Deployment

Six weeks, one team.No conversation read.

Here is, very concretely, what happens when a French company decides to try Maison AI: who does what, what connects where, what Maison AI sees and doesn’t see, and what the law requires before you start.

Technical and legal framework as of October 11, 2026.

The case

Northstar Inc., a B2B scale-up with 1,180 people across Paris and Berlin. The head of sales sees her SDRs each using AI their own way. She wants to try Maison AI on a single team before going further.

Pilot team: The 24 SDRs in France
AI tool: One during the pilot, the one the company already uses
Directory: Microsoft Entra ID
Duration: 6 weeks, after the works council consultation

The timeline

The critical path isn’t technical: it’s internal approval. That starts first.

Before
Scoping and legal
Head of sales, DPO, legal, HR, works council
- Choose the scope (one team), the AI tool and a sponsor.
- Sign the data processing agreement (DPA) and approve the list of subprocessors.
- Run the data protection impact assessment (DPIA) with the DPO.
- Inform and consult the works council (CSE), and wait for the consultation to close before opening any access.
- Give every SDR an individual information notice.
Week 1
Connection
IT
- Add Maison AI as an application in Entra ID: SSO and SCIM provisioning, limited to the group of 24 SDRs.
- The org chart rebuilds itself from groups, job titles and managers.
Week 2
Context
Sales manager, 2 to 3 lead SDRs, legal
- Write the rules that always apply (confidential data, approved models).
- Formalize the team’s method (MEDDPICC, CRM conventions).
- Collect the best existing prompts from volunteers and turn them into the first skills.
Week 3
Delivery
AI tool administrator
- Add the Maison AI connector to the company’s AI tool, for the pilot group.
- SDRs install nothing: they sign in once, and their AI now knows their context.
Weeks 4 to 6
Pilot
The 24 SDRs
- Real daily use. Skills get rated, commented on, improved.
- Mid-point review with the DPO and the works council.
- End of pilot: adoption review by team, and the decision to extend or not.

Time required from the company

IT (directory, SSO): 4 to 8 h
AI tool administrator: 3 to 6 h
Security and DPO: 8 to 16 h
Sales team (methods, skills): 10 to 20 h

About 25 to 50 hours in total, excluding approval lead times.

What connects

Three connections, all standard. Nothing to install on laptops.

Your directory

Entra ID, Okta or Google Workspace

Teams and groups
Job title and manager

Maison AI

Hosted in the European Union

Context
Library
Learning loop

Everyone’s AI tool

The one the company already chose

MCP connector
Organization skills

How context reaches the AI tool

1Maison AI exposes a connector built on MCP (Model Context Protocol), now stewarded by a Linux Foundation project and adopted by the major vendors.
2The AI tool administrator adds it once for the pilot group. Each employee is recognized through their work account (OAuth backed by SSO).
3When the AI needs a rule, a method or a skill, it asks the connector. Maison AI answers based on where the person sits in the organization.

By AI tool, October 2026

Tool	Mechanism	Status
Claude (Team, Enterprise)	Remote MCP connector and organization skills, added by the admin	Available
ChatGPT (Enterprise)	MCP app published by the admin, workspace skills	MCP in beta
Microsoft 365 Copilot	Declarative agent with MCP, deployed from the admin center	Available
Gemini Enterprise	Custom MCP server registered by the admin	Depends on plan

One tool during the pilot: covering several doubles the effort. Maison AI doesn’t change where your conversations are stored; that stays with your AI vendor.

What Maison AI sees, and what it doesn’t

When the AI calls the connector, it sends the name of the requested tool and its parameters, not the conversation history. Our parameters are closed (a skill identifier, not free text): content can’t pass through.

Maison AI sees

The minimal org chart: name, work email, team, job title, manager.
Which skill or rule was requested, by which role, when, and in which version.
The ratings, feedback and improvements employees choose to share.

Maison AI doesn’t see

The content of conversations with the AI.
Files, emails or CRM data.
Employees’ personal AI accounts.
Your AI vendor’s compliance logs: we don’t ask for them.

This is guaranteed by the architecture, not just by a policy: the data is never collected.

