Where do French and European SMEs really stand facing the AI Act, GDPR, and NIS2? The metrics you won't see in official press releases.
of French SMEs remain non-compliant with GDPR — six years after it came into force.
Regulatory compliance for large enterprises is well documented. That of SMEs is far less so. Available studies often stop at declarations of intent — "we are in the process of becoming compliant" — without measuring the actual state of practices.
This barometer compiles available public data from the CNIL, ENISA, the French General Directorate for Enterprise, and France Num. It does not claim to be exhaustive. It provides the most reliable overall diagnostic available today, and invites SMEs to contribute directly via our participatory study. This work is supervised by our team of experts .
Themio is running its own parallel study of French and European SMEs. The results will be published in the 2027 Barometer.
Participate in the study →Survey hosted on the official European Commission platform — your data is processed in compliance with GDPR.
Lack of awareness of obligations or failure to implement. This figure has remained stable since 2022.
Absence of compliant cookie banners, outdated privacy policies, unconsented trackers.
An increase of +780% compared to 2024 (55 M€). 32% of audited companies were SMEs or VSEs.
This document is mandatory for any structure processing personal data — virtually all companies.
This figure has doubled in one year. The majority of these companies are unaware that AI use is now governed by Regulation (EU) 2024/1689 (AI Act) .
Direct consequence: NIS2 obligations — which entered into force in October 2024 — remain largely unimplemented in structures with fewer than 250 employees.
| Regulation | SME Awareness Level | Estimated Compliance Level | Next Key Deadline |
|---|---|---|---|
| GDPR (Regulation EU 2016/679) | High — known by 80%+ of managers | Low — 40% compliant on substance | Continuous reinforced CNIL audits |
| AI Act (Regulation EU 2024/1689) | Low — less than 20% of SME AI users have heard of it | Very Low — virtually non-existent compliance | Article 4 (AI literacy): in force since Feb. 2025 — High-risk systems: December 2027 (Digital Omnibus delay, May 2026) |
| NIS2 (Directive EU 2022/2555) | Medium — known by the most exposed sectors | Low — delayed transposition in the majority of Member States | French transposition pending — check national status |
Digital Omnibus (May 2026): The postponement of high-risk AI Act obligations to December 2027 was finalized in May 2026. This postponement does not affect Article 4 (mandatory AI training) or prohibited practices, which have been in force since February 2025.
Not all SMEs are exposed in the same way. Here are the four sectors where the gap between compliance and obligations is most critical.
AI is heavily used for CV screening, attendance management, and performance evaluation. These uses fall directly under the category of "high-risk AI systems" in Annex III of the AI Act (Article 6). Obligations for transparency and human oversight apply — even for an SME with 20 employees using third-party HR software that integrates AI.
Advertising trackers, algorithmic personalization, commercial chatbots: three constant GDPR friction points. The CNIL has made cookies and consent its enforcement priority since 2023. E-commerce SMEs are overrepresented in simplified procedure sanctions (fines up to €20,000).
Entities subject to NIS2 as critical digital service providers. Obligation to report security incidents within 24 hours. 51% of VSEs/SMEs have already suffered a data security incident — without reporting it in the vast majority of cases. 📎 Source: France Num GDPR 2024
Health data = special category within the meaning of Article 9 GDPR. Maximum level of protection required. A sector with a structural delay in digital compliance despite a higher-than-average exposure to penalties.
Most SMEs think the AI Act only concerns AI developers. This is false. The regulation distinguishes two roles: the provider (who develops the system) and the deployer (who uses it in a professional context). As a deployer, an SME has obligations: verify that the system is compliant, train its staff (Article 4), and not use AI to monitor its employees unlawfully. Using ChatGPT, HR software with automated scoring, or a facial recognition tool places the SME within the scope of the regulation.
The absence of a record of processing activities is a documented infraction, auditable during a CNIL inspection, and punishable independently of any security incident. 59% of SMEs do not keep one. The record is not an optional document: it is the simplest GDPR obligation to implement and the first one that the CNIL verifies.
The Digital Omnibus has postponed certain obligations to December 2027. However, three obligations remain active starting now: the ban on AI practices with unacceptable risk (in force since February 2025), the obligation for AI training (Article 4, in force since February 2025), and rules applicable to general-purpose AI models (in force since August 2025). SMEs that wait until 2027 to start becoming compliant are taking a real risk.
Available data on SME compliance is mainly declarative or comes from large firms working with mid-caps and large enterprises. There is not yet a systematic, independent, and representative study of SMEs with fewer than 250 employees in France and Europe.
We are building it.
The survey takes less than 5 minutes. It is hosted on the official European Commission platform (EUSurvey). Your responses are anonymized and processed in compliance with GDPR.
Participate in the Themio Study →This barometer is based exclusively on verifiable public data from French and European institutions. No data is extrapolated or estimated without a documented basis.
| Data | Source | Year |
|---|---|---|
| 60% of SMEs are GDPR non-compliant | RGPDKit — CNIL 2025 Review | 2025 |
| 88% of VSE/SME sites are non-compliant with GDPR | Cartegie — GDPR 7 Years On | 2024 |
| €486M in CNIL fines in 2025 | DPO Partage — CNIL 2025 Penalties | 2025 |
| 32% of audited entities are SMEs/VSEs | CNIL — 2025 Annual Report | 2025 |
| 41% of VSEs/SMEs keep a record of processing activities | France Num GDPR 2024 Barometer | 2024 |
| 51% have suffered a data security incident | France Num GDPR 2024 Barometer | 2024 |
| 26% of VSEs/SMEs use an AI tool (x2 in one year) | France Num 2025 Barometer | 2025 |
| 59% of EU SMEs lack qualified cybersecurity staff | ENISA — NIS Investments 2025 | 2025 |
| Article 4 AI Act — training in force Feb 2025 | DGE France — European Regulation on AI | 2025 |
| Postponement of high-risk AI Act → Dec 2027 | Digital Omnibus — provisional Council/Parliament agreement, May 7, 2026 | 2026 |
Find out if you are in compliance with the European AI Act by evaluating your transparency obligations today.
Or participate in our study and contribute to the 2027 Barometer:
Answer the Themio survey →