When a small business leader discovers that their teams are using ChatGPT to draft business proposals without management being informed, the problem is no longer theoretical. This scenario, documented under the term “shadow AI,” now affects a significant portion of French companies. Following business trends in 2026 is less about stacking up creative ideas and more about understanding where operational risks and concrete competitive levers lie.
Shadow AI in business: the risk that most leaders underestimate
The France Num 2026 Barometer, published by the Directorate General for Enterprises on September 28, 2026, presents a clear finding: 40% of small and medium-sized enterprises (SMEs) use AI solutions, which is 14 points higher than a year ago. The progression is rapid. However, the framework is lagging behind.
Only 28% of respondents believe that their company is well-informed about the AI Act. In practice, this means that the majority of teams are deploying AI without an internal legal framework. A salesperson feeding a generative tool with customer data, an accountant automating bank reconciliations via an unvalidated plug-in: it quickly shifts from productivity gains to risks of confidentiality or intellectual property.
To keep an eye on these topics as they evolve, analyses and field feedback can regularly be found in the business news on France Actus, which cover these changes from the business perspective.
Specifically, three actions reduce exposure:
- Catalog the AI tools used by each department, including browser extensions and personal free accounts, to map the existing shadow AI.
- Draft an internal usage charter that specifies which data can feed an external model and which must remain strictly local.
- Designate an AI referent (even part-time) responsible for validating new tools before deployment and monitoring obligations related to the AI Act.
Cybersecurity of SMEs: the weak link in digital transformation
There is a lot of talk about AI, marketing automation, and data strategy. Less is said about the fact that 39% of SMEs report having experienced a cybersecurity incident in the past twelve months, according to the same France Num 2026 Barometer.
The more concerning figure: only 39% use multi-factor authentication. For a company managing customer files, billing data, or access to professional social networks, this is an open door.
What this changes for daily management
The challenge is not to invest massively in an outsourced SOC. For a structure of ten to fifty employees, basic practices make the difference: activating MFA on all critical accounts, automated backups tested monthly, annual training for teams on phishing techniques.
A cybersecurity incident often costs more than the annual subscription to protection tools. The feedback varies on the exact amount depending on the size of the company and the type of attack, but the impact on customer trust and business continuity is systematic.
AI Act and compliance: turning a regulatory constraint into a commercial advantage
The European AI Act is not just a legal text to watch from a distance. For companies selling digital services, digital marketing, or consulting, documenting their AI usage becomes a commercial argument.
A provider capable of showing their client how their data is processed, which model is used, and what compliance guarantees are in place stands out immediately. In B2B markets where trust is a selection criterion, this transparency weighs heavily in the purchasing decision.
Market analysis and customer engagement: the role of compliant tools
Data analysis, customer relationship management, and marketing management tools are gradually integrating AI functions. The question to ask each vendor is simple: where is the data hosted, what level of encryption is applied, and what traceability exists on automated decisions.
Companies asking these questions now are building an advantage over those that will have to catch up on compliance in six months. In the field, we are already seeing tenders incorporating criteria related to AI governance in their specifications.
Business failures in France: reading the signals to adjust strategy
The macroeconomic context weighs on decisions. Monitoring the evolution of business failures remains a concrete indicator for adapting cash management and supplier relationships.
Monitoring the financial health of business partners is part of business vigilance, just like analyzing consumer trends. A client or supplier in difficulty directly impacts revenue.
Concrete prevention practices
Check credit scores before signing a new contract. Diversify supply sources to avoid dependence on a single supplier. Shorten billing cycles when possible. These reflexes, seemingly simple, are what differentiate resilient companies from those caught off guard.
The rise in failures particularly affects structures that had accumulated debt during the post-crisis period without rebuilding their margins. For healthy companies, it is also a time when market shares are freed up, provided they have the means to invest.
Competitiveness in 2026 does not rely on adopting a miracle tool or a groundbreaking business idea. It depends on the ability to structure digital usage, protect data, and read financial signals before they become emergencies. Companies that document, train, and anticipate are those that navigate cycles without being overwhelmed.
