French study on AI in companies

A study published by the Bank of France in September 2026 found that 67% of companies with at least twenty employees use generative AI, often through tools that employees use directly. The study highlights three primary ways AI functions enter company systems: through publishers adding AI features with updates, IT administrators enabling functions via drivers or connectors, and employees using public assistants or connecting applications via personal accounts.

Legal distinctions in AI use

For legal professionals, the distinction between these paths is crucial. AI functions can be in one of three statuses: paid, activated, or used. A function is paid when a subscription or license that includes it is billed to the company. It is activated when at least one user can use it, either due to an administrator's setup or a default activation by the publisher. It is used when at least one user has used it in the last 28 days, according to usage reports from the publisher.

Independent AI statuses

These statuses are independent. A function can be paid but not activated, activated but not used, or used without prior company decision. This distinction matters because legal texts such as contracts, data processing registers, and CSE consultations target different statuses. For instance, contracts relate to what is paid, while data processing registers concern what is activated and used on personal data.

Tracking information origins

The method described in the study emphasizes the importance of tracking the origin of each piece of information. Information can be derived from tool documentation, company declarations, or calculated from other data. When information cannot be verified, it is noted, along with the source and date of the documentation.

Limitations of the method

The study also outlines limitations of the method, which is built from licenses, settings, and usage reports, not from emails or documents. Usage data appears by tool, not by individual, and does not track groups of fewer than ten people. This ensures the list is accessible to all, including the CSE, without revealing control tools.

Relevant legal frameworks

Three legal texts are particularly relevant: the GDPR, Article 30, on the register of processing activities; the European regulation on artificial intelligence, which requires a sufficient level of mastery of AI by personnel and sets obligations for deployers of high-risk systems; and the Labor Code, which mandates CSE consultation on new technologies and information on employee control means.

Public method for AI tracking

The method described is public and versioned (ojja.ai/methode, version 1.7, October 2026) and serves as a foundation for measuring AI adoption, stopping where legal advice begins.