French and European companies are approaching the end of 2025 and looking ahead to 2026 amid the convergence of three forces: a European regulatory framework taking effect in successive waves, AI use advancing faster than its governance, and cyber resilience requirements now extending across the entire supply chain.
These developments are no longer just matters of future planning. They are already reshaping operational decisions, budgets, and commercial relationships between buyers and service providers.
European regulation and companies’ operational timelines
The usual approach is to treat regulation as a legal matter delegated to compliance teams. Recent European legislation is changing that because it directly affects product design, data access, and supplier contracts.
The European Data Act has applied since September 2025. It governs access to data generated by connected products and the sharing of that data with cloud service providers. For a company selling a connected device, this means rethinking its data collection architecture, terms of use, and contractual commitments with cloud partners from the design stage onward.
As for artificial intelligence, the AI Act is coming into force gradually. Companies that develop or integrate AI systems need to prepare for the classification, documentation, and human oversight requirements set out in the legislation.
The exact timeline remains subject to change, making regulatory monitoring essential. Following Je ne sais quoi’s business news can help you adjust your roadmap as official updates are published.
DORA, which has applied to financial entities since January 2025, strengthens requirements relating to digital risks. France’s transposition of NIS2 has been delayed, but buyers are not waiting for the final legislation: they are already asking suppliers to demonstrate their level of preparedness. An IT provider unable to document its cyber resilience posture risks losing tenders, regardless of the legislative timeline.
AI in business: the gap between adoption and real productivity
Generative AI tools have spread rapidly across marketing teams, customer service departments, and content production. However, adopting AI is not enough to deliver measurable productivity gains. Work organization, the quality of available data, and employee training all determine the actual benefits.
In practice, a company that rolls out an AI assistant for its sales team without revising its lead qualification process often sees only a cosmetic effect: emails are better written, but conversion rates remain unchanged. The gains come from reorganizing the workflow around the tool, not from the tool itself.
Data governance and AI risk management
At many French companies, AI governance is progressing more slowly than AI use. The gap between data maturity (quality, accessibility, documentation) and the structure of AI use represents both an operational risk and a barrier to performance.
Key questions for business leaders include:
- Which datasets feed the models in use, and are they documented well enough to meet the AI Act’s future traceability requirements?
- Who validates the results produced by an AI system before they are used to make a business or HR decision?
- How does the company measure the return on investment of its AI projects beyond simply counting the hours saved?
There is no universal answer to these questions. It depends on the sector, company size, and digital maturity of each organization.
Cyber resilience and the supply chain: a commercial selection criterion
Cyber resilience was long seen as an IT department concern. It is now becoming a commercial selection criterion. Under pressure from DORA and awaiting NIS2, large companies are incorporating security requirements into their supplier specifications.
For an SME or mid-sized company operating as a subcontractor, this changes the nature of cybersecurity investment. The goal is no longer just to protect against an attack, but to document its security posture to retain access to its markets. Security audits, ISO 27001 certifications, and business continuity plans are becoming commercial prerequisites before they become legal obligations.
For mid-sized companies, the challenge lies in the cost and complexity of these processes. Frameworks are available, but qualified cybersecurity professionals remain scarce. Recruitment in this field remains challenging, prompting some companies to turn to outsourced managed services.
Business models and platforms: how data is changing services
Subscription models and service platforms continue to grow, but the underlying trend is less about the commercial format than about how access to customer data is redefining the value proposition. A company selling software as a service (SaaS) is not just selling a feature: it is selling the ability to use usage data to continuously improve the service.
The Data Act changes the equation here. Cloud service providers and software vendors must now set out how their customers can access and transfer their data. For businesses using these services, this is an opportunity: dependence on a single provider (vendor lock-in) is now a recognized risk that can be negotiated in contracts.
Hyper-personalization and operational limits
Personalizing customer journeys using customer data platforms (CDPs) and machine learning is often presented as a given. In practice, the quality of first-party data remains the limiting factor for most mid-sized companies. Without reliable data, personalization produces inconsistent results that harm rather than improve the customer experience.
Companies that get real value from these tools are those that have invested upfront in structuring their databases, managing consent, and training their marketing teams to interpret the metrics.
Today’s business trends have one thing in common: they reward companies that invest in organization and governance rather than simply accumulating tools. European regulation is accelerating this shift by imposing standards for traceability, portability, and resilience. Companies that put a structured approach in place now are not just getting ahead on compliance; they are securing access to tomorrow’s markets.
