What is a business AI audit and what is it for?

In our AI audits, we start from your processes, your data, your tools, and, when they already exist, your AI usage. Our goal is to identify integration opportunities with you that can generate the biggest gains in time or cost, while comparing them directly with the cost required to implement and operate them over time.

With our AI experts, we then perform a technical feasibility study of the different use cases identified and analyze their main risks. Each opportunity can then be compared by return on investment, technical prerequisites, data needs, complexity, and the conditions required for deployment.

Koragence therefore provides a prioritized map of AI integration opportunities, along with an estimate of the gains, implementation and operating costs, required infrastructure, and a roadmap. The final goal is simple: decide for each use case whether to launch it, prepare it over time, or drop it.

How do you identify the best AI use cases for a company?

We start by analyzing the current cost of the processes: monthly volume, human time used, manual tasks, re-entry, synchronization between tools, information search, and the potential cost of errors. This first measurement makes it possible to know precisely what an AI project should improve to become truly profitable.

We then compare those costs with the costs of the proposed solution: development, models and APIs, infrastructure, maintenance, and human supervision. We also include security and compliance constraints: GDPR, confidentiality, access rights, and, when the project involves hosting personal health data in a context covered by the HDS framework, that constraint is integrated into the choice of architecture and providers.

During the audit, we also assess the company’s AI maturity across four dimensions: strategy, technology foundations, team skills, and the ability of processes to evolve. An excellent use case cannot be properly industrialized if data is unreliable, systems do not communicate, or users do not yet have the framework needed to operate the tool.

For each opportunity identified, we can therefore deliver a simple diagnosis: ready for a POC, data or integrations to prepare, governance and security to frame, or project to defer. This avoids launching a technically appealing experiment when its success conditions are not yet in place.

How do you calculate the ROI of an AI project before building it?

An AI integration project can cost less or more than classic automation depending on the complexity of the process. Its development cost is only part of the story; there is also a variable operating cost: API calls, tokens consumed, data volume, infrastructure, possible storage, monitoring, and human interventions.

Model choice therefore has a direct impact on ROI. The most advanced models are not needed for every task: classification, document extraction, data normalization, or some structured outputs can often work with smaller and far less expensive models. The most powerful models become more relevant when reasoning, ambiguity, or context complexity require them.

We also recommend a follow-up phase after go-live: measure cost per treatment, response quality, human interventions, errors, and actual volumes. This observation makes it possible to optimize model choice, prompts, upstream rules, and request routing to progressively reduce operating costs.

How do you audit data before an artificial intelligence project?

Data is a major part of this analysis. We verify the sources of truth, duplicates, quality, freshness, access rights, and technical availability. A long history is essential for some predictive uses, but much less so for others, such as document search. The goal is to ensure each use case has the data it really needs, accessible with the right permissions.

The question is not just whether the company has a lot of data, but whether it is reliable, accessible, and fit for the use case. We then look at how AI will access it. An API or dedicated integration layer, for example, can expose only the data needed for processing rather than giving an agent or model much broader permissions.

This least-privilege logic improves confidentiality, security, and system readability at the same time. For organizations with an ISMS structured around ISO/IEC 27001, the project must also remain consistent with existing access control, information classification, and risk management policies. If ISO/IEC 27007 is kept in the framing, it concerns guidelines for auditing information security management systems.

How do you secure ChatGPT, Copilot, Gemini, and Shadow AI?

In our audits, we check which data can or cannot be sent, with what type of account, which retention policies apply, whether the data may be used to improve models, where it is processed, and what confidentiality, ownership, and data-control rules apply. These conditions depend on the provider, the product used, the type of account, the API, and, where applicable, the enterprise contract.

For example, some providers and offerings can expose very different retention settings depending on the use context. The audit is precisely there to select and configure the offers that match the desired level of security, retention, and confidentiality rather than assuming a single provider behaves identically across all of its products.

