Healthcare · France · hospitals, agencies, vendors
Healthcare AI, in production. On protected data.
AI projects are multiplying across hospitals and health agencies, and so are vendor offers. Few move from pilot to real service, and access security often lags behind usage. We build with your teams: a use case that actually helps, protected health data, clear rules, and people who can run it.
We have worked inside critical infrastructure: 24/7 hospital migrations, sovereign cloud, ISO 27001 and HDS environments. We bring the same standard to AI.
What changes in 2026–2027
French authorities have raised the bar. The figures below come from their own publications.
- 21%
- of responding hospitals have formalised no AI charter, no AI strategy and no data strategy.
- Igas, IGF and IGA report, July 2026, based on the FHF barometer
- 17 of 57
- AI use cases identified in regional health agencies in early 2026 are actually deployed. The other 40 are still pilots.
- Igas, IGF and IGA report, July 2026
- 90%
- of surveyed healthcare organisations have no formal channel to report a vulnerability to their software vendors.
- ANS survey, Cert santé and Cert-FR report, October 2026
- 11 Dec 2027
- The Cyber Resilience Act applies to software placed on the market: secure by default, security updates for at least five years, vulnerability reporting.
- EU regulation, ANS and Anssi
Who it is for
- Hospitals and hospital groups
- University hospitals, general hospitals, private clinics, care homes. You have AI projects, vendor offers and teams pulled in every direction. You need simple governance and a first use case that holds in production.
- Regional health agencies and administrations
- Inspections, complaints, authorisations, financial analysis of care providers: use cases already identified, often stuck in pilot. We take them to real service, with tools that can be reused across teams and regions.
- Healthcare software vendors
- The Cyber Resilience Act and NIS 2 change your obligations: access, secrets, vulnerability and patch management. We help your product teams fix the basics and add AI without opening new gaps.
How we work
Our See · Build · Own method, applied to healthcare constraints: medical confidentiality, sensitive data, public procurement, teams already stretched.
01
See: use cases, access, data
In a few weeks, we map the AI uses already in place or planned, including consumer tools used without a framework. We look at who can access what in the software that holds health data: authentication, care-team permissions, logging, detection of abnormal access. You leave with a short charter, a prioritised list of use cases and the basic gaps to fix first.
02
Build: a use case in production, not a demo
We pick a use case that genuinely relieves a team: record summaries, complaint handling, inspection preparation, drafting support, document triage. We build it with them, on infrastructure that meets your constraints: HDS-certified hosting, Mistral or self-hosted open-source models when data must not leave. Every assistant or agent has a written mandate: what it reads, what it does, where a human signs off. What it produces goes back into your records.
03
Own: teams that run the tool
Your teams learn by building: staff, digital leads, IT, security officers, management. Code, documentation and data stay with you. We add security and AI criteria to your tender specifications, so your next purchases require what the Cyber Resilience Act will enforce.
What you get
- AI governance sized for you: a charter, a list of use cases, rules for informing patients and staff.
- A first use case in production, measured, on protected health data.
- Access security basics fixed: multi-factor authentication, care-team permissions, logging and alerts on abnormal access.
- Ready-to-use procurement criteria for your tenders: security, vulnerability management, reversibility, data hosting.
- Teams trained on their own cases, with Ownward available for the next step.
Questions we get asked
Do you host our health data?
No. Data stays in your information system or with an HDS-certified host you choose, including French sovereign operators. We design and build; you keep control of hosting and access.
Can we use AI without sending health data to a US provider?
Yes. Mistral offers European models, and open-source models can run on your infrastructure or with an HDS host. For many use cases, data can also be pseudonymised before any processing. The choice depends on the task; we document it so you can change it.
Do you replace our IT or security team?
No. We work with them and for them. Our job is to deliver a concrete use case and leave your teams more autonomous than before, not to create dependency.
Does the Cyber Resilience Act concern us?
It applies to software vendors from 11 December 2027, except medical devices, which have their own rules. Hospitals are concerned as buyers: Anssi recommends adding cybersecurity criteria to tender specifications. Now is the time to write them.
Where do we start?
With a conversation about one specific use case or one specific concern: a stalled AI project, a vendor offer to assess, an access review to prepare. We then propose a short first scope with a visible result.
Go further
A use case that serves your teams, on protected data. Let’s talk.
Contact usOur future SaaS products
We also build tools you can make your own.
Alongside tailored delivery, Ownward is building three independent products, designed from scratch for multiple organisations, clients and activities.