When deploying a generative AI tool in a marketing team or customer service, the first question is no longer “which model to choose” but “are we allowed to use it this way.” This shift summarizes much of what has changed in tech in 2024: tools are advancing quickly, regulations are closely following, and decisions are now made as much on legal grounds as on technical ones.
AI Act: what the European regulation concretely changes on the ground
The European regulation on artificial intelligence (AI Act) was published in the Official Journal of the EU on July 12, 2024, and came into effect on August 1, 2024. Its architecture is based on a classification by risk levels, with obligations graduated according to the use of the AI system.
What distinguishes this text is its progressive timeline. The first prohibitions (social scoring, behavioral manipulation) apply from February 2, 2025. Obligations regarding general-purpose AI models follow from August 2, 2025. We are not dealing with a regulatory big bang, but with a gradual ramp-up spread over several months.
For companies, this means an inventory task: listing the AI systems used internally, classifying each use according to the risk level defined by the regulation, documenting processes, and training teams. You can find tech info on Web Hebdo that regularly details these regulatory developments applied to everyday tools.
A often underestimated point: compliance also concerns companies deploying AI, not just those designing the models. An HR department using an AI-based CV screening tool falls within the scope of the regulation just like the software publisher.
Data security and information systems in 2024
Generative AI has opened new attack vectors. Personalized phishing generation, voice deepfakes for social engineering, or the use of language models to detect vulnerabilities in source code have become scenarios documented by IT security teams.
In response, security solutions are also integrating artificial intelligence to analyze network behaviors in real-time. We observe a shift in investments: less classic perimeter firewall, more behavioral detection and dynamic segmentation.
What changes for SMEs
Large companies have dedicated teams. For smaller structures, the use of managed security services in the cloud is emerging as a viable compromise. These platforms pool monitoring, threat analysis, and incident response.
Feedback on this point varies by sector: an industrial SME does not have the same constraints as a consulting firm. The decision often revolves around the relationship between the cost of an incident and that of prevention.
Cloud technologies and hybrid computing: the decisions of 2024
The debate of “all cloud” versus “return to on-premise” has refined. In practice, most organizations operate in hybrid mode, with workloads distributed between local infrastructure and public cloud based on data sensitivity and latency constraints.
- Data subject to strong regulatory requirements (health, finance, public sector in France) often remain hosted on qualified or sovereign infrastructures
- Variable workloads (data analysis, AI model training, application testing) migrate to the public cloud to benefit from elasticity
- Critical applications with low latency (industrial control, embedded systems) increasingly rely on edge computing, with processing done as close to the source as possible
The choice of architecture depends on the use case, not on a doctrine. One does not migrate “to the cloud” by principle; one places what has a measurable operational interest there.
Generative AI in business: beyond demonstration
The experimentation phase with ChatGPT and its equivalents has given way to a more down-to-earth question: how to integrate these tools into existing business processes without creating technical debt or legal risk.
The use cases that hold up after several months of deployment share common characteristics:
- A narrow and well-documented scope (drafting template emails, summarizing meeting notes, generating initial code drafts)
- A systematic human validation loop before any dissemination to the outside
- A clear framework on training and prompt data to avoid injecting confidential data into third-party models
- A training of teams that goes beyond a simple tutorial and covers the limitations of the model (hallucinations, biases, lack of data freshness)
Companies that derive concrete benefits from generative AI are those that framed the use before deploying the tool. The opposite produces disappointing results and a quick rejection by teams.
The question of general-purpose models
The AI Act imposes specific obligations on providers of general-purpose AI models, particularly regarding technical documentation and transparency on training data. For companies building business applications on these foundations, this means verifying the compliance of the underlying model, not just that of the application layer.
This subject remains technical and still poorly understood in many organizations. The trend in 2024, on this front, is less about massive adoption and more about structuring: mapping uses, documenting risks, training employees.
The tech landscape of 2024 is characterized less by spectacular breaks than by a rapid maturation of usage frameworks. The tools exist, regulations are clarifying, and concrete work is now being done in the decisions of architecture, compliance, and team training.
