According to the third edition of the Data & IA Barometer, published by Coface on October 5, 2026, in partnership with Les Echos Etudes, six out of ten French companies still lack a formal framework for the use of artificial intelligence. The study surveyed 900 decision-makers across various sectors, finding that only 17 percent of companies have defined, formalized, and communicated an AI usage policy to their employees. This comes just two months after August 2, 2026, when national market surveillance authorities began monitoring the "AI mastery" obligation under Article 4 of the AI Act. This article was revised in the omnibus regulation 2026/1744, which still requires companies using AI to take steps to develop AI mastery among their staff, with a written policy being the first step in documenting this. The results are based on self-reported statements from decision-makers, meaning companies declare their own level of advancement without external verification. As of October 6, 2026, the Coface website does not provide details on the fieldwork period or the distribution of respondents by sector or company size. The full study is available for download after completing a form with personal and company information. The figures presented are from the public summary of the study. The data reveals that 60 percent of companies lack a formal framework for AI usage. Of these, 35 percent have no plan to implement one, while an additional quarter is considering the issue but has not formalized rules. Only 17 percent have a defined and communicated policy. In terms of AI usage maturity, 28 percent of companies report no structured use of AI, and 56 percent say they are little or not advanced in using AI to manage risks. In contrast, 17 percent claim to be advanced or very advanced in this area. The study also notes that 67 percent of companies consider their data reliable and relevant, up from 49 percent in 2025. However, the two 17 percent figures measure different aspects: one relates to governance (a written policy), and the other to the maturity of AI use for decision-making. The public summary does not clarify the status of the remaining companies. The barometer highlights a significant gap between large and small companies. Large firms with revenues exceeding 100 million euros are nearly three times more likely to report being advanced in AI usage compared to smaller companies with revenues under 10 million euros. This aligns with other surveys, such as one reported by ActuIA, which found that 40 percent of small and medium-sized enterprises use AI, but only 19 percent pay for it. However, these studies differ in their populations and methods, so their results are not directly comparable. Article 4 of the AI Act, which mandates AI mastery for personnel, was revised by the regulation 2026/1744. Originally, the 2024 version of the regulation (EU) 2024/1689 required suppliers and deployers to ensure a sufficient level of AI mastery for their staff. The new regulation, which took effect on July 27, 2026, shifts the focus to promoting the development of AI mastery rather than guaranteeing a specific level. This change aims to reduce the compliance burden, especially for small businesses. The obligation remains in place, with criteria including technical knowledge, experience, education, and training of personnel, as well as the context of system use and the people affected by these systems. National market surveillance authorities began enforcing these requirements from August 2, 2026. While the regulation does not set specific fines for violations, member states can impose administrative fines, warnings, and other measures, taking into account the interests of small businesses. The regulation does not prescribe a specific model for AI usage policies, and the European Commission’s frequently asked questions (FAQs) state that no particular governance structure is required to comply with Article 4. However, the Data & IA Barometer highlights common steps companies should consider, including defining the scope of AI use, listing authorized tools, identifying prohibited data, ensuring human validation of AI-generated content, maintaining a traceability register, and providing tailored training. Additionally, companies must inform and consult employee representatives when deploying high-risk AI systems, as mandated by Article 26 of the AI Act. This requirement applies to systems listed in Annex III of the AI Act from December 2, 2027. The barometer also points to a growing confidence in data, with 67 percent of decision-makers considering data sufficiently updated for risk management. However, only 58 percent believe these data are well integrated into business tools, and 51 percent think they are harmonized across departments or subsidiaries. Nesrin Gonin, director of information services for Western Europe and Africa at Coface, notes that companies have yet to create the necessary framework to fully leverage AI's potential. The delay in governance also affects documentation, making it harder for companies without written policies or training records to demonstrate compliance to regulatory authorities. This issue is not unique to France or 2026, as Capgemini highlighted governance challenges in generative AI adoption in 2025. The revised Article 4 also requires the European Commission to provide practical examples of compliance and the European Committee on AI to set common objectives, though no deadlines are specified.