V-DIG Audit: Air France

Target company: Air France (operating entity of Air France-KLM S.A.) Audit phase: V-DIG (Digital Forensics) Reference date: May 2026

Enterprise Technology Stack & Vendor Relationships

Disclosed Enterprise Stack

Air France-KLM’s strategic technology relationships are dominated by large US and European vendors. In June 2022, the group named Google Cloud as its preferred cloud provider for data and AI workloads in a formally announced multi-year strategic partnership; subsequent Universal Registration Documents confirm the relationship as ongoing through 2024–2025 ^{1 2}. Microsoft is referenced as partner for the M365 productivity suite and, from 2024, for generative-AI use cases across customer-facing travel applications ². IBM held the long-running IT infrastructure outsourcing mandate, with a major contract renewal confirmed in 2016; partial migration of workloads to Google Cloud was announced from 2022, though the residual scope of IBM hosting is not publicly disclosed ^{3 1 2}.

Professional and managed services are concentrated among European-headquartered integrators. Accenture is the named digital-transformation partner following a multi-year contract extension in September 2021 ⁴. Capgemini provides digital workplace services ². Atos / Eviden is referenced as a cybersecurity services provider in the European aviation segment ².

On the commercial and operational systems side, Amadeus (Spain) holds a long-term distribution agreement signed in 2023 ²; Sabre (US) supports network planning and commercial systems ²; Salesforce (US) has powered CRM and customer-experience operations since December 2019 ⁵; and Thales (France) is contracted to supply cockpit avionics and in-flight entertainment systems for Air France’s Airbus A350 fleet ².

Israeli-Origin Enterprise Vendors — Direct Procurement

No public evidence was identified that Air France or Air France-KLM holds a publicly disclosed enterprise license, subscription, or integration with any of the following Israeli-founded or Israeli-origin vendors: Check Point Software, Wiz, SentinelOne, CyberArk, NICE Systems, Verint Systems, Claroty, or Palo Alto Networks ^{6 7}. Source classes checked include the AF-KLM Universal Registration Documents for 2023 and 2024 ², vendor customer-reference pages, French-language IT and cybersecurity trade press, and NGO corporate accountability databases ^{6 7}.

Scale of Dependency on Israeli-Origin Technology

No public evidence was identified that Israeli-origin technology is embedded in Air France’s critical enterprise infrastructure. All publicly named critical-path partners are non-Israeli in origin ^{1 4 3 5 2}.

Integrator-Routed Israeli Tooling

Atos/Eviden, Accenture, Capgemini, and IBM all carry Israeli-origin security tools (including Check Point and CyberArk) within their broader managed-service portfolios. However, no public evidence was identified that any of these integrators has specifically deployed Israeli-origin tooling within the Air France or Air France-KLM environment. Source classes checked include integrator press releases, AF-KLM Universal Registration Documents ², and cybersecurity trade press.

Evidence Gap — Cybersecurity Vendor Stack

Air France-KLM does not publicly disclose its specific endpoint security (EDR/XDR), SIEM, identity and access management (IAM), or network-security vendor selections. The presence or absence of Check Point, CyberArk, SentinelOne, Wiz, Palo Alto Networks, NICE, or Verint within the internal security stack therefore cannot be confirmed or refuted from public sources. Similarly, Air France operates large customer-service contact centres for which the specific contact-centre platform vendor (NICE, Verint, Genesys, or other) is not publicly named.

Surveillance, Biometrics & Retail Technology

Biometric Boarding

Air France participates in biometric boarding pilots at Paris-Charles de Gaulle Airport through IATA OneID-aligned programmes operated by Groupe ADP (airport operator). The publicly named technology providers in French aviation and industry press are IDEMIA (France) and Groupe ADP itself ⁸. No public evidence was identified of any deployment by Air France — directly or via airport concession — of Israeli-origin biometric vendors, including Trigo, BriefCam, AnyVision/Oosto, or Trax. Source classes checked include vendor customer-reference pages, French aviation trade press, and NGO databases ^{6 7}.

Predictive Analytics, Monitoring & Workforce Surveillance

No public evidence was identified of Israeli-origin predictive policing, sentiment analysis, social-media monitoring, or workforce surveillance tools deployed by Air France. Source classes checked include the AF-KLM Universal Registration Documents ², the CNIL public sanctions and decisions register ⁹, and French labour-press coverage of Air France works-council disputes.

Third-Party or Bundled Deployment

No public evidence was identified that Israeli-origin surveillance or retail analytics tools reach Air France indirectly via managed-security, platform-bundle, or outsourced retail arrangements from Atos/Eviden or other contracted providers.

Evidence Gap — Biometric Backend Vendors

The full backend analytics vendor stack for CDG and Orly biometric boarding trials is not exhaustively published. It is therefore not possible from public sources alone to confirm that no Israeli-origin analytics component sits behind the IDEMIA-fronted infrastructure.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

Air France is an air carrier, not a data-centre operator. No public evidence was identified that it owns, leases, or co-locates data-centre infrastructure in Israel ². The company’s disclosed cloud strategy centres on Google Cloud as the preferred platform ¹, with no geography-specific Israeli hosting arrangement mentioned in either the 2023 or 2024 Universal Registration Documents ².

Project Nimbus and Israeli Government Cloud

Project Nimbus — the approximately USD 1.2 billion Israeli government cloud contract — is held by Google and AWS ¹⁰. Air France is not a participant, sub-contractor, or indirect beneficiary in that contract. No public evidence was identified of any Air France involvement in Israeli sovereign or government cloud programmes.

