Alongside Google, Microsoft, OpenAI, and Salesforce, Zaion is among the organizations for which the OECD has published a transparency report as part of the G7-initiated Hiroshima AI Process (HAIP). We are proud of this recognition, and it reinforces our commitment, as our practices are now available for everyone to review.
HAIP: An International Framework for Safe and Transparent AI
Launched by the G7 in 2023, the Hiroshima Process on AI established guiding principles and an international code of conduct for organizations that develop advanced AI systems. At the request of the G7, the OECD subsequently created a reporting framework to monitor the implementation of this code.
Specifically, each participating organization completes a questionnaire structured around the 11 actions outlined in the code of conduct:
- risk identification and assessment;
- information security and data protection;
- transparency with users;
- governance and incident management;
- Research and investment in safer AI.
The full report is published on the OECD platform. This is a voluntary and public initiative: customers, partners, regulators, and competitors can read our responses. That is precisely what makes it valuable.
Why Zaion Is Included
Following an invitation extended after Franz Fodéré, Zaion’s founding president, participated in the G7 Digital and Tech7 Summit last May, Zaion now represents a French company specializing in conversational AI for customer relations at these events .
This perspective is all the more valuable given that our AI agents interact daily with customers in industries where standards are among the highest, and where mistakes come at a real cost.
1. Trust is built from the very beginning
At Zaion, data protection isn’t an afterthought—it’s built into the architecture. In practical terms, this translates into five technical choices:
- Masking occurs before any third-party model is used. Emails, phone numbers, bank account information, and Social Security numbers are replaced with placeholders before being fed into a language model, and are then restored only in the response to the customer.
- Caution by default. A word is masked as soon as there is a 10% probability that it is personal data. If the audio alignment is deemed unreliable, the entire statement is masked rather than risking a partial leak.
- Our shared services do not store any conversations: they are processed in memory and deleted after each request.
- Hosting in Europe, databases in France, AES-256 encryption at rest and TLS encryption in transit, and per-client isolation.
- Your data remains yours. It is never used to train our suppliers' models or to serve other customers.
And because trust also depends on honesty with the end user, every person we interact with is informed, right from the start of the conversation, that they are speaking with an AI agent.
2. Autonomy must take place within a controlled framework
An AI agent that takes action must remain under control. At Zaion, it is the client who defines what the agent is allowed to do.
- Only authorized actions—and nothing else. Each AI agent can perform only the actions and use only the tools specified by the client company.
- Automatic safeguards. Limits on the number of steps, loop detection, and per-conversation budgets: an agent that fails to converge is interrupted and hands off the call.
- A human backup when understanding is uncertain. A human backup when understanding is uncertain. As soon as the confidence level drops, the interaction is transferred to an agent, and only the requests that the AI agent can handle reliably are automated.
- Complete traceability. Every step and every tool request is reported to the client: the organization in charge can see exactly what the agent did.
We consider the following four situations to be unacceptable without appropriate measures: a caller in distress who cannot reach a human; a decision with significant consequences made without human review; an interaction in which the user is unaware that they are speaking to an AI; and voice recognition that performs poorly for an identifiable group of users.
3. Technology must be proportionate to its intended use
We assess risks based on their consequences for the user (severity, reversibility, scope) within the actual context of each deployment.
That is the principle behind our hybrid approach: the right intelligence, in the right place, with the right level of control.
- Sensitive steps, such as identification or authentication, are based on deterministic, stable, and explainable logic.
- Generative AI comes into play where fluidity creates value, grounded in knowledge sources validated by the client.
- The lightest models (NLU, SLM) are preferred when they are sufficient: they are faster, easier to manage, and more efficient in terms of computational resources.
These practices are part of an AI management system aligned with the ISO/IEC 42001 standard and integrated into our ISO/IEC 27001 security program, under the direct responsibility of our CISO and senior management.
The voice of a French actor—responsible and independent
Alongside the major American and Asian players in AI, our contribution offers a different perspective: that of an independent French software company, a pioneer in voice technology since 2017, that faces the demands of large enterprises and regulated industries every day.
For these organizations, the question is no longer whether generative AI works. It is whether it can be deployed in a controlled manner on a large scale. Our conviction is clear: mastering AI is a prerequisite for its widespread adoption.
Further Reading
- View Zaion's transparency report on OECD.AI.
- Are you deploying AI agents in a regulated environment? Talk to our experts.
