The digital health record you don't have

Your batches have a file. Your data, however, does not...

On August 2, 2026, the European Artificial Intelligence Act became applicable, after entering into force in 2024 and being phased in since February 2025 (European Commission, 2026). In most industrial management departments, the text was filed away under software publisher topics: an issue for those who design models, not for those who manufacture parts.

Yet, the risk does not come from the model you are going to buy. It comes from the one your teams are already using, without a contract, without boundaries, and without logs. Your manufacturing routing sheets, your series variations, your supplier conditions have been circulating for months in generic assistants open in a browser tab. The day a client, an auditor, or a prime contractor asks you what has left your information system, you will not have an answer. Not because you did something wrong. Because nobody recorded anything.

A few figures to measure the gap between usage and control:

• 18% of companies established in France declare using at least one artificial intelligence technology in 2025, which is 8 points higher than in 2024 (Insee, 2026)

• 17% in the manufacturing industry, compared to 58% in companies with 250 or more employees, across all sectors (Insee, 2026)

• 73% of companies using AI resort to paid cloud services (Insee, 2026)

• 63% of surveyed organizations have no AI governance policy in place to guide its use (IBM, 2025)

• 97% of organizations that fell victim to an AI-related security incident state that they did not have appropriate access controls on these tools (IBM, 2025)

• 39.7% of interactions with AI tools in corporate settings involve sensitive data (Cyberhaven, 2026)

Definition drawings, supplier prices, non-conformity reports: what your teams are pasting into a browser

The mechanism is not spectacular. A quality engineer needs to produce a root cause analysis by the end of the day. He has a forty-page non-conformity report, a three-hour deadline, and an assistant that answers in ten seconds. He pastes the report. The analysis is good, the deadline is met, nobody talks about it.

What just occurred, technically, is a transfer. The content left your perimeter, was processed on an infrastructure you did not qualify, in a country you did not choose, under retention terms you did not read. The proportion of exchanges concerned is not marginal: nearly four out of ten interactions contain sensitive data (Cyberhaven, 2026). And as AI usage relies predominantly on paid cloud services (Insee, 2026), the data does not stay on the local workstation any more than it does on site.

Three direct consequences that appear on no dashboard.

No trace on the IT side: the request left through the browser, not through an application interface. Your monitoring only sees HTTPS traffic to a legitimate domain.

No retention rules: you know neither how long the content is stored, nor if it feeds model training, nor which subcontractors have access to it.

No reversibility: design data that has gone to a third party does not come back. You can neither recall it nor prove that it was not used.

Nothing is logged. A usage charter without logs is like a blank health record: the patient is doing fine, until the day you need to explain why they are no longer doing fine.

Since August 2, 2026, usage is no longer enough; you need proof

The European timeline placed obligations before usage patterns, which is unusual and changes the workload for technical departments.

Prohibited practices and AI literacy obligations have applied since February 2, 2025. Governance rules and obligations regarding general-purpose models have applied since August 2, 2025. The regulation itself has been applicable since August 2, 2026, and requirements targeting systems used in certain high-risk areas, including critical infrastructure, will apply starting December 2, 2027 (European Commission, 2026).

Operational translation: the literacy obligation does not concern a product; it concerns your teams. It assumes you know who is using what. Which is precisely what you do not know.

Then there is the personal data aspect. In July 2025, the French National Commission on Informatics and Liberty (CNIL) finalized its recommendations on the development of AI systems, pointing out that models trained on personal data may be subject to GDPR, that the annotation phase is decisive for model quality, and that robust filters must be planned at the level of the system wrapping the model (CNIL, 2025). Your production files contain operator names, authorizations, and intervention logs. These are personal data.

What this timeline establishes is not a technical constraint, but a reversal of the burden of proof. Until now, digital usage was presumed legitimate as long as no incident contradicted it. From now on, it is up to you to establish what was used, by whom, on which data, and in what context. Your sectors already know how to work this way for physical materials: no batch leaves without a file, no part is released without a record. Digital systems, however, remained outside this discipline for a long time. They have just entered it.

Being compliant and being able to demonstrate it are two distinct states. Only the second can be argued, document in hand, within fifteen days of a request.

The burden of proof lies with you.

"We do not do AI": the objection that protects you from nothing

The classic objection fits in one sentence: "we do not do AI". It is sincere and false. You do not have an AI project; you have AI usages. This is not the exact same thing, and only the second engages your responsibility.

The discrepancy is visible in the figures. The manufacturing industry declares a 17% adoption rate, while companies with 250 or more employees reach 58% (Insee, 2026). An industrial site with 400 people statistically has more usages than it has declared. We described this gap between real adoption and established frameworks in DeepSeek: the application that is devouring your business....

The cost of this blind spot is documented. Organizations with high exposure to shadow AI see the average cost of a data breach increase by $670,000, and 63% of surveyed organizations have no AI governance policy (IBM, 2025). The problem is not the lack of security tools: 97% of organizations affected by an AI-related incident state they did not have appropriate access controls to these tools (IBM, 2025). Access was open, quite simply.

For an industrial mid-cap or SME, the issue is not the fine. It is the gap between two disciplines coexisting in the same company: one that forbids releasing a batch without an entry, and one that lets a design file leave without a trace. The first has been taught, audited, and maintained for thirty years. The second has never even been written down.

It is not your size that exposes you. It is your lack of logs.

3 concrete actions to open the record book

1. Map flows, not tools. Start with data, not applications: which document families leave, from which business units, for what purpose. An inventory of tools becomes obsolete in three weeks. A flow map lasts for two years.

2. Set up a technical boundary, not a charter. A service memo filters nothing. A single gateway, where requests are anonymized before leaving and logged as they pass, filters everything that matters without prohibiting usage. It is there, and nowhere else, that the log line is written: request, user, timestamp, destination, retention period. Without it, your compliance is an intention; with it, it is a folder.

3. Decide where the model runs. This is the truly sovereign arbitration. A model hosted on your infrastructure does not fall under the same regime as the same model called at hyperscalers subject to extraterritorial laws. This decision is played out in your architecture, not in your terms and conditions: it is the focus of our expertise in Artificial Intelligence.

akawan designed Bosl.ai to address exactly this gateway in an industrial context: a web application that integrates request anonymization algorithms, warns and alerts users about leak risks, and bases processing on a sovereign AI, with data remaining on local servers. The user journey has been redesigned so that the secure path is also the fast path, a necessary condition for it to be adopted. The design of this application is presented on the sheet Secure chat with Bosl.ai.

Sovereignty is not declared, it is instrumented

The issue is not whether generative AI will enter your industry: it is already there, from the bottom up, without an architecture. The issue is whether it enters through a door you have installed, instrumented, and logged, or through a window that no one is watching.

This shift does not require a transformation program. It requires an architectural decision: a gateway, an anonymization rule, a log, and an explicit choice of execution venue. The rest follows, because usage always follows the shortest path.

The question to bring to your next board meeting is not "do we have an AI policy". It is: if an auditor asks us tomorrow for the list of production data that left our IT system this quarter, are we capable of producing it?