The AI Act provisions that came into force on February 2, 2025, are changing the landscape for every company that deploys or develops artificial intelligence tools in Europe. Transformation strategies are no longer just about adopting the latest generative AI platform: they now also need to account for a binding regulatory framework, ESG reporting requirements undergoing major changes, and growing pressure to secure digital supply chains.
AI Act and algorithmic governance: what companies need to map
The first AI Act obligations concern prohibited AI practices and control over how AI is used. In practical terms, every organization must inventory the AI systems it uses, identify those classified as high-risk, and document its automated decision-making processes.
Staff training is not optional. The regulation requires people overseeing AI systems to have an adequate level of competence. Legal departments, IT departments and business teams are all affected.
We find that most trend guides discuss AI in terms of productivity without addressing this layer of compliance. Several industry analyses, available in Le Blog Info’s business section, track how these regulatory requirements are evolving for French and European companies.
Assessing the risks associated with AI tools requires an internal register, updated with every new deployment. This register must specify the system’s purpose, the training data used, and the human oversight measures in place.
ESG reporting in 2026: CSRD, the Omnibus Directive and a narrower scope of obligations
The so-called “Stop the clock” directive postponed certain CSRD and CS3D deadlines. Omnibus I then narrowed the scope of the CSRD to the largest companies, changing compliance priorities for a large part of the business community.
The timeline has shifted for mid-sized companies and SMEs that expected to publish a sustainability report in the near term. This postponement does not mean requirements are easing: large companies still subject to the CSRD will continue to request ESG data from their suppliers. The pressure is moving down the value chain.
Practical implications for supplier management
A company that is not directly subject to the CSRD may still receive detailed questionnaires from its clients. Procurement teams and finance departments need to anticipate these requests by structuring how they collect environmental and social data.
A common pitfall is investing in a reporting tool before confirming whether the company is still within scope. Checking the exact scope following Omnibus I helps avoid premature spending on oversized solutions.
Digital supply chain cybersecurity: the risk digital strategies underestimate
A recurring finding in cybersecurity analyses is that a compromised service provider or third-party software can be enough to paralyze entire business processes.
Companies accelerating their digital transformation are creating more connections with SaaS providers, third-party APIs and technical subcontractors. Every new component increases the attack surface.
Three resilience measures to include in every transformation strategy
- Regular audits of digital service providers, including checks of their certifications and business continuity plans
- A contractual clause requiring prompt incident notification and the separation of customer data environments
- Resilience tests simulating the failure of a critical service provider to measure the actual time needed to resume operations
These measures are no longer solely the responsibility of the IT department. Executive committees must treat supply chain cybersecurity as a strategic risk, on a par with financial or regulatory risk.
Skills and recruitment: the gap between technological ambitions and human capital
Companies deploying AI, automating processes and strengthening their data-driven marketing all face the same obstacle: a shortage of technical skills available on the market.
The World Economic Forum’s Future of Jobs Report confirms that roles related to AI, cybersecurity and data analytics are among those seeing the fastest growth in demand. The gap between this demand and the pool of trained candidates is driving up salaries and increasing turnover in digital teams.
Strategies for developing skills internally
Training existing employees costs less than hiring externally, provided the learning path is well structured. Companies making the most progress in this area are introducing:
- Reskilling programs focused on the technologies actually being deployed (no generic training without an internal use case)
- A training budget aligned with the technology roadmap and reviewed with each strategic cycle
- Expert-business and technical staff pairings to accelerate skills transfer without relying solely on external providers
The opposite risk also exists: overinvesting in training for tools with a short life cycle. Prioritizing transferable skills (data literacy, algorithmic thinking, agile project management) delivers better returns than certification in a single product.
In 2026, business transformation will depend less on adopting a technology than on the ability to bring regulatory compliance, operational security and skills development together. Organizations that manage these three areas in silos fall behind; those that take an integrated approach become more resilient without multiplying coordination costs.
