If you sell software, data, or any B2B service “augmented by AI,” a new stakeholder will quickly appear in your deals: INESIA (National Institute for AI Evaluation and Security). Created in 2025 and bringing together ANSSI, INRIA, LNE and PEReN, INESIA just published its 2026–2027 roadmap with a clear mission: provide tooling for AI risk assessment and reinforce implementation of the AI Act in France.
Translation for SME founders and CIOs: soon your customers — and their legal teams — will no longer ask only “does it work?” but “is it measurable, auditable, and defensible?”
The Opportunity for SMEs
The upside is real: this creates a strong differentiation lever. INESIA structures 11 projects around three pillars: regulatory support (AI Act), expertise on systemic risks and AI agent systems, and open challenges for performance and reliability. Gradually, AI compliance will shift from a checklist to explicit buying criteria.
For a B2B SME, being “INESIA-ready” can become a commercial asset: faster responses to security questionnaires, shorter procurement cycles, stronger reassurance for hesitant enterprise accounts, and a real reduction in the risk of a late-stage no-go during RFPs.
Key point: INESIA promotes a model of sovereign evaluation, with the prospect of certifications and audits by recognized third parties. If you arrive early with clean documentation, traceability, tests, and a resilient architecture, you build credibility — without waiting for mandatory rules to land.
What to Watch For
The flip side: preparing for evaluations takes time and budget (even if fees, timelines and deadlines aren’t specified yet).
- Increased audit workload: the push toward “certified third-party auditors” means procedures, evidence, and likely technical iterations.
- Timing uncertainty: the 2026–2027 roadmap doesn’t impose requirements today, but it sets direction. Ignoring it = risk of frantic catch-up later.
- Regulatory lock-in: aligning too early with criteria that may shift can trigger costly rework. The challenge is to be ready without over-specializing your product to a moving target.
- Upgraded AI cybersecurity: the SEPIA project (led by ANSSI) is developing cybersecurity evaluation methods and penetration tests delegated to third-party auditors. Practically: harder architectures, stricter input/output controls, and increased resistance to attacks (prompt injection, exfiltration via RAG, etc.).
The Compliance Angle
AI Act (EU): INESIA positions itself as France’s technical arm for implementation. If you operate (or supply) high-risk AI systems, expect to demonstrate compliance through more structured evaluations.
GDPR: an indirect but tangible impact. AI evaluations typically require traceability, a data inventory, justification of processing, anonymization/pseudonymization, and often a DPIA (Data Protection Impact Assessment) when personal data and high risks are involved. Even if your AI is “technical,” your customer is thinking in terms of data and accountability.
nLPD (Switzerland): less central, but if you serve Swiss clients they will ask for equivalent documentation — so harmonization is in your interest.
Conclusion & Cohesium Support
INESIA won’t rewrite your product roadmap overnight, but it will reshape the market: AI compliance becomes a commercial asset and a prerequisite for trust. Rather than improvising, Cohesium AI helps in two pragmatic ways:
- AI Act Audit + “INESIA-Ready” Assessment: review your AI workflows (agents, RAG, LLMs), prepare you for SEPIA-style cybersecurity evaluations, identify gaps, and deliver actionable recommendations. If needed, we also help frame hosting choices to match your constraints (Exoscale, OVH, Infomaniak, AWS regions Paris/Zurich, etc.).
- 2026–2027 Compliance Roadmap: governance, documentation, team acculturation, and preparation for third-party certified audits — without over-optimizing for criteria that may still evolve.
If you prefer craftsmanship over mass production — building secure, auditable, and defensible AI rather than fragile, generic stacks — let’s talk. We offer custom integration and strategic audits tailored to your product and market position. Contact us