French companies have been facing a regulatory and technological paradox since 2025. On one hand, the European regulation on artificial intelligence imposes new obligations on organizations using AI tools. On the other hand, the NIS2 directive strengthens cybersecurity requirements for an increasing number of entities, including SMEs that were previously unaware of their obligations. Between these two frameworks, IT solutions intended to enhance performance also become compliance issues.
Regulatory obligations related to AI in business since 2025
Since February 2, 2025, Article 4 of Regulation (EU) 2024/1689 requires organizations using AI systems to ensure a sufficient level of competence among their staff. This obligation is not limited to software publishers. It also applies to SMEs deploying tools like ChatGPT, Copilot, or Gemini in their daily processes.
Specifically, this involves formalizing authorized uses, identifying associated risks, and documenting the training provided to teams. A company using a conversational assistant for customer support or internal document drafting falls within the scope of this regulation.
The second wave of obligations arrived on August 2, 2026, with the entry into force of Article 50 of the same regulation. Companies must now inform users when they interact with a chatbot and disclose certain content generated or manipulated by AI. For an SME that has integrated a chatbot on its website, this transparency is no longer optional. Specialized providers like skynet-system.fr assist organizations facing these technical and organizational requirements.
Shadow AI and IT outsourcing: a blind spot for cybersecurity
The phenomenon of shadow AI refers to the use of artificial intelligence tools by employees without validation or supervision from management or the IT department. An employee who pastes customer data into a free text generation tool creates a risk of data leakage without the company being aware of it.
This issue cannot be resolved by a simple ban. Field feedback varies on this point: some organizations find that restrictive policies push usage even further into the shadows. The challenge is rather to frame, offer validated alternatives, and provide training.
IT outsourcing plays a structuring role here. A provider managing the IT infrastructure and network access can detect abnormal data flows, block connections to unauthorized services, and propose compliant cloud solutions. The question is no longer whether the company uses AI, but whether it knows which AI tools are actually used internally.
Criteria for evaluating an IT outsourcing provider in light of these risks
- Ability to inventory the SaaS and AI tools used by employees, including those not reported to the IT department
- Implementation of network filtering policies adapted to new usages (selective blocking rather than a blanket ban)
- Support for regulatory compliance, particularly regarding transparency obligations arising from the AI Act
- Monitoring of outgoing data flows to identify transfers to non-contracted third-party services
NIS2 Directive and cybersecurity: SMEs affected without knowing it
The NIS2 directive significantly broadens the scope of companies subject to cybersecurity obligations in Europe. While NIS1 primarily concerned operators of vital importance, NIS2 extends these obligations to many mid-sized entities. SMEs in sectors previously not targeted are discovering that they must now formalize security policies, report incidents, and implement proportionate technical measures.
In France, the transposition of the directive is through the Resilience Law. The available data does not yet allow for a definitive conclusion on the timeline for transposition, but companies waiting for the publication of the national text to act are falling behind. The required technical measures (access management, encryption, backup, continuity plan) require several months for implementation.
What NIS2 changes for the choice of cloud solutions
Cloud computing remains a performance lever, but NIS2 pushes companies to reconsider their selection criteria. Data localization, provider certifications, and incident notification contractual clauses become decision-making elements alongside price and features.
A company migrating its commercial management to a cloud tool must ensure that its provider complies with the directive’s requirements. The choice of a SecNumCloud certified host or equivalent is no longer a luxury reserved for large groups. It is a compliance criterion for any entity falling within the NIS2 scope.
National AI plan and available support for SMEs
Support comes in various forms:
- Subsidized AI diagnostics to identify relevant use cases within the company
- Technical support from referenced providers for the deployment of suitable solutions
- Training for leaders and operational teams on the fundamentals of AI and regulatory obligations
The purpose of these initiatives is to bridge the gap between large companies, which have dedicated technical departments, and SMEs, which often have to choose between digital performance and budget constraints. The coupling of public aid and specialized IT outsourcing allows progress without internalizing costly expertise.
The challenge remains the clarity of the offerings. Between regional aids, national schemes, and European programs, an SME can spend as much time searching for the right support as deploying the solution itself. Chambers of commerce and industry play a primary filtering role, but the process remains fragmented.
Adopting high-performance IT solutions in 2026 is no longer limited to comparing features or prices. Regulatory compliance now conditions the choice of tools, whether in AI, cloud, or cybersecurity. Companies that integrate this dimension from the selection phase avoid much higher compliance costs later on.
