Digital Audit - Air France

Domain: Digital (Digital / Technology nexus) Entity scope: Société Air France S.A., the operating airline subsidiary of Air France-KLM S.A. Air France’s own technology acts are in scope. Facts that belong to the Air France-KLM holding company, to the KLM sibling carrier, or to group arms (AFI KLM E&M, Servair, Transavia) are attributed to those entities and treated as parent/sibling/arm context, not as Air France’s own acts. Only genuinely Israeli-domiciled vendors are treated as Israeli-origin in scope; Israeli-founded but US/EU-domiciled firms are flagged as such. Compiled: 2026-06-26 Method: Live web search (≈22 queries) against primary filings, vendor and integrator press releases, the CNIL register, NGO accountability databases (Who Profits, AFSC Investigate, UN OHCHR), and reputable trade and general press. No model training data.

Enterprise Technology Stack & Vendor Relationships

Air France’s enterprise technology is procured almost entirely at the Air France-KLM group level and shared across Air France, KLM, and Transavia. The disclosed strategic vendors are large US and European technology firms; none of the publicly named critical-path partners is Israeli-domiciled.

In December 2024, Air France-KLM named Google Cloud (US-domiciled, Alphabet Inc.) as the platform for a multi-year data and generative-AI partnership, migrating the group from three legacy proprietary data centres toward a multicloud architecture built on services such as BigQuery¹². In November 2024 the group signed a multi-year cloud data-migration contract with Tata Consultancy Services (TCS, Indian-domiciled) to modernise flight-operations, passenger, maintenance, and e-commerce data onto a cloud-native architecture, with delivery teams in France, the Netherlands, and India³⁴. Customer relationship management runs on Salesforce (US-domiciled) Service Cloud / Einstein⁵. In February 2025 the group contracted Amadeus (Spanish-domiciled) to migrate from Altéa to the next-generation Nevio offer-and-order platform under its internal “MOON” programme⁶⁷.

No public evidence was identified that Air France or Air France-KLM holds a disclosed enterprise licence, subscription, or integration with any Israeli-domiciled enterprise vendor - including Check Point Software (Tel Aviv), NICE Ltd. (Ra’anana), or CyberArk Software (Petach-Tikva)⁸⁹. Vendors frequently described in trade coverage as “Israeli” but which are in fact US-domiciled - Verint Systems (Melville, NY), SentinelOne (Mountain View, CA), and Claroty (New York) - likewise show no disclosed Air France contract⁹.

The group’s 2024 Universal Registration Document references cybersecurity governance aligned to the ISO 27000 family but does not name specific endpoint-security, SIEM, or identity vendors¹⁰. The precise security-vendor stack for Air France ground IT is therefore not publicly disclosed; the presence or absence of any Israeli-domiciled security product within it cannot be confirmed or refuted from public sources. This is an evidence gap.

Surveillance, Biometrics & Retail Technology

Air France operates a biometric boarding capability at Paris-Charles de Gaulle built on IDEMIA (French-domiciled, Courbevoie) facial-recognition technology - promoted as the airline’s “biometric boarding pass,” with a 2019 pilot at JFK and Houston run in collaboration with US Customs and Border Protection¹¹¹². The physical biometric-gate infrastructure at CDG and Orly is operated by the airport authority Groupe ADP / Paris Aéroport, not by Air France directly¹³.

No public evidence was identified that Air France - directly or through the ADP-operated airport infrastructure - deploys any Israeli-domiciled biometric or surveillance vendor (for example Oosto/AnyVision, BriefCam, or Corsight). BriefCam facial-recognition software has been reported in use by French police, but that is a French Ministry of the Interior procurement entirely separate from Air France¹⁴. The full backend analytics stack behind the IDEMIA-fronted boarding system is not exhaustively published, so an Israeli-origin sub-component cannot be positively excluded; this is an evidence gap.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Air France is an air carrier, not a data-centre operator. No public evidence was identified that it owns, leases, or co-locates data-centre infrastructure in Israel, or that any of its Google Cloud workloads run in the Google Cloud Israel region¹¹⁰.