Data Sovereignty and Resilience Services to the Israeli State

Provision of data sovereignty, intelligence-grade storage, or resilience infrastructure to Israeli state bodies is not within Air France’s commercial or technical offerings. No public evidence was identified.

Evidence Gap — Tel Aviv Station Office Local IT

Whether Air France’s Tel Aviv station office relies on locally provisioned Israeli SaaS products (HR, payroll, local CRM, or workforce-management tools) is not publicly disclosed in any AF-KLM filing or press release reviewed.

Defence, Intelligence & Security Sector Technology Relationships

Israeli Military and Intelligence Contracts

No public evidence was identified of any contract, partnership, memorandum of understanding, or service agreement between Air France and the Israeli Ministry of Defence, the Israel Defense Forces, Mossad, Shin Bet, or any affiliated Israeli security or intelligence body. Source classes checked include the AF-KLM Universal Registration Documents for 2023 and 2024 ², Israeli state procurement coverage, NGO corporate accountability databases ^{6 7}, and the UN OHCHR 2020 database of business enterprises involved in activities in Israeli settlements ¹¹.

Commercial Aviation Links (Contextual — Non-Technology)

Air France operates the CDG–Tel Aviv commercial passenger route, which experienced periodic suspensions and resumptions during 2023–2024 in response to regional security conditions ². Historical codeshare arrangements between Air France and El Al Israel Airlines have been documented in commercial aviation coverage from the pre-2020 period ²; this is a passenger-aviation commercial arrangement, not a technology supply or data-sharing relationship, and falls outside V-DIG scope.

Dual-Use Technology Provision

Air France is a buyer of IT and avionics, not a vendor or licensor of technology to third parties. No public evidence was identified of any dual-use technology provision by Air France to any Israeli state or commercial entity.

Offensive Cyber and Weapons Technology

No public evidence was identified. Air France is not a cyber-weapons developer, exploit vendor, or provider of offensive security capabilities.

AI, Algorithmic & Autonomous Systems

AI Deployment Profile

Air France-KLM is an AI consumer, not an AI provider. Publicly disclosed AI and ML deployments use Google Cloud Vertex AI for operations and revenue-management applications, announced as part of the 2022 strategic partnership ¹, and Microsoft AI tooling for customer-facing applications introduced in 2024 ². Both deployments are directed at internal airline operations and passenger services.

AI/ML Provision to Israeli State, Military, or Security Bodies

No public evidence was identified of AI or ML services, models, pipelines, or decision-support systems being supplied by Air France to any Israeli state, military, law-enforcement, or intelligence body.

Training Data Sourcing

No public evidence was identified of Air France AI training data being sourced from Israel, the occupied Palestinian territories, or any Israeli public or government dataset.

Autonomous Targeting and Lethal Systems

Autonomous targeting or lethal autonomous weapons systems are entirely outside the operational scope of a commercial airline. No public evidence was identified.

Technology Ecosystem & R&D Footprint

Innovation Hubs and Engineering Offices

Air France-KLM’s publicly listed innovation footprint is concentrated in France and the Netherlands. Named facilities include the Sophia Antipolis innovation hub (France), the Paris/CDG digital and operations lab, and the Amsterdam innovation office (Netherlands) ¹². No public evidence was identified of any Air France or Air France-KLM innovation lab, corporate accelerator, technology incubator, or engineering office located in Israel.

Acquisitions and Investments in Israeli Technology

No public evidence was identified in the AF-KLM Universal Registration Documents for 2023 or 2024 ², or in any M&A press coverage reviewed, of Air France-KLM acquiring an Israeli-origin technology company or making a fund-level investment in an Israeli venture capital vehicle.

Patents, IP Co-Development, and Academic Partnerships

No public evidence was identified of patent co-filings, licensing agreements, or collaborative research arrangements between Air France and Israeli research institutions, including the Technion–Israel Institute of Technology, the Hebrew University of Jerusalem, or the Weizmann Institute of Science.

Procurement Transparency Constraint

As a listed commercial entity with French and Dutch state shareholdings, Air France-KLM is not subject to EU Tenders Electronic Daily (TED) line-item procurement publication obligations applicable to public-sector contracting authorities. Vendor-level granularity in the publicly available record is therefore structurally limited.

Civil Society Scrutiny & Regulatory History

NGO and Academic Listings

Air France is not listed in the Who Profits Research Center companies database ⁶ for technology-supply-related grounds. Air France is not listed in the AFSC Investigate corporate accountability database under occupation-industry technology categories ⁷. Air France is not included in the UN OHCHR 2020 database of business enterprises identified as involved in activities related to Israeli settlements in the occupied Palestinian territory ¹¹.

Boycott and Divestment Campaigns

The BDS Movement primary targets list does not name Air France for technology-related grounds ¹³. Activist and civil-society criticism of Air France has periodically addressed Tel Aviv-route operations — a transport-services issue — rather than technology supply chains, placing that criticism outside V-DIG scope. No technology-grounds boycott or divestment campaign targeting Air France was identified.

Regulatory and Legal Actions

The CNIL public sanctions and decisions register ⁹ shows data-protection matters typical for a major European carrier — routine GDPR and passenger-data handling cases — with no export-control, sanctions, or technology-related enforcement actions connected to Israeli technology sales or services identified. No judicial, regulatory, or parliamentary proceeding related to Israeli-technology supply was identified in French, Dutch, or EU-level records reviewed.

Sustainability and ESG Disclosures

The Air France-KLM Sustainability Report 2023 ⁸ addresses environmental and social performance, including biometric boarding and digital passenger services, without disclosing any supplier-level technology relationship that raises V-DIG-relevant concerns. No material omissions or contradictions relative to the claims in the Universal Registration Documents ² were identified on technology-supply grounds.

End Notes