Every Prompt Is a Cross-Border Transfer: AI Governance Under Law 2019-014

A company in Lomé or Dakar wires two hundred employees to American inference APIs, and nobody files anything. This article argues that a prompt containing customer data is a transfer of personal data to a third country in the sense of Togo's law 2019-014, that an LLM gateway does not change the legal nature of that transfer but is what makes it declarable, and that the residency options available to a West African company rank very differently on paper than they do once GPU prices, currency exposure and payment friction are counted.

Nobody Knows What Your Company Spends on AI

Every company now has employees using OpenAI, Anthropic and Gemini every day, and almost none of them can say who asked what, what data left the building, or what any of it returned. This article argues that AI governance by policy fails for the same reason shadow IT policies failed, that the request for a fixed AI budget is the wrong question, and that FinOps is the practical way in: the only one of the three unknowns you can measure today is cost, and measuring it is what buys you the other two.

A Reference Architecture for a Sovereign Government Cloud

The two previous articles showed where Togolese law and Kubernetes fail to meet, then why multi-cloud does not answer a jurisdictional question. This one proposes what to build: a reference architecture for a sovereign government cloud in the WAEMU context. Requirements derived from the legal texts, layer-by-layer design choices with their justifications, an operating model, stated limits, and an honest comparison with the alternatives. An architecture document, not a tutorial.

Decree 2018-062 and Kubernetes: The Gap Between the Text and the Implementation

Decree 2018-062, which implements Togo's law 2017-007 on electronic transactions, imposes obligations on security, traceability, retention and continuity. But those obligations were written with a physical server or VM in mind. Kubernetes introduces ephemeral pods, dynamic scheduling, volumes provisioned on the fly, and Operators. This article maps each obligation to its native Kubernetes equivalent, exposes the real gaps where the tool does not answer the text, and proposes implementation patterns. A legal-technical angle, not a tutorial.