The digital transformation of a company is no longer managed like a traditional IT project. Since the gradual implementation of the European AI Act, any adoption of artificial intelligence technologies comes with regulatory obligations that change the approach. Leaders who ignore this framework face direct operational and legal risks.
AI Act and digital transformation: the regulatory framework that roadmaps overlook
The Article 4 of the AI Act, applicable since February 2, 2025, imposes a sufficient level of AI mastery by the personnel using these systems. In practical terms, this means that deploying a customer scoring tool, a chatbot, or a recommendation engine without training the relevant teams exposes the company to sanctions.
Article 50, applicable since August 2, 2026, adds transparency obligations towards affected individuals (clients, employees, candidates) as soon as an AI system is involved in a process. For an SME automating its after-sales service or recruitment process, this requires documenting each AI touchpoint and informing end-users.
Regulation (EU) 2026/1744, known as the “digital omnibus on AI,” which came into effect on July 27, 2026, has, however, eased and postponed several obligations for SMEs. We recommend precisely mapping the AI systems already in production before launching any new innovation project, as this mapping determines the level of regulatory requirements applicable.
Companies that structure their AI governance from the framing phase, rather than at the end of the project, gain several months on compliance. Specialized support in digital strategy facilitates this articulation between innovation and compliance, as proposed by https://www.upsidecom.fr/ in its consulting missions.
Technical debt and API integration: the real barrier to technological innovation
The majority of digital transformation failures do not stem from a poor tool choice. They arise from an accumulated technical debt on existing systems that makes any integration costly and fragile.
An aging ERP without REST APIs, a CRM with customer data duplicated across three distinct databases, a billing system that communicates with nothing: this is the daily reality for most French SMEs. Deploying AI or automation on top of this layer is like building on sand.
We observe that companies that succeed in their transformation start with a technical audit focused on three points:
- The state of available APIs on their business tools (ERP, CRM, HRIS) and the actual interconnection capability between these components
- The quality and uniqueness of customer and product data, as an AI model trained on inconsistent data produces unusable results
- The level of obsolescence of infrastructures (hosting, security, software versions) that conditions compatibility with recent cloud solutions
Resolving technical debt before innovating is cheaper than discovering it during deployment. This sequencing is rarely popular with executive management, who prefer to see a POC of generative AI rather than a data cleaning project. Yet, it is this project that determines the success of everything else.
Business process automation: choosing the right use cases
Automating a poorly designed process means accelerating a problem. Before connecting a RPA tool or an automated workflow, it is essential to identify the processes that generate the most operational friction and are based on stable and documentable rules.
High-return use cases for SMEs are not the most spectacular. Automatic accounting reconciliation, intelligent routing of incoming customer requests, or automated reporting generation from structured data produce measurable gains in just a few weeks.
On the other hand, generative AI projects applied to customer relations (advanced conversational chatbots, automatic drafting of business proposals) require a longer calibration phase and ongoing human oversight to avoid deviations. Article 50 of the AI Act reinforces this supervision requirement since the customer must know they are interacting with an automated system.
The selection criterion for a use case is not technological sophistication. It is the ratio between the implementation cost (integration, training, maintenance) and the recurring operational gain. A simple table suffices:
| Criterion | Priority use case | Risky use case |
|---|---|---|
| Business rules | Stable, documented | Changing, implicit |
| Task volume | Repetitive, daily | Occasional, variable |
| Available data | Structured, centralized | Dispersed, non-standardized |
| Regulatory impact | Low (back-office) | High (customer relations, HR) |
Training and skill development: legal obligation and performance lever
The AI Act has transformed team training from a “nice to have” into a regulatory obligation for any company deploying AI systems. Article 4 does not specify a number of hours or a standard program, but requires that personnel have a sufficient level of mastery. The burden of proof lies with the company.
We recommend structuring skill development at three levels:
- Operational level: daily users of automated tools master nominal cases, system limitations, and escalation procedures
- Management level: business leaders know how to interpret performance indicators of digitized processes and decide between automation and human intervention
- Governance level: management and the DPO understand the transparency, documentation, and supervision obligations imposed by the AI Act
This structuring avoids the classic trap of generic “digital culture” training that produces no concrete change in practices. An employee trained on their tool, in their business context, adopts the technology. An employee who attended a webinar on “the stakes of digital” does not change anything in their way of working.
The most effective digital transformation is not the one that piles on the most technologies. It is the one that identifies three or four high-impact processes, cleans them technically, automates them within a controlled regulatory framework, and trains teams to utilize them. The rest is noise.
