Your colleague uses an AI assistant to write meeting minutes. Another one uses it to sort applications. A third generates visuals for a client presentation. None of these uses have been validated by management, and no one knows exactly which tools are in play. This scenario currently affects the majority of French SMEs, and the obligations related to the AI Act and the NIS2 directive make this gray area increasingly risky.
Informal AI Uses in Business: Mapping Before Regulating
Before drafting a charter or banning anything, the first step is to know what is actually happening. An SME whose employees use ChatGPT, Copilot, Gemini, or a similar tool can be considered a “deploying entity” in the sense of the AI Act. This status implies identifying uses, assessing risks, and training teams.
The problem is that these tools are installed without IT validation. An employee creates a free account, pastes client data, gets a satisfactory result, and repeats the process the next day. The tool becomes a reflex, not an approved technical choice.
To map these practices, an anonymous questionnaire sent to the teams is sufficient as a starting point. Three questions already provide a useful overview: what tool do you use, for what task, and what data do you transmit?
This inventory allows for distinguishing low-risk uses (rephrasing internal text) from those that pose a real problem (sorting CVs, analyzing personal data). You will also find IT information on Planet X Tech that details these distinctions between risk levels.
AI Act and NIS2: What Regulations Already Require from SMEs
You may have read that some deadlines of the AI Act have been postponed. This is partially true. The regulatory timeline has been modified to 2026, but the training and transparency requirements remain applicable. Waiting until the last minute to act amounts to accumulating a compliance debt that is difficult to resolve.
In practical terms, the AI Act requires deploying entities to ensure that individuals using AI systems have a sufficient level of understanding of these tools. For an SME of twenty people, this means that a minimum of documented awareness must exist, even if informal.
NIS2 Expands the Scope Well Beyond Traditional Cybersecurity
The French transposition of NIS2 remains a point of vigilance. The proposed framework includes increased responsibility for leaders regarding risk management, including those related to the supply chain. Software publishers are also targeted, which goes beyond the traditional approach focused solely on internal information systems.
Among the obligations outlined by NIS2, several directly concern the use of unsupervised AI tools:
- Supplier risk management, which includes cloud services and AI APIs used by employees without a formal contract.
- Strong authentication and business continuity, two areas that are weakened when data circulates on uncontrolled platforms.
- Gradual incident notification, which requires knowing which tools are in play when a data breach occurs.
The link between informal AI and cybersecurity is direct: an unlisted AI tool is a blind spot in incident management.
Regulating AI Uses Without Blocking Productivity
Banning all AI tools does not work. Employees who have saved time using these assistants will circumvent the ban, and the company will lose productivity without reducing risk. An effective approach relies on a clear framework that distinguishes what is allowed, what requires validation, and what is prohibited.
Three Categories to Structure an Internal AI Charter
The logic is simple. Classify each use identified during the mapping into one of these categories:
- Free Use: rephrasing internal texts, searching for general information, brainstorming. No sensitive data leaves the company.
- Regulated Use: generating content intended for clients, summarizing documents containing business data. These uses require validation from the manager and the use of an approved tool.
- Prohibited Use: any processing involving personal data (CVs, client files, medical data) on a non-contracted tool. These cases fall directly under the AI Act when they involve high-risk systems.
This framework does not need to be perfect from day one. It must exist, be communicated, and evolve as regulations become clearer.
Training Without Turning Every Employee into a Lawyer
The AI Act requires users to understand the tools they are handling. In practice, a one-hour session per quarter covering the basics is sufficient for an SME: what data to never paste into an AI assistant, how to verify a generated response, whom to report a questionable use to.
The most effective format remains concrete examples. Show a real case where an AI assistant produced a false but credible response. Show an export of a conversation containing client data. These demonstrations leave a stronger impression than a ten-page document on regulatory compliance.
Data, Security, and Governance: The Technical Foundation to Establish
Mapping uses and the internal charter are not enough if the technical infrastructure does not keep pace. One often overlooked point concerns the data that flows through these tools. When an employee pastes an Excel spreadsheet into a free AI assistant, that data is potentially stored and used to train the model.
The technical response involves choosing tools with contractual guarantees regarding data processing. Several vendors now offer professional versions where data is neither retained nor reused for training. The additional cost is modest compared to the risk of a data breach.
On the governance side, appointing a reference person (even part-time) to centralize AI-related questions helps prevent each department from creating its own rules. This referent does not need to be an AI specialist. They should know internal processes and be able to direct requests to the right resources, whether legal or technical.
The challenge for the coming months is not to lock everything down, but to move from a situation where no one knows what is happening to a framework where uses are visible, classified, and adjustable. Companies that establish this foundation before the full implementation of the AI Act and NIS2 will gain considerable time on final compliance.
