The start of 2026 confirmed businesses’ appetite for artificial intelligence. Assistants are proliferating, models are being integrated into business software, and the first agents are beginning to handle sequences of actions. According to the 2026 report on the digital decade, nearly one in five European companies now uses AI. Adoption is progressing rapidly, but the focus has shifted. Executives now want to know which projects can be scaled up, at what cost, and with what measurable benefits.

This shift calls for stricter selection criteria. A project must improve processing times, reduce costs, enhance service quality, or open up a new revenue stream. Experiments that lack business relevance, reliable data, or performance metrics become difficult to justify. The true cost of generative AI also includes integration, data preparation, security, response monitoring, and change management.

Technology departments are thus adopting a portfolio approach. They must discontinue certain projects and focus their resources on the most promising use cases. Innovation remains essential, but it is now judged by its ability to scale.

Resilience: A New Measure of Performance

The pursuit of value also requires companies to gain a better understanding of their risks. Cyberattacks, service disruptions, geopolitical tensions, and reliance on a handful of global suppliers have brought business continuity back to the forefront. A service that is fast but unavailable at the wrong time—or impossible to migrate—can end up costing far more than the savings promised at the time of purchase.

As for European regulations—from NIS2 to DORA and the Cyber Resilience Act—they are accelerating this trend. According to ENISA, compliance is, in fact, the primary driver of cybersecurity investments for 70% of the organizations surveyed. However, their main challenges involve patch management, business continuity, and supplier-related risks. Here, meaningful compliance goes hand in hand with true resilience.

Technological sovereignty involves the same trade-offs. But it is not simply a matter of buying European products on principle or hosting data within the Union. Decision-makers are examining the applicable jurisdiction, access to data, reversibility, portability, software dependencies, and a service provider’s ability to continue providing its service in the event of

external disruption. In 2026, the European Commission incorporated these criteria into a framework for assessing cloud sovereignty. As a result, this issue is beginning to have a tangible impact on requests for proposals.

The Choice of Technology: A Governance Decision

Strategic decisions now extend beyond the scope of the IT department alone. Business units want quick results. The finance department monitors total costs and the rise in cloud usage. Legal teams assess liabilities and data transfers. Security teams seek to limit access, prevent data leaks, and avoid new dependencies. Human resources must identify available skills and organize training.

This diversity makes decision-making slower, but also more realistic. It brings to light issues that have long been pushed to the sidelines. Who owns the service? Who validates the data? Who monitors the results? What happens if the provider changes its model, pricing, or contract? How do you retrieve the data, business rules, and historical records? A high-performance architecture is only valuable if the organization knows how to manage it and can transition away from it.

The skills gap remains a major obstacle. Europe is making progress in adopting cloud computing, data, and AI, but it still lacks digital specialists. Simply purchasing a platform does not create governance or the ability to execute. Companies need hybrid professionals who can bridge the gaps between technology, business, risk, and regulation. They must also train users, as a lack of understanding of AI can lead to unauthorized use, errors in judgment, and the exposure of sensitive data.

The AI Act Establishes Industry Standards

The phased implementation of the AI Act underscores this transformation. As of August 2, 2026, most of the regulations have taken effect, including several transparency requirements for interactive systems and user-generated content. Requirements for high-risk systems will follow in December 2027, and those for systems integrated into certain regulated products will take effect in August 2028.

This timeline leaves no room for delay. An organization must already take stock of its AI systems, specify their purpose, identify the vendors and the data used, classify the risks, and designate those responsible. It must organize documentation, traceability, human oversight, incident tracking, and the provision of information to those affected. This work goes beyond legal compliance. It allows organizations to regain control over practices that are sometimes deployed faster than the governance frameworks can keep up.

This is the key technological priority for the second half of 2026. Executives want to know whether an innovation can be deployed, funded, secured, explained, and replaced. For European players, this requirement also represents an opportunity. Trust, transparency, interoperability, and control over dependencies can become competitive advantages—provided they are demonstrated in products and contracts, rather than left merely at the level of rhetoric.