Data sovereignty is also part of the analysis. In June 2026, IBM reported that 68% of surveyed executives found it difficult to meet residency and sovereignty requirements across multiple geographies. Depending on the constraints, we can therefore study European residency, private infrastructure, or locally run models. A local or on-premises AI can provide greater control over data and infrastructure, but it also shifts more security, maintenance, and operating responsibilities to the company.

AI audit and the AI Act: what should be checked in 2026?

An AI Act audit starts by identifying which AI systems are actually being used, for what purpose, and what the company’s role is. An organization using a third-party tool is generally in a different position from one that develops and commercializes a system itself.

Since 2 August 2026, Article 50 has imposed transparency obligations for certain systems: informing a person when they interact directly with AI, enabling the identification of certain generated or manipulated content, and in some cases informing about deepfakes, emotion recognition, or public-interest texts generated without editorial control.

AI literacy is also a concrete topic. Article 4 requires providers and deployers to take measures to develop AI knowledge among the people using these systems on their behalf, taking into account their skills, the context, and the risks.

Finally, when a future use case could fall under high-risk systems, the audit can anticipate the associated requirements: risk management, data quality, documentation, traceability, human oversight, robustness, and cybersecurity. The rules applicable to Annex III high-risk systems are now scheduled from 2 December 2027.

How do you audit an AI agent that can act inside your software?

An assistant that suggests a response and an AI agent capable of acting inside a CRM, messaging system, or ERP do not present the same level of risk. For each agent, we examine the accessible tools, the permissions granted, the data available, and the actions it can perform without validation.

Sensitive operations can be surrounded by explicit limits: human validation before irreversible action, amount or volume caps, minimal rights, dedicated technical accounts, action logging, and cancellation or replay mechanisms. The CNIL notes that agentic AI introduces more complex and sometimes opaque processing chains when tasks are delegated to the system.

The goal is therefore not just to ask “does the agent work?”, but how far can it act when it makes a mistake? That question helps define the right level of autonomy before deployment.

How do you avoid dependence on a single model?

A project should not become dependent on a model simply because it was the best one at POC time. Prices, performance, usage limits, and available models can change quickly. During the audit, we therefore look at where the real dependency lies: API, data format, proprietary functions, infrastructure, prompts, evaluations, or integrations.

When the use case justifies it, the architecture can isolate the AI layer from the rest of the process to make model changes easier. A shared evaluation set then allows multiple providers to be compared on the same criteria: quality, speed, cost, and error rate. The goal is not necessarily to run multiple models all the time, but to keep a credible replacement capability.

This risk is real: in the IBM study published in June 2026, 71% of surveyed executives said it was difficult to switch their main provider or model, and 91% said they did not fully understand their dependencies between vendors, models, and infrastructure.

How do you validate an AI POC before industrialization?

A proof of concept must prove more than a model’s ability to answer a few examples correctly. Before we even begin, we define the criteria that will determine whether the project deserves to be industrialized: minimum quality, actual time saved, cost per treatment, human intervention rate, acceptable latency, and error count.

The test must then be run on data and situations representative of real operations. This is often where the real issues appear: unexpected documents, permissions, larger volumes, model errors, API downtime, or cases that ultimately require human validation.

Going into production therefore means turning a demo into an operational process: monitoring, user rights, logs, fallback rules, human control, cost measurement, and a clearly identified owner. Only when these elements are under control does a POC become a truly industrialized AI integration.

What deliverables should an AI audit include?

Koragence therefore provides a prioritized map of AI integration opportunities, along with estimates of gains, implementation and operating costs, the infrastructure required, and a roadmap. The final goal is simple: decide for each use case whether to launch it, prepare it over time, or abandon it.

A good deliverable should not stop at a list of technologies. It must help the company make quick and clear decisions between projects to launch, projects to prepare, and projects to drop.

AI tool, API, or custom development: which solution should you choose?

An AI audit should not automatically lead to custom development. An existing SaaS is often better for standard needs, while an API integration becomes interesting when the chosen model must be connected to internal data and workflows.

Custom development makes more sense when the project requires several business systems, special permissions, a dedicated interface, or company-specific complex logic. The right diagnosis should therefore prioritize, reject, and then build only what has demonstrated value.