Dossier

Dossier 11 — Authorities (CNIL, FDPIC, European AI Office)

Faithful sentence-by-sentence translation of the French master text, aligned line by line; the French text remains the reference.

Master text: holding-seb-docs@a7df2793 · docs/dossiers-publics/en/11_AUTHORITIES.md

Download the PDF All dossiers

Use: presentation dossier kept ready for an inspection, a request for information or a voluntary step. No step is taken by this mission.
Identity: ethical cognitive infrastructure embeddable through an SDK; generalist brain; it does not talk. ELYSÉA is neither a companion, nor a chatbot, nor a coach, nor a therapist, nor a wellness product, nor a medical device.
Controller: Sébastien Sanna, Geneva sole proprietorship, not registered (holding-seb-docs:docs/juridique/AIPD_ELYSEA_2026-09-30.md:37@8560b37). No real users; sales closed.

A. CNIL (France)


What it expects	Qualification of the actors “on a case-by-case basis” (translation) [S-DRT-07]; DPIA if high risk [S-DRT-08]; list of authorised and prohibited uses on the deployer side [S-DRT-10]; for education, no consent as a basis, DPIA [S-DRT-11]; 2026 work on AI at work and in health [S-DRT-09].
What ELYSÉA presents	DPIA of 09-30, decision “authorised under conditions” (translation), 30 blocking measures (`holding-seb-docs:docs/juridique/AIPD_ELYSEA_2026-09-30.md:20@8560b37`); register (`holding-seb-docs:docs/juridique/REGISTRE_TRAITEMENTS_2026-09-30.md:3@8560b37`); breach procedure (`holding-seb-docs:docs/juridique/PROCEDURE_VIOLATION_DONNEES_2026-09-30.md:3@8560b37`); rights procedure (`holding-seb-docs:docs/juridique/PROCEDURE_DROITS_PERSONNES_2026-09-30.md:1@8560b37`).
Declared gaps	Supabase region eu-central-1 (Frankfurt), dashboard reading by Sébastien on 10-01 at 18:03, evidence M-I1 to be attached; paths to providers possibly outside the EU, being removed — OpenAI fallback, vector memory, voice (OpenAI TTS, Deepgram; removal from the brain decided on 10-01 at 11:27); reservation maintained until the deployment is verified (DPIA §0.2); DPIA not signed; no DPO appointed; EU representative (GDPR art. 27) mandatory and not appointed — mandate ready (`holding-seb-docs:docs/juridique/MANDAT_REPRESENTANT_UE_2026-09-30.md:1@8560b37`).
Decision	No opening before the 30 measures are carried out and proven on the deployed service (DPIA §6).

B. FDPIC (Switzerland)


What it expects	The FADP “directly applicable” (translation) to AI; transparency about the machine; impact assessment for high-risk processing [S-DRT-12] [S-DRT-13].
What ELYSÉA presents	The same DPIA (GDPR and revFADP framework); information to people under revFADP art. 19 (`holding-seb-docs:docs/juridique/INFORMATION_PERSONNES_2026-09-30.md:1@8560b37`).
Specific point	Swiss project holder serving EU customers: dual compliance FADP + GDPR/AI Act.

C. European AI Office


Its role	Implementation and enforcement of the AI Act; competence over general-purpose models and, since 2026/1744, over certain systems built on these models by the same provider [S-DRT-14] [S-DRT-02].
Qualification of ELYSÉA	Not a general-purpose model; not a high-risk system; art. 50 applicable from the first placing on the market (`holding-seb-docs:docs/juridique/AIPD_ELYSEA_2026-09-30.md:558@8560b37`).
Art. 5(1)(f)	Emotions locked to false, not modifiable (`elysea-core:functions/src/core/sdk/sdkAppService.ts:68@a5b9780e`).
Possible voluntary step	AI Pact, pillars I and II [S-DRT-15] (sheet F11).

D. What any authority can verify for itself

Point	Evidence
Control before / after the model	`elysea-core:functions/src/core/security/owaspInputGuard.ts:5@a5b9780e` · `elysea-core:functions/src/core/pipeline/validateLLMResponse.ts:1094@a5b9780e`
Trace per response	`elysea-core:functions/src/core/attestation/interactionAttestor.ts:4@a5b9780e`
Prohibitions that cannot be switched off	`elysea-core:functions/src/endpoints/sdkSurface.ts:139@a5b9780e`
Measurement protocol	`elysea-tests-e2e:audits/PROTOCOLE_CAMPAGNE_4BRAS_3TIRS_SCELLE_2026-08-28.md:3@c9898dd3`
Results	to be measured — campaign in progress

The repositories are private: read access is given to the authority on request.

E. Objections and answers

Objection Answer

You process health data. Settled in DPIA §2.1.2 (holding-seb-docs:docs/juridique/AIPD_ELYSEA_2026-09-30.md:228@8560b37).

Your transfers? Regions fixed by the code: Cloud Functions europe-west1 (EU), Firestore europe-west9 (EU), Bedrock eu-west-3 (EU), Vertex AI eu (EU). Supabase: eu-central-1, dashboard reading by Sébastien on 10-01 at 18:03 (evidence M-I1 to be attached). Transfers possibly outside the EU for providers whose region is not fixed by the code, including, on the deployed service, direct model access US_DIRECT (elysea-core:functions/src/core/llm/providers/claude.ts:23@8d2e50ec), removed in the upcoming version (elysea-core:audits/INVENTAIRE_SERVICES_EXTERIEURS_2026-10-01.md:1@b1c078ef); transfer basis not established. Full list: holding-seb-docs:00-architecte/conformite/SOUS_TRAITANTS.json.

Objection	Answer
You process health data.	Settled in DPIA §2.1.2 (`holding-seb-docs:docs/juridique/AIPD_ELYSEA_2026-09-30.md:228@8560b37`).
Your transfers?	Regions fixed by the code: Cloud Functions europe-west1 (EU), Firestore europe-west9 (EU), Bedrock eu-west-3 (EU), Vertex AI eu (EU). Supabase: eu-central-1, dashboard reading by Sébastien on 10-01 at 18:03 (evidence M-I1 to be attached). Transfers possibly outside the EU for providers whose region is not fixed by the code, including, on the deployed service, direct model access `US_DIRECT` (`elysea-core:functions/src/core/llm/providers/claude.ts:23@8d2e50ec`), removed in the upcoming version (`elysea-core:audits/INVENTAIRE_SERVICES_EXTERIEURS_2026-10-01.md:1@b1c078ef`); transfer basis not established. Full list: `holding-seb-docs:00-architecte/conformite/SOUS_TRAITANTS.json`.

F. Concrete next step

Sign the DPIA, appoint the EU representative, then keep this dossier ready. No notification or step is taken by this mission.

Dossier sources

S-DRT-02 · S-DRT-07 · S-DRT-08 · S-DRT-09 · S-DRT-10 · S-DRT-11 · S-DRT-12 · S-DRT-13 · S-DRT-14 · S-DRT-15