AI is already in your organisation: are you in control of it?

1. Who already uses AI in your institution, and outside what framework?

Higher education does not have its own figure yet: as far as we know, no quantified survey of staff at French institutions had been published as of October 2026. The figures available come from the French civil service and from an international survey covering all sectors.

In the civil service, the survey published in April 2026 by the French Ministry of Public Action and Accounts (1,867 public servants already exposed to AI) gives the order of magnitude: 89% use it in their work, and 55% say they use tools outside the formal framework¹. Only 31% say they have been trained by their employer.

In higher education, the obstacle is named without being quantified. The ministry report of July 2025 notes that “the absence of frameworks” for the use of AI holds back its use, particularly among staff; institutional charters (Université Paris-Saclay in 2025, Université de Brest in 2026) seek to address this².

A conversational assistant answers a question and stops. An AI agent carries out a multi-step task: it reads an internship agreement, checks the mandatory clauses, prepares the reply and moves on to the next file. The Work Trend Index 2026 measures this shift in companies: the number of active AI agents on the report publisher's platform grew fifteenfold between March 2025 and March 2026, and eighteenfold in large companies³. In its survey of 20,000 people who use AI at work in ten countries, 16% are advanced users: they hand multi-step tasks to agents, regularly rethink how they work with AI and share common practices (8% in France)⁴.

You can produce your own figure in a week. Ask each department one question, with no sanction: “what do you already use, for what, and with which data?”. The answers give you the list of uses to bring under a framework first: those that affect a student, a company or a file.

2. Why is this more serious than shadow IT?

Because an agent acts. Software installed without authorisation used to read your data. An unauthorised agent writes, sends and modifies, in the institution's name. Three cases show the gap:

1. 1)An agent connected to the admissions inbox replies to an applicant. If it ranks or rejects applications, the use falls under Annex III, point 3(a), of the EU AI Act (access and admission): a high-risk use. If it only provides information to the applicant, it falls outside it.
2. 2)An agent prepares and sends enrolment certificates, and updates the student's file. An error by the agent is repeated on every file processed before a person notices it: one wrong email to a student can be corrected; a thousand wrong emails can end up on social media that same evening.
3. 3)An administrator pastes a student's file into a personal account so that an agent can draft the reply. Personal data leaves the institution, without a trace. The CNIL (the French data protection authority) and the Conseil de l'IA et du Numérique (CIANum) devote their exploratory note of 20 July 2026 to the risks of agentic AI for personal data⁵.

In all three cases, the same elements are missing: a named owner, access rights that have been decided, a log, and the ability to stop the agent.

The law makes these gaps visible:

1. 1)Since 2 August 2026, an AI system that interacts directly with people must let them know that they are dealing with an AI, unless this is obvious (Article 50 of Regulation (EU) 2024/1689)⁶.
2. 2)For a public institution in France, an individual decision taken on the basis of algorithmic processing must say so to the person concerned (Code des relations entre le public et l'administration, Article L. 311-3-1)⁷.
3. 3)From 2 December 2027, for high-risk uses (including admission, the evaluation of learning outcomes and exam proctoring), the institution will have to assign human oversight to people with the necessary competence, training and authority, keep automatically generated logs for at least six months and inform the staff concerned before putting the system into service (Article 26)⁶.

An agent that leadership does not know about cannot be declared compliant: nobody has examined it.

3. What makes controlled adoption possible?

The organisation, more than individuals. The Work Trend Index 2026 measured the weight of 29 factors in what the AI users surveyed say they get out of it: organisational factors (culture, manager support, HR practices) account for 67%, individual factors for 32%⁴. This result is a statistical association based on self-reported data, with no proof of cause; it shows where to focus effort first: manager support, written rules, recognition for those who try.

The manager's example can be measured. In a survey of 1,800 employees (July 2025), when managers use AI themselves in front of their team, employees report 30 points more trust in agents and 17 points more perceived value⁸.

The gap is also visible at the top. Only 26% of AI users say their leadership is clearly and consistently aligned on AI (20% in France). The leaders surveyed say more often than their employees that reorganising one's work with AI is safe and rewarded; yet only 13% of users (12% in France) say they are rewarded for doing so without an immediate result⁴. Leadership therefore risks overestimating how safe its teams feel when they experiment.

Training that changes practice goes through practice. A half-day presentation on “the challenges of AI” rarely changes the way people work. A day in which each administrator runs an agent on a real file, reads what it produces and compares it with what they would have done themselves leaves the department with a list of the exceptions the agent missed. That list is the raw material of the future procedure.

First, train the people who will approve. For high-risk uses, Article 26 will require human oversight to be assigned to people with the necessary competence, training and authority; the dated list of those who attended the day is a first piece of evidence.

4. What is your role as a leader?

Practise first. A leader who has never run an agent on a real file cannot set a credible rule on its use. Take an hour and an internship agreement, give it to an agent, then read what it produces and what it flags. Then present the result to the senior leadership team, failures included: in the survey of 1,800 employees, it is the use shown by the manager that goes with 30 more points of trust.

Then write down the right to experiment. A rule that only prohibits risks pushing uses outside the framework. In the same survey, when managers create a climate of safety around experimentation, employees report up to 20 more points of readiness and perceived value, and are 1.4 times more likely to use agents often⁸. The rule fits in one sentence: complete freedom for prototypes, a strict framework for anything that goes into service.

What goes into service is simple to define: any agent whose output affects a student, a company or a file. For such an agent, the strict framework has four elements:

1. 1)a named owner;
2. 2)access rights decided in writing, tool by tool;
3. 3)a log of runs, read every week by a named person;
4. 4)the ability to stop the agent at any time.

The rule also lists, department by department, the decisions the agent prepares without taking them (admitting an applicant, approving an agreement, answering a complaint) and the person who takes them.

Decide on this framework this year. In 2026, the most advanced agents succeed on their own, one time in two, at well-defined computing tasks that take an expert 16 hours; this duration has doubled roughly every seven months since 2019, and would reach 64 hours by the end of 2027 if the curve holds⁹. Rules written now could then apply to agents four times more autonomous.