Arkange90% of French companies use AI without a governance framework (Usine Digitale, 2025). Meanwhile, the European AI Act is entering application in stages and the CNIL is hardening its controls on algorithmic processing. An AI agent that runs without an audit log, without a named business owner and without a rollback procedure piles up compliance debt.
This article dismantles that debt line by line and ends with an operational checklist to run before production.
The thesis. An AI agent without governance is an active risk
An AI agent deployed without an operational framework (business owner, audit log, rollback procedure, documented data scope) does not deliver net productivity. It transfers regulatory and operational risk onto the company, at a pace proportional to its usage rate. That is the thesis of this article, held up by three facts.
First fact. 90% of French companies use generative AI without a formalized governance framework (Usine Digitale, 2025).
Second fact. The European AI Act has been in progressive application since August 2024, with the obligations on high-risk systems hardening in 2026.
Third fact. Out of 1,491 respondents across 101 countries, only 1% of companies reach AI maturity (McKinsey State of AI, 2025). Nearly all organizations that deploy therefore do so without a complete framework.
Laid upstream, governance is what lets you go faster afterwards without breaking everything.
Why the AI Act changes the game for every French SMB and mid-cap in 2026
The European AI Act does not concern only the CAC 40 giants. Any company deploying an AI system for decisions affecting people (CV screening, client scoring, care recommendation, file assessment) enters the high-risk systems scope. That includes a good part of the HR, finance, health and legal use cases found in SMBs and mid-caps.
The text imposes operational obligations. Technical documentation, event logging, human supervision, training data quality, transparency toward users. For general-purpose models, the obligations extend to dataset traceability and incident reporting. Fines are capped at €35 million or 7% of global revenue.
In already-regulated industries, the step is familiar. Aeronautical subcontractors supplying critical parts to the major aircraft makers have long had documented traceability processes. Transposing that culture to an AI agent handling quality data is a limited cultural jump. For an accounting firm subject to the Order’s standards, the governance of an AI agent helping prepare a tax return must align with the existing professional obligations. For an online bank, the ACPR does not wait for the sector to be ready, compliance remains a prerequisite.
Why an AI agent without an audit log is not deployable
The scenario that comes back most often in the post-incident analyses published by the CNIL and the European sector authorities in 2024-2025 is the following. A decision-support AI agent, deployed without an audit log at the level of the decision itself, ends up producing biased outputs with no trace to trace the cause back. Application screening, client scoring, care recommendation, file assessment, the pattern is the same everywhere.
Without an audit log recording the features that weighed into the decision, nobody notices quickly, because standard dashboards only show aggregate scores. The alert most often comes from one specific individual case (a candidate asking a detailed question about their rejection, a client asking why their file was classified as risk), and the retrospective audit is complicated, slow and expensive.
The direct cost of such an incident stays limited when it is detected early and an operational kill-switch exists. The avoided cost, a CNIL report, a characterized discrimination, an internal trust break, is of another order entirely. The rule to hold before any production go-live is simple. An AI agent without an audit log at decision level is not auditable, and a non-auditable agent stays in pilot. That holds for HR, finance and legal uses, and every use case producing a high individual-impact recommendation.
The 4 pillars of an operational governance framework for AI agents
A functional governance framework for AI agents stands on 4 pillars.
Pillar 1. A named business owner
Every AI agent has a first and last name as business owner, beyond the “data department” or the CIO office. This person decides the scope, validates evolutions and receives alerts in case of drift. Without a named owner, the agent becomes an orphan within 6 months. The rule is binary and applies to every sector. No identified owner, no deployment.
Pillar 2. An audit log at decision level
Logging “the agent answered 1,247 tickets today” is useless the day the CNIL knocks at the door. The log must record, for every sensitive decision. The input, the output, the sources used (RAG), the model version, the prompt version and the timestamp. 5-year storage minimum for AI Act high-risk uses. That verbosity is necessary.
Pillar 3. A documented rollback procedure
If the agent derails, how long does it take to cut it off cleanly without breaking the business process that grew around it? If the answer is “we do not know”, the agent should not be in production. The standard to aim for is a two-level kill-switch, with automatic suspension on an anomaly threshold and manual switch-over to the pre-AI process in under 30 minutes.
Pillar 4. Explicit data scope and residency
Which data enters the agent? Where is it processed? Which data must never leave? An agnostic and modular architecture lets you switch LLM or move on-premise without a rebuild, precisely so that data residency is not a choice frozen at the start. In critical industries (aeronautics, defense, health), where actors handle sensitive technical data, this point is not negotiable.
Governance as an accelerator
The most mature industrial organizations run several months ahead of their competitors on business AI agent deployment, carried by a governance laid upstream. When the framework is set, every new use case inherits the governance decisions already made. Security, the audit log and the owner are instantiated per agent from the existing frame.
Shadow AI does the opposite. 90% of companies let their employees use ChatGPT, Claude or Mistral on business data with no framework at all (Usine Digitale, 2025). Every incident is handled case by case, in urgency, without a methodological framework.
On an AI maturity grid of five levels, governance is what separates the N3 Deployer level from the N4 Industrializer level. A 10/30/100 rhythm (10 days for a first agent in test, 30 days for team adoption, 100 days for measured ROI) only holds if governance is laid from day 10.
Checklist. 9 points to check before an AI agent goes to production
This checklist is the operational distillate of the 4 pillars, crossed with AI Act requirements. To be checked literally, in the meeting, before switching an AI agent from pilot to production.
- A named business owner (first name, last name, role) with a written mandate to validate evolutions
- A documented functional scope. What the agent does, what it does not do, escalation cases to a human
- AI Act classification done. Limited-risk, high-risk or unacceptable system, with justification
- Audit log at decision level activated, with 5-year retention for high-risk uses
- Training dataset and RAG sources documented, with the last update date
- Rollback procedure tested in real conditions with the maximum switch-over time measured
- Human supervision defined. Who validates what, at what frequency, with what level of veto right
- User transparency notice in place. The person interacting knows they are talking to an AI
- A scheduled quarterly review plan. Model drift, regulatory evolutions, adjustments
If any of these points is not covered, the agent stays in pilot. It is an honest risk accounting.
What it means for your next decision
If you are reading this article as a leader, CDO or CIO of a French SMB or mid-cap, here is the operational translation. The AI agents you deployed in 2024 and 2025 were probably put into production without a complete operational framework. That is the statistical norm. The window to catch up on that debt is the year 2026, before AI Act controls generalize.
A governance audit over an existing agent fleet usually takes 10 to 15 working days and leads to a sequenced remediation plan. The exercise remains a structured inventory followed by a few targeted adjustments.
A governance diagnostic crosses the 4 pillars above with the existing agent fleet and the AI Act classification. It produces a mapping, a prioritization of remediations and a cost estimate, ready to move to action in the following weeks.
