60% of Companies Use AI Without Governance: The Usage Policy the AI Act Already Expects From You
The New Development
The third edition of the Coface Data & AI Barometer, conducted with Les Echos Études among 900 decision-makers and reported by ActuIA, paints a stark picture. Some 35% of companies have no AI governance mechanism and no plans to create one; another quarter are considering it without formal rules. In total, 60% operate without a framework. Only 17% have defined, formalized, and communicated an AI usage policy to their employees.
The cited barriers echo the same theme: data security and regulatory compliance (41%), lack of internal maturity (31%), and trust in AI-generated analysis (30%). The study highlights a paradox: confidence in data rose by 18 points in one year to 67%, yet only 58% of executives consider that data well integrated into their business tools. Data quality is improving, but governance is lagging behind.
What the AI Act Actually Requires
The European AI Regulation (Regulation 2024/1689) is often reduced to its "high-risk" obligations. Those were postponed to December 2, 2027 by Omnibus Regulation 2026/1744, published in the Official Journal of the EU on July 24, 2026, as detailed in ActuIA's breakdown. However, three core pillars already apply to any enterprise that provides or deploys an AI system:
- Prohibited practices (Article 5), in force since February 2, 2025. One directly affects employers: inferring employee emotions in the workplace—for instance in a call center—outside medical or safety justifications.
- AI literacy (Article 4), in force since February 2, 2025, and supervised by national market surveillance authorities since August 2, 2026.
- Transparency (Article 50), in force since August 2, 2026: informing individuals interacting with a chatbot and labeling AI-generated content.
The omnibus regulation rewrote Article 4 to ease the burden on smaller businesses. Providers and deployers are no longer required to "ensure, to their best extent, a sufficient level" of AI literacy, but rather to "take measures to foster" its development, without an obligation to guarantee a specific level for each individual. The core obligation remains, along with its original criteria: technical knowledge, experience, staff training, and usage context.
In its FAQ updated on July 27, 2026, the European Commission clarifies that no formal certificate is required and that an internal training log suffices. No specific fine is attached directly to Article 4; penalty regimes fall under Member States, which must take SMEs' interests into account. In France, the bill designating the competent national authorities was still in committee at the National Assembly as of October 6, 2026.
Why a Written Policy Is the Right Starting Point
A company whose employees draft, translate, or summarize documents using a generative assistant falls under Article 4: its teams must understand the risks specific to the tool, starting with factual hallucinations. Without a written policy or register, the company cannot show a supervisory authority what measures it has taken. The governance gap measured by Coface is therefore also a documentation gap.
The DGE's France Num 2026 barometer confirms the scale of the issue in smaller businesses: 40% of VSEs and SMEs use AI, but only 19% pay for a solution. In other words, a large share of usage runs through free, personal accounts outside company oversight—with all the data leakage risks that entails.
The Five-Part AI Usage Policy
The regulation does not mandate a rigid policy template or governance structure. The outline below covers the minimum steps listed by the Commission and directly addresses the barriers cited by executives.
- Scope: list of approved tools, corporate accounts to use, permitted use cases by department, and prohibited uses.
- Forbidden Data: customer or employee personal data, trade secrets, and confidential documents. This directly addresses the number-one concern cited by leaders (41%).
- Human Validation: mandatory human review of any AI output before sending it to a client, publishing it, or making a decision that binds the company.
- Traceability: an internal register of deployed tools and completed training sessions, serving as proof of the "measures" taken under Article 4.
- Training: role- and level-appropriate training modules, from executives to frontline operators, updated annually.
Two additions for relevant businesses: informing employee representatives when AI alters working conditions, and—for companies operating a contact center or customer support desk—verifying that no software analyzes agents' emotions.
Implications for Decision-Makers
Regulatory. The obligation is already in force; what is still pending in France is the formal designation of supervisory authorities and penalty schedules. Waiting for their appointment to act means risking an audit with zero documentation in hand.
Operational. A policy without training remains a dead letter. The goal is not to ban AI, but to channel existing shadow usage toward company-controlled tools.
Human. Employees are already using AI, often quietly. A clear framework protects the business and reassures teams by clarifying what they are allowed to do and with which tools.
Caveats and Limitations
The Coface barometer is self-reported, published by a credit insurer that markets business information services, and its public release does not specify fieldwork dates or company size breakdowns. The two 17% figures cited in the study measure different things: one tracks formal governance, the other usage maturity. Finally, the AI Act timeline may still evolve: the next milestone on December 2, 2026 covers machine-readable watermarking of generated content and two additional prohibitions; "high-risk" obligations follow a separate schedule.
Conclusion
Formalizing an AI usage policy is neither a heavy legal burden nor a brake on innovation. It is a few pages of clear rules, an internal register, and a training plan that turn scattered habits into structured enterprise practice. The 17% of companies that have done so already meet the AI Act's expectations; the rest have every reason to act before national authorities begin enforcement.
What Next?
FASEYA Academy designs role-specific AI training programs with skills validation that feeds directly into your compliance register. FASEYA Consulting helps you draft your usage policy, map existing workflows, and define governance; FASEYA BPO applies these standards across the customer support and back-office teams it operates for you. To review your readiness in 30 minutes: request a diagnostic or email contact@faseya.com.
Frequently Asked Questions
Does Article 4 of the AI Act apply to an SME that only uses an assistant like ChatGPT?
Yes. Any organization deploying an AI system in a professional context must take measures to foster its staff's AI literacy, regardless of the specific tool used.
Is an official certification or accredited training body required?
No. The European Commission states that no certificate is required. An internal register of completed training and deployed tools is sufficient to document the measures taken.
What is the next AI Act deadline for businesses?
December 2, 2026, for machine-readable marking of content generated by systems placed on the market before August 2, 2026, and for two new prohibited practices. Annex III 'high-risk' obligations will apply on December 2, 2027.
Sources and References
Read also
Enterprise AI: Only 13% of CIOs See Significant Value — Investment Discipline Makes the Difference
AI is being deployed everywhere, yet tangible returns remain elusive: according to a Gartner survey published on October 28, only 13% of CIOs report that their organization has captured significant value from it. The companies that succeed are not those that launch the most projects, but those that know which ones to shut down.
E-Invoicing: 30 Million Invoices, 3% Rejection Rate — What SMEs Must Fix Before September 2027
Six weeks after the September 1 launch, French authorities have released their first assessment of mandatory e-invoicing: 30 million invoices exchanged, but still a 3% rejection rate between certified platforms. For SMEs, which will be required to issue electronic invoices starting in September 2027, these figures represent less a victory lap than a checklist of projects to launch right now.
Need to address these challenges in your business?
Our practice directors are available for a 30-minute diagnostic session to assess your priorities.
Prefer a direct discussion?