Mapping of artificial intelligence usage
Somewhere in your company,
AI is working with your information.
Who is using AI with your data?
Your teams use AI without you even knowing how, where or why:
they hand company data to generative assistants.
Your subcontractors embed AI into their services.
Your customers use the data you send them.
Three circles, three blind spots.
An inventory of uses, an assessment of exposure, a charter to circulate.
Four modules to map the real uses of AI; executive committee, employees, subcontractors, customers;
and turn them into reports, signed evidence and a charter. Everything is driven from your client area.
Nothing is improvised, everything is measured.
01The groundWhat we observe
AI entered the company
without a written decision, and often in spite of you.
It did not arrive through a project, a budget or a committee. It arrived through employees saving time, and through providers who enriched their service without necessarily telling you.
The day someone asks what leaves the company; a regulator, a client, an insurer; “I believe so” will not be an acceptable answer. You will need an inventory, and it will need a date.
The principle
The blind spot is not AI. It is the absence of an inventory.
The question is the same for every organisation: who uses what, for what purpose, with what data. Vigiia is therefore generic; one survey protocol, one assessment grid, one reporting format, whatever your size and sector.
What changes from one company to the next is not the questions: it is the answers. And that is precisely what you do not have yet.
02The four modulesAll driven from the client area
Four watch posts.
One discipline: evidence.
Each module follows the same mechanics: a smart questionnaire, online reports, downloadable deliverables.
You activate the modules you need, in the order that suits you.
Module 01
AI strategy
The board module; so that those who govern can decide.
Where will your data be in 2030, and who will be able to reach it? The sovereignty diagnostic measures exposure on four axes, projects it into four scenarios and identifies the five decisions to put before the board.
- Executive questionnaire; 23 questions, 10 minutes
- Online report; axes, scenarios, blind spots
- Square prospective report; the company's own white paper
Module 02
Internal mapping
Your employees' AI usage; anonymous, therefore honest.
A questionnaire anonymous by design, sent as an email campaign with automatic reminders. Each employee leaves with an individual report, identified by a local code and never by name; the company gets the consolidated view, by department and by role.
- Employee questionnaire; anonymous, 8 blocks, reminders at D+10 and D+25
- Individual report; online, downloadable, with its own identifier
- Consolidated square booklet; online and PDF, for the account holder
Module 03
External mapping
Two campaigns: subcontractors and customers.
Your information travels beyond your walls: to those who work for you, and to those who work with your documents. Two declarative campaigns, named and signed, extending the assessment carried out under Article 28 of the GDPR.
- Provider questionnaire; reminders at D+8, D+16 and D+24
- Signed declaration per respondent; score out of 100 and certificate
- Customer questionnaire; reciprocal approach, reminders at D+8, D+16 and D+24
- Lists and square consolidations; each report tied to its sender
Module 04
AI usage charter
Your charter, written from your own choices.
Eighteen governance questions, and each answer writes a clause. The output: an eleven-article charter ready for legal review and internal release, with its roadmap, each measure tied to the article it makes effective.
- Governance questionnaire; 18 questions, 10 to 12 minutes
- Online charter; viewable, downloadable, printable
- Square shareable document; everything carried over
Charter written for a sample company, shop-exemple SAS, 312 employees; eleven articles and twelve dated measures.
03The methodFour steps
How the mapping is run.
01
Scope
You choose which circles to survey and which populations are involved. The survey can start with employees alone and extend later.
02
Questionnaires
Each population gets the questionnaire suited to its position, in its own language. Answers are declarative and aggregated, never nominal.
03
Consolidation
Usage is consolidated by department, by tool and by purpose. The exposure level of personal data is assessed for each.
04
Charter and priorities
The output is a usage charter to adapt and release, and an order of priority based on the exposure actually observed.
04The output
What you did not have before
What you obtain,
and what did not exist before.
Usage by department and by tool
What is used, by whom, for which tasks; including the tools nobody had declared.
The level of exposure
Which categories of data pass through those tools, and what that means under the GDPR.
Risk by subcontractor
An assessment of each provider's AI practices, extending the review carried out under Article 28.
Your customers' answers
What those you send data to declare, and the formal record of their answer.
The mapping is declarative and aggregated. It informs a management decision; it monitors no one.
05The client areaThe control room
You do not manage questionnaires. You run campaigns.
Invitations and reminders
Ready-made email sequences, pacing adapted to each audience: two reminders for employees, three for subcontractors and three for customers.
Live participation
Response rate per campaign, without ever de-anonymising employees: the total is known, never the names.
Register and consolidations
Each signed declaration is tied to its sender: score, level, date, viewable document. Each module produces its own summary, online and as a booklet.
06The three circlesData does not stop at your walls
What the mapping lets you decide.
