Generative AI is already in your offices. The real question is no longer whether your teams use it, but whether you know what they're doing with it. One employee in two types prompts into a consumer-grade tool, often through a personal account, while management still believes "no one here has taken the plunge yet." This gap between actual use and the official framework is the subject of this article: what pays off, what creates exposure, and the simple governance that reconciles the two.
Key Takeaways
- 55% of French small and mid-sized businesses use generative AI as of late 2025, but only 17% use it regularly (Bpifrance Le Lab, January 2026)
- 61% of French employees use AI tools outside any official framework (Microsoft/YouGov, 2026)
- Fear over data is the top barrier: 33% of business leaders cite it (Bpifrance Le Lab, 2025)
- The AI Act applies in full on August 2, 2026: usage needs mapping, even at a small business
- Effective governance fits on one page: approved tools, banned data, one person in charge
Adoption has doubled, governance hasn't caught up
The adoption figures are dizzying. According to the Bpifrance Le Lab survey published in January 2026, 55% of French small and mid-sized businesses say they use generative AI as of late 2025, up from 31% a year earlier. Twenty-four points gained in twelve months. The Baromètre France Num 2025 confirms the trend on a broader scale: 26% of French small and mid-sized businesses use at least one AI solution, double the 2024 figure.
But look at the second number, the one that changes everything: regular use applies to only 17% of companies. In plain terms, a majority has tried it, a minority has industrialized it. Bpifrance calls this a "shift in usage." You can also read it another way: the tool came in through the back door, in employees' hands, before the company set a single rule.
It's this mismatch that creates risk. Not the technology itself, but the fact that it circulates with no framework. The use cases that work are known and documented. What's missing is the safety net around them.
Three uses that genuinely pay off
Not all uses are equal. The two that dominate among French small and mid-sized businesses, as measured by Bpifrance Le Lab in late 2025, are content generation (72%) and data analysis (67%). These are also the two that produce the most value once plugged into a real process.
In practice, at a French small business, generative AI pays off on three families of tasks:
- Writing what no one has time to write. Sales proposals, meeting minutes, replies to repetitive emails, product sheets. The gain is immediate and measurable in hours.
- Reading and summarizing documents. A 40-page contract, a tender, a set of accounting records: AI extracts what matters in seconds.
- Analyzing data without a data scientist. Cross-referencing files, spotting trends, producing a simple dashboard.
What separates a use that pays off from a gimmick comes down to three conditions: it draws on your own data, it plugs into an existing process, and the user knows what they're doing. Meeting these three conditions is exactly the work of an assessment of your processes, not a subscription purchase.
The risks that don't show up in the spreadsheet
The risk isn't that AI is bad. It's that it gets used without anyone having decided so.
The number that sums it all up: according to a Microsoft/YouGov study published in 2026, 61% of French employees use AI tools outside any official framework, often through personal accounts. English speakers call this "shadow AI." Your customer data, your contracts, your cost prices pass through tools whose terms of use, and whose handling of that data, the company has never reviewed.
The fear isn't irrational. It's even been measured: in the Bpifrance Le Lab survey from June 2025, 33% of business leaders cite fear of confidential data being misused as the top barrier to adoption. They're right to be wary. By default, data sent to a consumer-grade chatbot can be used to train the model, as the practical guide from the Conseil national des barreaux (France's national bar council), republished on France Num, points out.
For regulated professions, this isn't even a matter of caution - it's a matter of professional ethics. Law firms and professional secrecy can't entrust a legal document or a filing to a tool whose confidentiality they don't control. The answer exists: run the models locally, so data never leaves the company. That's the position NexeAI holds, and it's nothing theoretical.
The AI Act is arriving: what it changes for a small business
Many business leaders still think European AI regulation doesn't concern them. That was true yesterday; it stopped being true on August 2, 2026, when the AI Act applies in full. From that date, most obligations on high-risk AI systems take effect across all 27 member states.
Two things worth remembering, without going into legal detail.
First, the AI literacy obligation, in force since February 2025, applies to every company, not just tech giants. In practice: an employer must ensure that people using AI systems on its behalf have a sufficient level of competence. Letting an employee figure out a tool alone already falls short of this obligation.
Second, the AI Act works by risk level. Most uses at a small business (writing, analysis, summarizing) fall under minimal or limited risk: few constraints, but a transparency obligation. High-risk systems concern recruitment, health, education, or critical infrastructure. If your company touches these areas, the obligations become real: technical documentation, human oversight, risk management.
The right reflex isn't to panic, but to map things out: which tools use AI, in which processes, with which data. The regulation provides for penalties of up to €35 million or 7% of worldwide turnover, but a small business that keeps a simple log of its uses is far from those extremes.
Simple governance fits on one page
The word "governance" sounds intimidating. People picture a committee, procedures, a consulting firm. For a small business, useful governance fits on one page.
It answers four questions:
- Which tools are approved? A closed list, not "whatever works." ChatGPT for writing, a local tool for sensitive data, nothing for customer data in a public chatbot.
- Which data must never leave the company? Customer data, health data, HR data, trade secrets. The list is short, but it must be written down.
- Who's responsible? One person, not a department. They answer teams' questions and approve new tools.
- Who's trained? A tool with no training produces mediocre results and mistakes. Training your teams isn't a luxury, it's the condition for any gain.
French companies have gotten the message: according to KPMG, 60% of them are putting cross-functional AI governance in place and 86% have adopted a responsible-use charter. The charter is the right starting point: a one-page document every employee reads and signs.
Governance isn't a brake on innovation. It's what lets you benefit from AI without exposing the company. Once the framework is in place, you can move on to the uses that really change things: AI agents that automate entire tasks, the logical next step after generative AI.
FAQ
How much does deploying generative AI cost a small business?
It depends on the ambition. Controlled use of existing tools can start for a few tens of euros a month per user. A local solution, which keeps your data with you, requires a larger upfront investment but removes the risk of a leak. The costly mistake isn't the subscription - it's deploying with no framework and getting no gain at all.
Do you need a DPO or a lawyer to comply with the AI Act?
Not necessarily. For a small business whose uses fall under minimal or limited risk, a simple log of tools and a usage charter are largely enough. Legal support becomes useful once you touch sensitive data or high-risk use cases like automated recruitment.
What's the difference between generative AI and an AI agent?
Generative AI produces content: text, images, summaries. An AI agent chains actions: it reads a document, makes a simple decision, carries out a task, then moves to the next one. The agent is the logical next step after generative AI, once the framework and the data are in place.
Where do you start when you haven't done anything yet?
With an honest inventory: who's already using what, with which data. This is the step everyone skips, and it explains most failures. Then, a single measurable use case over three months, rather than ten experiments running in parallel.
Conclusion
Generative AI in business is neither a gimmick nor a magic revolution. It's a tool that pays off when it's managed, and creates exposure when it isn't. The figures are clear: adoption has doubled in a year, but regular use remains a minority, and more than half of employees use tools outside any framework. Governance isn't one more constraint - it's what turns scattered experimentation into a lasting gain.
The right order comes down to three steps: map out what already exists, set a one-page charter, train those who use the tools. NexeAI supports small businesses and independent professionals through each of these steps, with a clear stance: local, no-code AI, where your data stays with you. Let's talk about your situation to take stock, with no commitment.
