Business leaders often ask: "Are my teams already using AI?" The honest answer, in the vast majority of companies, is yes, even without a formal approval process. AI-assisted writing, translation, data analysis, image generation: these uses take hold on their own, one workstation at a time.
Why this matters
Since August 2, 2026, a new set of obligations under the European AI Act has come into force, with penalties that can reach €35 million or 7% of global revenue. An unrecorded use isn't necessarily risky in itself; but the lack of an overall picture makes it impossible to know.
The wrong answer: ban everything
Abruptly banning AI use rarely gets teams to stop: it pushes them to keep going quietly, without ever mentioning it to leadership again. The situation then gets worse: the usage persists, but becomes invisible.
The right answer: take stock before deciding
The first step isn't to judge, but to know. An honest inventory of the tools actually in use (including those never formally approved) makes it possible to distinguish low-risk uses from those that deserve to be regulated or stopped.
- Which tools are used, by whom, and for what.
- What data flows through them, particularly customer data or sensitive information.
- The level of risk of each use with respect to the regulation.
Then, a framework rather than a ban
Once the situation is known, most companies don't need to ban AI: they need a clear framework for what is allowed, and an up-to-date register in case of an audit. That is precisely the purpose of a compliance diagnostic.
A company that discovers several unregistered tools then has a natural conversation about what needs to be put in place: without overdramatizing, and without shutting everything down.
