The news about French companies at the end of 2026 is structured around three regulatory and technological axes that are changing operational practices: the legal framework for AI at work, the rise of the Cyber Resilience Act, and the emergence of autonomous AI agents. These topics are no longer speculative; they impose concrete decisions on general management, IT departments, and HR departments.
Consultation of the CSE before deploying an AI tool: what the case law says
The deployment of artificial intelligence tools in companies is no longer just an IT project. According to ActuIA (October 2026), a judge can suspend an AI project for lack of prior consultation with the CSE. This decision, which notably concerns the case of RATP, sets a direct precedent for any company with a social and economic committee.
The legal basis rests on the obligation of information-consultation whenever a project modifies working conditions or monitoring methods. An internal conversational assistant, a candidate sorting tool, or an automated scheduling system fall within this scope.
Most SMEs and mid-sized companies still launch their AI projects without formalizing this step. The risk is not theoretical: judicial suspension blocks deployment, generates costs due to delays, and deteriorates social dialogue.
It is better to integrate the consultation of the CSE from the framing phase, even before choosing the tool. To keep track of these regulatory developments and their impact on business management, it is possible to access the IQ Business site which aggregates this type of sector news.
AI Act and Cyber Resilience Act timeline: obligations applicable to French companies
Two European texts now structure the digital framework of companies. Their interplay remains poorly understood, even by legal departments.
AI Act: what is already applicable and what is postponed
The timeline of the AI Act has been partially revised. According to ActuIA (update of October 10, 2026), obligations related to high-risk AI systems are postponed via the Omnibus regulation. However, companies using HR scoring systems, intelligent video surveillance, or automated diagnostics remain concerned in the medium term.
On the other hand, the requirements for transparency and control of AI are already partially applicable. Specifically, this means that an employee must be informed when interacting with an AI system, and the company must document the deployed uses.
Cyber Resilience Act: expanded pressure on connected products
Effective from September 2026, the Cyber Resilience Act goes beyond the traditional scope of internal cybersecurity. According to Préventica (September 2026), manufacturers and suppliers of products containing digital elements must now ensure their security throughout the lifecycle.
For French companies that design or distribute connected objects, embedded software, or IoT components, this implies:
- A technical security documentation from the design phase, not just at the time of market launch
- A vulnerability management process with mandatory notification to the competent authorities
- Extended supplier responsibility for security updates post-commercialization
Small and medium-sized subcontractors of large industrial contractors will be the first affected, as these requirements cascade down the supply chain.
AI and cybersecurity in SMEs: the gap revealed by the France Num 2026 barometer
The France Num 2026 barometer, published on September 29 and reported by Préventica on October 9, confirms a clear trend: the adoption of AI in SMEs is accelerating, but cybersecurity is not keeping pace. The gap between technological equipment and system protection is widening.
This gap is explained by a priority bias. Leaders of small structures invest in AI for immediate productivity gains (writing, customer relations, automated accounting) without budgeting for securing these new data flows. A generative AI tool connected to CRM or messaging creates an additional attack surface.
A “security by design” approach applied to any AI integration project, even modest, involves three concrete actions:
- Mapping the data accessible by each AI tool before its production deployment
- Demanding from the vendor documentation on data processing and storage (location, encryption, retention period)
- Training user teams on specific risks related to prompts containing sensitive data
Autonomous AI agents: governing systems that make decisions
The most structuring topic for the coming months no longer concerns chatbots or writing assistants. According to Économie Matin (October 2026), companies must prepare to govern autonomous AI agents capable of executing tasks without intermediate human validation.
An autonomous AI agent can place a supplier order, adjust a price in real-time, or trigger a customer follow-up action. The difference with a simple generative AI tool is fundamental: the agent acts; it does not merely suggest.
The stakes that arise are operational and legal. The traceability of decisions made by an agent must be ensured, which requires usable and auditable logs. Human supervision must be defined in advance: what level of decision remains subject to validation? Access management becomes critical, as an agent with extensive rights on an ERP or payment system poses a systemic risk in case of malfunction or compromise.
These questions do not pertain to a distant future. The first deployments of autonomous agents in the supply chain and B2B customer relations are already underway in French mid-sized companies. Companies that have not formalized their governance framework by mid-2027 risk facing incidents without a remediation process.
The regulatory and technological landscape at the end of 2026 requires a cross-reading: the AI Act, Cyber Resilience Act, social dialogue, and governance of autonomous agents form a coherent whole. Departments that address these issues in silos expose themselves to costly redundancies and legal blind spots. The convergence between regulatory compliance, cybersecurity, and AI governance becomes the real strategic issue for French companies.
