AI has settled into employees’ daily work faster than the rules meant to govern it. This is shown by the second edition of the Enterprise and Sustainability AI Barometer, conducted in March 2026 among 826 IT and digital professionals in France, the United Kingdom, Germany and Spain. According to the study, 66% of respondents observe Shadow AI, i.e., the use of AI tools not validated by their company.
- Les salariés adoptent l’IA plus vite que les règles ne sont mises en place.
- Un outil validé, performant et formé réduit mieux le Shadow AI qu’un simple rappel réglementaire.
- Les usages restent peu encadrés, et les agents autonomes accroissent les risques.
- Il faut un inventaire, une classification en trois listes, un registre des agents et des clauses de révision.
Co‑author of the barometer with Laurent Inard (Forvis Mazars), Dejan Glavas, professor of finance and AI at ESSCA School of Management, reflects on these blind spots and on the rules to set.
Approved tools that struggle to compete
For Dejan Glavas, the approved tool often arrives after the habit. Among respondents who notice widespread Shadow AI while their company provides its own tools, three reasons recur. Habit tops the list, as employees had adopted an assistant before their employer offered one. Next comes performance, the provided tool generally being judged inferior, and ease of use, internal tools sometimes being slower or less convenient.
He says an approved tool that supports comparison with market offerings reduces Shadow AI more reliably than a reminder of the regulation. The phenomenon is more pronounced in France, where one in five companies describes it as widespread, versus one in ten in the other three countries. He puts forward two levers. First, governance: less than one French company in two trains its staff on AI, versus three out of four in the United Kingdom. “When the rule and training arrive late, usage installs itself,” he summarises. Second, internal offering: more than four French companies out of ten still lack a tool to query their internal documents with AI.
Regarding bans, the picture is stark. One in eight companies reports that Shadow AI persists despite a clear prohibition, while tolerance is the most frequent response, at 24%. Dejan Glavas judges this stance “the most fragile”, because the company knows and lets it happen, raising a responsibility question the day data leak out. He believes a ban makes sense when it is precise, for example for customer data, payroll elements or a contract under negotiation. For everything else, he advocates governance: specify which uses are permitted, with which tools and on which data, then provide a high‑quality approved tool.
Accepted uses, but little governed
Meeting transcription tops the list of underestimated uses. Four out of five companies use language models for office work, notably for summaries, video‑conference minutes and email drafting. In France, four respondents out of ten indicate that consent to recording is requested explicitly and logged, whereas for another four out of ten it remains informal or has disappeared.
A meeting contains names, opinions about people, sometimes trade secrets, which first falls under the GDPR, the European regulation on personal data. Recruitment is another cited case: having an AI rank applications may seem harmless, but such uses can fall under the high‑risk systems of the AI Act. Finally, code raises the issue of technical debt and skills. More than half of companies that develop declare that at least a quarter of their code is AI‑assisted, a productivity gain that can be accompanied by technical debt when review lags.
On the legal framework, Dejan Glavas believes the text does exactly what it was written for. Since 2 August 2026, it requires informing a person that they are interacting with a machine and making AI‑generated content identifiable. Rules applicable to high‑risk systems, such as recruitment, will apply in December 2027. Its limitation, in his view, lies in its scope: the AI Act regulates systems and those who provide or deploy them, whereas an employee who pastes a document into a personal assistant mainly falls under internal policy and the GDPR. Fewer than three respondents out of ten say their company knows the text well.
Agents and governance framework
AI agents, capable of chaining tasks with limited human intervention, further complicate matters, because “the agent acts”. With an assistant, the employee reads a response before using it; with an agent, the email is sent, the file is modified, the order is placed. More than one company out of three already uses autonomous agents in France, according to the barometer, and nearly half of European companies use or are testing them.
Control mechanisms exist, the professor estimates. Developers speak of harnesses, i.e., limits set on the agent: reduced access rights, an activity log and human validation before any irreversible decision. He advises keeping a register of agents, with an owner for each, from the first deployment, and cites frameworks such as the NIST AI Risk Management Framework or ISO standards 42001, 42005 and 23894. With Laurent Inard, he recommends starting from real practices, beginning with an anonymous inventory of tools used, then classifying uses into three lists: what is permitted, what is permitted under conditions, and what is prohibited. Given the speed of change, he deems it important to include revision clauses.
