Artificial intelligence is altering the scale, speed, and access to skills. According to Sébastien Garnault, founder of Garnault & Associés and the Paris Cyber Summit, regulation would benefit from focusing on access to the power of systems, rather than on models or uses alone. In this logic, clouds play the role of power plants, and it remains to be seen who will control the valves.
Until now, regulation has sought to govern models on one side, and uses on the other. The author proposes linking the two by focusing on what models make possible and what uses produce. This power multiplies scale, compresses time, and substitutes for skill. Acting on it would, in his view, allow action on all three at once.
Nuclear power offers a precedent. Faced with the atom, states have regulated uses, but also access to materials, facilities, and sensitive technologies. Low-enriched uranium fuels reactors, while highly enriched uranium can be used to make a weapon. The level of control must therefore depend on the capabilities actually accessible, a principle the author considers transferable to AI.
A foundation of power, differentiated access
The same model can be used in very different ways. It can only answer questions, or also read documents, search the internet, write and execute code. Used in an agentic mode, it acts directly, by sending messages, placing orders, or controlling a machine. Power depends on the foundation that supports it, namely computing, models, infrastructure, and data, but also on the open access to tools and autonomy.
A daily use does not require the power needed by defense, intelligence, or a research laboratory. For the author, control must follow the capabilities opened up, not the status of the requester. The rule he proposes can be summed up in one sentence: the more capabilities an access opens, the more it must be controlled. Providers of the most powerful access should thus know their customers and track what they open for them, following the model of customer knowledge in banking.
Each is responsible for what they make possible
The risk, the author stresses, is not theoretical. In 2025, an espionage campaign targeted around thirty organizations. According to the company that thwarted it, an AI performed 80 to 90% of the tasks. The attacker would have forced no doors: they would have broken the operation down into small, innocuous tasks, each authorized, only the whole of which was dangerous.
Each actor would then be assigned a share of responsibility. The model provider would be responsible for the capabilities it opens, the one who combines models and tools for what the combination makes possible, and the user for their actions and their effects. The common criterion would remain the power actually accessible: what the system can do, at what scale, with which tools, which data, and what autonomy.
Who holds the valves?
No one today masters the entire chain alone, from chips to models, from cloud to data. Each negotiates their access from the link they control, and the author recalls that the United States understood this by controlling the export of the most advanced chips. For open source, the situation is different: a published model is copied infinitely and can no longer be withdrawn. Control then shifts to the computing power needed to run it, and to those who deploy it. The most powerful are not European, but data and electricity, which Europe and France, thanks to nuclear power, can condition, remain levers.
For Sébastien Garnault, the ultimate lever remains the credible ability to condition access to power, up to refusing it. The question is no longer whether AI will be governed, but who will hold the valves, and under what conditions.