Three levels of learning

The learning loop doesn’t read prompts. It learns at three levels, which the company switches on one at a time.

1 · Usage

What is learned: Which skills are used, by which teams, which ones are ignored. No content at all.
Who: The whole pilot group
What the law requires: Prior individual notice, works council consultation, DPIA recommended.

2 · Contributions

What is learned: What employees share themselves: a prompt that works, an improvement, a reported problem.
Who: Anyone, when they choose to
What the law requires: Covered by the overall DPIA. The voluntary act is an extra safeguard.

3 · Panel

What is learned: Volunteers tag the category of task they’re working on, from a closed list. Patterns only appear in aggregate.
Who: Volunteers, recruited outside the reporting line
What the law requires: DPIA required in practice. Pseudonymization, aggregation threshold, short retention.

Level 1 measures adoption of what already exists. Spotting repeated tasks that don’t have a skill yet takes levels 2 and 3, which is why they rely on volunteers.

The legal framework in France

What applies to the deploying company, in plain terms. To be confirmed with your DPO and counsel, who know your context.

French Labor Code

L2312-8 and L2312-38From 50 employees, the works council (CSE) is informed and consulted on new technologies and on any means that allow employee activity to be monitored. Before the decision, so before the pilot. Source ↗
Case law 2025-2026Several French courts have suspended AI pilots launched before the consultation closed, even when use was optional. Source ↗
L1222-4No information about an employee may be collected by a system that wasn’t disclosed to them beforehand. That includes level 1 usage data. Source ↗
L1121-1Any restriction must be justified and proportionate. Each level of data must be able to show it. Source ↗

GDPR

Legal basisThe employer’s legitimate interest, documented. An employee’s consent is rarely considered freely given. Source ↗
Art. 28The company is the controller, Maison AI the processor: a DPA sets instructions, security, subprocessors and what happens to the data.
Art. 35An impact assessment is recommended from level 1, and needed in practice for level 3 (employees, systematic collection, innovative use). Source ↗
MinimizationFrance’s regulator (CNIL) fined an overly intrusive activity-tracking tool in 2024. No time tracking, no screenshots, no content. Source ↗

AI Act

Annex III and Art. 6A system that evaluates employees’ performance or behavior is high-risk. Maison AI delivers context based on the role and produces no individual score or profile: it stays outside. Source ↗
Art. 5Inferring emotions in the workplace is prohibited. No tone or sentiment analysis, by design. Source ↗
Art. 4Companies must support their staff’s AI literacy. Shared methods and skills contribute directly.

Is working only with volunteers enough?

No, but it’s essential.

At work, consent is rarely free, and volunteering doesn’t exempt you from consulting the works council. It remains a strong safeguard, as long as it’s genuine.

The works council consultation, closed before the first access.
Individual notice to every participant.
An impact assessment (DPIA).
The right to withdraw at any time, with no reason and no consequence.
A written ban on any HR or disciplinary use.
No manager access to the list of participants.

Our commitments

No individual evaluation

No score, no ranking, no named export. Prohibited by contract, absent from the product.

No conversation content

The connector’s parameters are closed: content doesn’t pass through.

Aggregation threshold

No pattern shown below a minimum number of people, set with you in the DPIA.

Hosted in Europe

Data encrypted in transit and at rest, hosted in the European Union.

No training

Your data trains no model, neither ours nor our subprocessors’.

Access log

Available to your DPO and your works council.

The checklist

Before the pilot

Written AI Act qualification: purpose, exclusion of any evaluation.
DPA signed, subprocessors listed, EU hosting, no-training clause.
Records of processing and legitimate interest assessment, per level.
DPIA with the DPO’s opinion.
Works council consultation closed.
Individual information notice and AI usage policy.

During

Level 1 only by default; volunteer panel recruited outside the reporting line.
Aggregation threshold, pseudonymization and deletion verified.
Mid-point review with the DPO and the works council.

Before extending

DPIA updated with lessons learned.
New works council consultation if the scope changes.
Watch list: CNIL guidance on AI at work, AI Act deadlines.

Want to run this pilot?

We prepare the file for your DPO and works council with you, before the first line of configuration.