The digital transformation of French companies has been facing a regulatory framework since 2025 that alters the very way of conceiving a digital project. The European AI Act, the NIS 2 directive on cybersecurity, and the obligations for training in artificial intelligence: these texts impose specific constraints, tool by tool, position by position. Launching a digitalization without integrating these parameters is akin to building on land without knowing the land use plan.
Regulatory compliance and digital transformation: the filter that companies overlook
Most guides on digital transformation present AI as a technological block to be adopted globally. The European regulation on artificial intelligence (AI Act) works in the opposite way: each AI system is classified according to its own level of risk. A small business can use a customer support chatbot classified as minimal risk and, at the same time, a HR scoring tool subject to enhanced obligations.
This granularity changes the game for decision-makers. It is no longer enough to choose a software vendor and deploy their solution. Each tool must undergo a separate compliance assessment, which requires a prior mapping of all the technological components used.
Since February 2, 2025, Article 4 of the AI Act requires providers and deployers of AI systems to ensure a sufficient level of AI mastery among users and supervisors. No minimum staff threshold is specified: a company with twelve employees using an AI tool to generate its quotes is subject to the same requirements as a CAC 40 group.
Organizations like upsidecom.fr support this transition by integrating the regulatory dimension from the design of digital strategies.
Real adoption of AI in France: what field data reveals
Discussions about digitalization suggest that AI has become widespread in the French economic fabric. Field feedback diverges on this point. The gap between declared intention and actual usage remains considerable.
Several factors explain this discrepancy. The integration cost, first, often exceeds the initially planned budget, as it must include training, compliance, and maintenance. Organizational resistance, next: teams that were not involved in the selection of tools tend to bypass or underutilize them.
The government’s “Dare AI” plan
The French government launched the “Dare AI” plan to accelerate adoption in SMEs and mid-sized enterprises. A positive initial assessment has led to a new phase aimed at expanding the program. The goal is to provide concrete support (diagnosis, funding, training) rather than simply promoting the technology.
Field feedback shows that companies making the most progress are those that designate an internal AI referent, sometimes called an “AI ambassador.” This role does not necessarily require a technical profile but rather an ability to identify relevant use cases and coordinate providers.
NIS 2 directive and cybersecurity: the constraint that structures the digital roadmap
The NIS 2 directive, gradually transposed into French law, significantly expands the scope of companies subject to cybersecurity obligations. SMEs in certain sectors (health, energy, transport, digital services) must now formalize their cyber risk management and report incidents within strict deadlines.
NIS 2 transforms cybersecurity into a prerequisite for any digitalization, rather than an optional layer added afterward. Concretely, this means that the choice of a cloud tool, management platform, or automation service must incorporate the security requirements imposed by the directive from the outset.
For an SME launching its digital transformation, the roadmap must therefore articulate three simultaneous dimensions:
- The assessment of the risk level of each AI tool in light of the AI Act, along with the associated training for relevant users
- Cybersecurity compliance according to NIS 2, including mapping of digital assets and incident notification procedures
- The actual business integration, meaning the adaptation of internal processes to the new digital tools deployed
Automation solutions and digital tools: choose by use case, not by trend
Process automation remains the most accessible lever for companies beginning their digitalization. Available feedback indicates that the most measurable gains concern electronic invoicing, document management, and first-level customer support.
On the other hand, ambitious automation projects often fail due to excessive scope. Attempting to automate accounting, customer relations, and logistics simultaneously creates an integration complexity that most SMEs cannot absorb. A sequential approach (one process at a time, measured, adjusted, then expanded) yields more sustainable results.
Criteria for selecting a digital tool in a regulated context
The choice of a solution can no longer be limited to the functionality/price ratio. Three additional criteria are essential:
- The classification of the system in light of the AI Act, provided by the vendor or assessed by a third party
- The location of data and GDPR compliance, particularly for cloud solutions hosted outside the European Union
- The vendor’s ability to provide sufficient technical documentation to meet NIS 2 audits
- The existence of an integrated training program covering the mastery obligation imposed by Article 4 of the AI Act
Digital transformation in 2026 is no longer just a technological choice. It is an exercise in balancing operational performance, regulatory compliance, and the teams’ capacity to absorb change. Companies that integrate these three dimensions from the outset of their project avoid the costs of retroactive compliance, which are often much higher than the initial investment. The European regulatory framework, far from hindering digitalization, redefines the conditions for success.