Project Nimbus - the approximately USD 1.2 billion Israeli government cloud contract - is held by Google and Amazon Web Services as the contracting parties; it is not a multi-tenant or reseller arrangement¹⁵. Air France is a downstream commercial customer of Google Cloud, not a party to, sub-contractor of, or indirect beneficiary in the Nimbus contract. No public evidence was identified of any Air France involvement in Israeli sovereign-cloud or government-cloud programmes, or of provision of data-sovereignty or resilience services to Israeli state bodies.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence was identified of any contract, partnership, memorandum of understanding, or service agreement between Air France (or Air France-KLM) and the Israeli Ministry of Defence, the Israel Defense Forces, Mossad, Shin Bet, or any affiliated Israeli security or intelligence body. Source classes checked include the Air France-KLM Universal Registration Document¹⁰, NGO accountability databases⁸¹⁶, and the UN OHCHR settlement-business database¹⁷.

Air France is a buyer of IT and avionics, not a vendor or licensor of technology to third parties. No public evidence was identified of any dual-use technology, offensive-cyber capability, or exploit/weapons technology being supplied by Air France to any Israeli state or commercial entity.

AI, Algorithmic & Autonomous Systems

Air France is an AI consumer, not an AI provider. Its publicly disclosed deployments are internal airline tools built with Google Cloud and Accenture: TALIA (an internal generative-AI productivity assistant), PAMELIA (an airport-agent customer-query tool with multi-language translation, in test at CDG in 2025), CHARLIE (maintenance-documentation AI), and FOX (customer-feedback analysis)¹⁸¹⁹. In July 2025 Air France-KLM launched a group-wide “generative AI factory” with Accenture (Irish-domiciled) and Google Cloud, providing a catalogue of pre-evaluated models for ground operations, engineering, and customer service across Air France, KLM, and Transavia²⁰²¹.

No public evidence was identified of AI or ML services, models, or decision-support systems supplied by Air France to any Israeli state, military, law-enforcement, or intelligence body, nor of AI training data sourced from Israel or the occupied Palestinian territories. Autonomous targeting and lethal autonomous systems are entirely outside the operational scope of a commercial airline; no public evidence was identified.

Technology Ecosystem & R&D Footprint

Air France-KLM’s disclosed innovation footprint is concentrated in France (including Toulouse data teams supporting the TCS migration) and the Netherlands³²². No public evidence was identified of any Air France or Air France-KLM innovation lab, accelerator, incubator, or engineering office located in Israel.

No public evidence was identified, in the Universal Registration Document¹⁰ or in reviewed M&A and venture coverage²², of Air France-KLM acquiring an Israeli-origin technology company, making a fund-level investment in an Israeli venture vehicle, or entering patent co-filings, licensing, or collaborative research with Israeli institutions such as the Technion, the Hebrew University of Jerusalem, or the Weizmann Institute. As a listed company subject to French and Dutch state shareholdings rather than EU public-procurement publication rules, Air France-KLM’s vendor-level disclosure is structurally limited, which constrains the granularity of this record.

Civil Society Scrutiny & Regulatory History

A site-restricted search of the AFSC Investigate database returned no entry for Air France on occupation-technology grounds¹⁶. In the Who Profits database, the only match for “Air France” is its appearance as a listed customer on Who Profits’ profile of The Boeing Company - a commercial aircraft-purchasing relationship, not a listing of Air France itself as a subject company on technology grounds⁸. No public evidence was identified that Air France appears in the UN OHCHR 2020 database of business enterprises involved in activities related to Israeli settlements¹⁷. BDS technology-focused campaigning identified via live search targets cloud and military-tech suppliers (Google, Amazon, Microsoft) over Project Nimbus and does not name Air France on technology grounds²³.

On regulatory history, in late 2024 Air France and KLM disclosed a data breach in which the ShinyHunters extortion group accessed customer data (names, contact details, Flying Blue numbers) via a third-party Salesforce platform; Air France notified France’s data-protection regulator, the CNIL²⁴²⁵. The incident confirms Salesforce as the group’s customer-service platform but carries no Israel nexus. No export-control, sanctions, or technology-enforcement action connected to Israeli-technology sales or services was identified in French, Dutch, or EU records reviewed.

End Notes