An inventory
The AI usage of your whole ecosystem in one place: each with its report, each with its assessment.
A charter that holds
Built on your actual usage, not on a generic template nobody will follow.
An order of priority
You know what to handle first, based on the exposure actually observed.
The trace of the decision
Timestamped. That is what separates a vigilant company from a surprised one.
On the AI Act, we are clear.
Vigiia does not declare you compliant with the AI Act. It gives you what any process will ask for first: knowing where, how and by whom AI is used. The GDPR, however, is not waiting; any AI use involving personal data is already processing, and it is documented today.
07PricingIndexed on headcount
One price, indexed on your headcount.
| Company headcount | Year 1 | Following years | Discount |
|---|---|---|---|
| − de 20 | 50 € | 25 € | −50 % |
| 21 – 50 | 90 € | 45 € | −50 % |
| 51 – 100 | 150 € | 75 € | −50 % |
| 101 – 250 | 260 € | 156 € | −40 % |
| 251 – 500 | 440 € | 264 € | −40 % |
| 501 – 1 000 | 680 € | 408 € | −40 % |
| 1 001 – 2 000 | 950 € | 665 € | −30 % |
| 2 001 – 3 500 | 1 670 € | 1 169 € | −30 % |
| 3 501 – 5 000 | 2 520 € | 1 764 € | −30 % |
| 5 001 et plus | 4 500 € | 3 150 € | −30 % |
Annual prices excluding tax, for all four modules: strategy, internal mapping, external mapping and charter.
Two updates per year are included; they keep questionnaires, frameworks and report templates in line with regulatory requirements.
The “following years” price applies from renewal. Multi-entity groups and white label: on request.
08Questions
Before you get in touch
What people ask us
before getting started.
What is Vigiia, in practice?
Vigiia maps how artificial intelligence is actually used across an organisation. Four modules — strategy, internal mapping, external mapping and charter — produce a dated inventory of who uses what, for what purpose and with which data, then the deliverables that follow: online reports, signed declarations and a usage charter.
Does Vigiia make my company AI Act compliant?
No, and we do not claim it does. Vigiia provides the prerequisite any programme asks for first: knowing where, how and by whom AI is used. AI Act compliance then requires classifying systems and meeting the obligations attached to each risk level. The GDPR, however, already applies: any use of AI involving personal data is processing, and must be documented.
Are employee answers genuinely anonymous?
The internal questionnaire is anonymous by design: each participant is identified by a local code that lets them retrieve their own report, never by name. The company sees the participation rate and the consolidated view by department and role; it cannot trace an individual. The subcontractor and customer questionnaires are nominal and signed — that is their purpose.
Do I need a DPO or a lawyer to run the mapping?
No. The questionnaires are written to be understood without legal training, and the assessment is automated. A DPO or legal counsel remains useful to review the charter before release and to settle edge cases — but collecting and reporting requires no prior expertise.
How long does a full mapping take?
Count four to eight weeks depending on the size of the organisation and the number of populations surveyed. The executive questionnaire takes ten minutes, the employee one about fifteen; most of the elapsed time is reminders, set at D+10 and D+25 internally, and at D+8, D+16 and D+24 for subcontractors and customers.
Can I activate a single module?
Yes. The four modules are independent and can be activated in any order. Many organisations start with internal mapping, which gives the most immediate picture, then extend to subcontractors. The published price covers all four modules.
What does the AI usage charter actually contain?
Eighteen governance questions write eleven articles: scope, approved tools, prohibited data, human review, ownership of outputs, training, reporting, sanctions, revision. A roadmap is added where each measure is dated and tied to the article it enforces. The charter is delivered online, as a PDF and as a shareable square document.
Where is the collected data hosted?
On infrastructure located in the European Union, operated under European law. No transfer to a third country occurs in normal operation. Answers, reports and signed evidence remain exportable, and erasable on request.
How does Vigiia fit with the GDPR processing register?
The mapping feeds the register rather than replacing it. It surfaces the AI uses that constitute processing of personal data and that, more often than not, are not yet listed — generative assistants, transcription tools, analytics services. It is then for the controller to record them.
What happens if a subcontractor does not answer?
The campaign includes three reminders, at D+8, D+16 and D+24. A non-response is itself information: it is recorded, dated, and becomes a documented fact when the contract comes up for renewal or an incident is investigated.
Does the price cover regulatory changes?
Yes. Two updates a year are included in the subscription. They keep the questionnaires, assessment frameworks and report templates aligned with current requirements, with nothing to do on your side.
Does Vigiia replace an audit?
No. Vigiia is a declarative instrument: it collects what people and organisations declare, assesses it against a constant framework and keeps a time-stamped record. An audit verifies on documents and on site. The two complement each other — the mapping says where to look, the audit confirms what is there.