question is no longer just «Do we have controls in place?», but rather «Do these controls give us a shared view of risk and the ability to act together?»
Do you use AI in your organisation?
Foire aux questions (FAQ)
Because an AI system can simultaneously create operational, technical, legal, cyber and human risks, a multidisciplinary team allows these dimensions to be confronted before a decision is made. However, its effectiveness requires clearly defined responsibilities and decision-making power.
No. Training helps employees understand the rules and detect risky situations, but it must complement concrete measures: access limitation, data minimisation, documentation, risk analyses, technical controls and incident procedures.
It consists of selecting data that is adequate, relevant and genuinely necessary for the purpose of the system. It does not automatically prohibit the use of large volumes, but requires the organisation to justify the categories, sources, historical depth and level of precision retained.
Because certain architecture, access, logging, or vendor selection decisions are difficult and costly to fix after deployment. Integrating security by design helps reduce risk exposure throughout the system's lifecycle.
AI governance must be linked to existing mechanisms: enterprise risk management, data protection, cybersecurity, compliance, procurement, incident management and business continuity. A shared register, common criteria and coordinated escalation procedures make it possible to avoid the creation of a parallel structure.
