Your AI rules. Enforced everywhere.

Why we built Qastel

Today, we're launching Qastel.

My co-founder Nordine Marie and I spent years at Microsoft building the technology that helped companies adopt AI. I was there for more than fifteen years, most recently as Group Product Manager for Copilot AI tools. Nordine was a senior engineer working on Copilot Studio and Power Automate AI.

Working closely with enterprise customers, we saw first-hand that AI governance was becoming one of their biggest challenges. Companies were eager to adopt AI but struggled to control how it was used, what data was shared and what actions AI systems should be allowed to take.

Across the enterprise landscape, AI adoption was spreading well beyond officially approved systems. Employees were turning to personal AI accounts, business teams were building agents connected to company data, and software vendors were embedding AI into applications their customers already used. Much of this was happening outside traditional IT governance processes.

Traditional governance processes weren't designed for this reality. Security teams were expected to control a growing number of AI systems, while business teams lacked the tools to define and enforce their own rules. We saw the gap widening between how quickly companies could adopt AI and their ability to govern it.

That's why we built Qastel.

AI governance needs a new model

AI is becoming part of nearly every business workflow, and agents increasingly take actions on behalf of employees. This creates two fundamental risks: what data AI systems can access and share, and what actions they can take autonomously.

The scale is growing fast. Gartner predicts that by 2028 the average global Fortune 500 enterprise will have more than 150,000 AI agents in use, up from fewer than 15 in 2025. IDC forecasts more than one billion actively deployed AI agents worldwide by 2029.

No central IT team can realistically review and govern every interaction, decision and action across that many systems. And scale is only part of the challenge.

AI governance has largely been treated as an IT and security responsibility. Yet many of the risks created by AI are business risks.

IT and security teams establish essential safeguards. But who decides whether an AI agent can approve a payment, offer a discount, modify a contract or share sensitive customer information with an external AI provider? Those decisions belong to the business teams accountable for the outcomes.

A data protection officer should be able to say:

Never share customer personal data or confidential business information with unapproved AI services.

A sales director should be able to say:

AI agents must not contact customers or send messages on behalf of employees without human approval.

A finance director should be able to say:

AI agents can prepare payments, but any transaction above €10,000 requires human approval.

These rules are easy for business owners to express, but difficult to enforce consistently across dozens of AI platforms and thousands of agents.

That's the idea behind Qastel: business teams define the rules, Qastel makes them enforceable, and security teams maintain oversight.

Governance also shouldn't depend on discovering and approving every AI system first. Qastel can apply policies to sanctioned and unsanctioned AI alike, including systems that haven't yet been inventoried, wherever its runtime controls are deployed.

Introducing Qastel

Qastel is an independent AI governance and runtime control platform built around five capabilities.

Discover AI across your organisation

Qastel connects to your existing identity, network security and AI platforms to identify sanctioned AI, shadow AI and autonomous agents. It brings together signals from systems such as Microsoft Entra ID, Netskope, Cloudflare and AI platforms into a single inventory.

Teams can see which systems are being used, by whom, what data they interact with and where the biggest risks lie. Each system receives a risk score based on its autonomy, data exposure, governance and compliance posture.

Govern AI in the language of your business

Business, security and compliance teams can define AI policies in plain language, without writing complex technical rules. Qastel translates these instructions into structured policies that teams can review, approve and apply across supported AI environments.

Business owners define what's acceptable. Security teams maintain enterprise-wide guardrails.

Enforce policies where AI operates

Qastel applies policies at runtime to prevent unauthorised data sharing and actions before they happen. Controls operate through supported browser, desktop and MCP gateway integrations, protecting both employee AI usage and autonomous agents.

Policies can first run in monitoring mode, so teams can assess their impact before enabling enforcement.

Define your rules once and apply them across AI systems, including those IT hasn't approved or discovered.

Put AI Guardians to work

Qastel introduces Guardians, specialist AI reviewers that help teams assess risks and improve governance.

Our first Guardian focuses on data protection. It analyses sensitive data exposure, produces assessments and proposes policies to address the risks it finds. Every proposed policy requires human review and approval before activation.

Prove compliance with evidence

Qastel records relevant activity, policy decisions and governance changes in an audit trail. Teams can export reports for internal reviews, data protection officers, auditors and customer security assessments.

Governance becomes part of day-to-day operations, with the evidence ready whenever someone asks for it.

Built in Europe. Independent by design.

We founded Qastel in Paris with a simple conviction: organisations should control their AI, their data and the rules under which their systems operate.

Qastel is hosted in the European Union. Our AI analysis uses open-weight models running on European infrastructure, and our subprocessors are published in our Trust Center.

Independence matters as much. Qastel isn't tied to any particular AI model, cloud provider or platform, and we don't sell the AI systems we're responsible for governing. Our responsibility is to help companies enforce their own rules consistently, across technologies and vendors.

As regulations such as the EU AI Act evolve, we believe independent governance and verifiable oversight will become increasingly important.

Who we're building for

Qastel is for organisations that want to accelerate AI adoption without losing control:

• Business leaders accountable for how AI is used and what decisions it makes.
• CISOs and security teams who need consistent controls across AI systems.
• DPOs and compliance teams who need to demonstrate that policies are enforced and risks are managed.

We believe AI governance works best when the business owns the rules, security establishes the guardrails, and technology makes enforcement scalable.

Get started with Qastel

We're already working with organisations to discover shadow AI, understand their exposure and put practical controls in place.

If you're responsible for AI governance, security or business transformation, we'd love to show you what we're building. Book a 30-minute demo to see Qastel in action, or request a free AI inventory scan to discover the AI already in use across your organisation.

We'll use this blog to share what we're learning about shadow AI, autonomous agents, runtime controls and practical AI governance.

We spent years helping companies bring AI into their businesses. Now we're building the controls that let businesses stay in charge.

Gwenaël & Nordine

Sources

• Gartner, Gartner Identifies Six Steps to Manage AI Agent Sprawl, April 2026.
• IDC, Agent Adoption: The IT Industry's Next Great Inflection Point, December 2025.
• Regulation (EU) 2024/1689, the EU AI Act.