Dr. Thiébaut Devergranne

From legal scholar to compliance software engineer

I sit at the intersection of three worlds that rarely overlap: academic law, operational cybersecurity, and software engineering. My doctoral thesis at Université Paris II Panthéon-Assas (2007) was titled "La propriété informatique" — an early systematic treatment of property rights over digital assets, defended with jury commendations. I then spent six years as legal counsel at the SGDN/DCSSI, the office that became today's ANSSI — the French national cybersecurity authority. That gave me operational exposure to the security side of compliance that most data protection lawyers never see: incident response, classified regulations, dual-use technology controls, and direct interaction with the highest level of French government on technology matters, including representing France in international working groups while still in my early twenties.

I've been writing code for over twenty years — Python, JavaScript, Shell, C, C#, SQL, dojo. Before founding Legiscope, I built a complete CRM platform for law firms (over a million lines of code, two years of development). That experience changed how I think about compliance: I see the law as a specification that must be implementable. When a regulation can't be turned into a workflow, a database schema, or an algorithm, it stays theoretical — and theoretical compliance is the kind that gets sanctioned.

Why Legiscope exists

Legiscope is the platform I wished existed when I was advising banks, multinationals, and administrations on GDPR. The compliance work that took me weeks of manual analysis — auditing DPA contracts, mapping cross-border transfers, generating DPIAs, maintaining records of processing — is largely pattern matching, and pattern matching is what AI does well. Legiscope automates the operational layer so that DPOs and legal teams can focus on the judgment calls that actually require human expertise.

The platform doesn't replace lawyers. It removes the parts of legal work that don't need a lawyer — leaving more time for the parts that do.

Teaching and public work

I taught for six years at the Master's level at Université Paris-Dauphine, and have led approximately one hundred training sessions for senior French government officials on data protection and information security law. I co-founded the SSTIC conference with the original MISC magazine team, which has become one of Europe's leading technical security conferences. I also publish regularly on donneespersonnelles.fr, a French-language platform dedicated to operational data protection guidance.

What I write about on Legiscope

The articles on this site are practitioner-oriented. They cover what I see when I audit organizations: the gap between what the law says and what implementations actually do. Topics:

• GDPR compliance — Article-by-article practical interpretation
• DORA — Operational resilience for EU financial entities
• NIS2 Directive — Cybersecurity obligations for essential and important entities
• EU AI Act — Risk classification and provider obligations
• Privacy by design — Foundational principles across regulatory frameworks

Credentials

• Ph.D. in Private Law and Criminal Sciences — Université Paris II Panthéon-Assas (2007). Dissertation: La propriété informatique. Honors: très honorable avec les félicitations du jury.
• DEA in Communication Law (with thesis on computer fraud)
• CAPA — Certificat d'Aptitude à la Profession d'Avocat (legal practice qualification)
• 20+ years of programming (Python, JavaScript, C, C#, SQL)
• 6 years legal counsel at SGDN/DCSSI (now ANSSI), French Prime Minister's services
• 6 years teaching at Master's level, Université Paris-Dauphine
• ~100 training sessions for senior French government officials
• Co-founder, SSTIC (Symposium sur la Sécurité des Technologies de l'Information et des Communications)
• Founder, specialized cybersecurity legal consulting firm (predecessor to Legiscope)
• French delegation to international technology law working groups (G8 context)

Get in touch

For Legiscope product inquiries: request a demo or email thiebaut@legiscope.com. For media or speaking requests, LinkedIn is the fastest channel.