AI in SMEs: 42% already use it, 49% held back by law (14/10/2026)
On 14 October 2026 the European Commission published a survey of 12 826 SME owners across the 27 Member States. The 42% adoption headline matters less than the detail: only 12% have genuinely deployed, and the law holds firms back as much as the price does.
In short
On 14 October 2026 the European Commission published Flash Eurobarometer 578, on artificial intelligence and algorithmic management in European SMEs and mid-cap companies[1]. Fieldwork ran from 20 March to 13 April 2026, covering 12 826 heads of privately owned firms with 1 to 749 employees across all 27 Member States[1][2]. The most useful finding for an SME is not the 42% adoption rate: it is that legal uncertainty (49%) sits one point behind investment cost (50%) among the barriers reported[2].
What the 42% figure actually measures
The Commission is not measuring AI use in the broad sense. It measures the use of AI and algorithmic management, defined as digital systems that help organise the workforce or support decisions about tasks, schedules, performance or staffing. Those systems may or may not be powered by AI, and they cover both tools that automate a decision and tools that merely recommend, with a person making the call[1]. A shift-planning package therefore counts, even with no AI model inside it.
The breakdown matters more than the total. Within the 42%, 12% report extensive use and 30% limited or experimental use; 21% plan to adopt, 35% have no plan to, and 2% do not know[2]. Read honestly, that is roughly one firm in eight genuinely deployed, not one in two. If a vendor shows you 42% as proof that your competitors are equipped, ask for the split.
Where AI enters an SME, and where it stops
Current or planned uses, by frequency[2]:
| Use | Share of companies |
|---|---|
| Customer service and client relations | 47% |
| Monitoring performance and productivity | 36% |
| Logistics, planning, staff scheduling | 30% |
| Selecting training for workers | 19% |
| Health, safety, risk prevention | 15% |
| Recruitment and candidate screening | 11% |
| HR decisions | 9% |
The curve falls as the tool gets closer to people: 47% for customer service, 9% for HR decisions. That ranking mirrors the order in which obligations tighten once a system processes data about staff or candidates. For an SME this is good operational news: the most accessible ground is also the least exposed.
The main barrier is not price, it is uncertainty
Barriers reported by company heads[2]:
| Barrier | Share of companies |
|---|---|
| High investment costs | 50% |
| Uncertainty about legal and regulatory rules | 49% |
| Lack of internal expertise | 48% |
| Management does not trust the technology | 37% |
| Fear among employees of increased surveillance | 33% |
Three barriers sit within two points of each other. Writing that cost is the leading obstacle would therefore misread this survey: cost, law and skills weigh the same. And two of the three can be addressed without an investment budget.
On trust the survey is blunt: 49% of company heads do not trust AI or automated systems for staff-related decisions, 41% tend to trust them and 3% fully trust them[2]. In practice people stay in charge. 52% of firms say AI suggests and a human decides, 38% decide with no AI at all, 7% let AI decide with a possible human review, and only 2% have fully automated decisions with no review[2]. Separately, 61% say AI helps them take decisions and 75% expect it to improve job quality[1].
The four countries: what the survey does not say
The infographic published by the Commission contains no country breakdown: every figure above is an aggregate across the 27 Member States[2]. Nobody can therefore derive a Belgian, Dutch, French or Luxembourg rate from this survey. If you see such a number credited to Flash Eurobarometer 578, ask for the exact page.
What does differ by country is the authority to put your questions to on personal data and automated decisions:
| Country | Data protection authority |
|---|---|
| Netherlands | Autoriteit Persoonsgegevens (AP) |
| Belgium | Data Protection Authority (APD / GBA) |
| France | Commission nationale de l'informatique et des libertes (CNIL) |
| Luxembourg | Commission nationale pour la protection des donnees (CNPD) |
The Commission notes that several of these obstacles are already addressed by rules in force, the General Data Protection Regulation and the AI Act, and points to a forthcoming Quality Jobs Act intended to clarify the framework for algorithmic management[1]. For an SME that means the uncertainty you feel is not a legal vacuum: there is a text to read before signing a subscription. Never assume a rule applies everywhere without checking it country by country.
One benchmark for context: a Digital Decade target sets at least 75% of EU businesses taking up AI, cloud or big data by 2030[1].
To do this week
- List the tools already running that organise work or score performance, including those with no AI: scheduling, time tracking, call scoring, productivity monitoring. That is the scope the Commission calls algorithmic management[1].
- For each tool, write down the name of the person who decides. The 2% of fully automated decisions with no human review are the zone to avoid by default[2].
- Check whether any use touches recruitment, staff monitoring or HR decisions. That is where requirements are strongest, and where only 9 to 11% of firms have gone[2].
- Write a one-page AI usage policy: approved tools, forbidden data, who signs off, who keeps the record. It answers the 48% who cite a lack of internal expertise[2].
- Tell your teams before deploying any monitoring tool: 33% of company heads cite employee fear of increased surveillance as a barrier[2].
- Start with customer service (47%) rather than HR (9%): quicker effect, lower exposure[2].
At CyberNovaLabs.io
We tackle the survey's three barriers in reverse order of cost: first the inventory of tools and the usage policy, then the team's skills, and only then the automation itself. See our page on AI and automation for business and, for the lack of internal expertise cited by 48% of company heads, our AI training for teams. Two related reads on the same logic of proof: the Flink breach, where one former employee's login was enough, and the closing of the CNIL injunction against France Travail. If you prospect from Belgium, our page on B2B appointment setting in Brussels sets out the method. To discuss a specific case, book a meeting.
Sources
- Commission europeenne — Growing use of AI in European companies (14 octobre 2026)
- Flash Eurobarometre 578 — Artificial Intelligence and Algorithmic Management, infographie (14 octobre 2026)
- Eurobarometre — fiche d'enquete Flash Eurobarometer 578
- Commission europeenne — communique de presse IP/26/2160 (14 octobre 2026)
- Commission europeenne — Shaping Europe's digital future, actualites du 14 octobre 2026
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 16, 2026 · 7 min readB2B appointment setting: 7 levers that cut no-shows
No ghosts in your calendar. A missed B2B meeting costs the prep, the slot and the follow-up. Here are 7 levers to cut your no-show rate, and what the public evidence does — and does not — let you expect.
Read the article →October 16, 2026 · 9 min readNIS2 France: are law firms in scope?
Legal services are absent from Annexes I and II of NIS2, and France had not finished transposing as of 16 October 2026. Yet the directive reaches firms through their in-scope clients' supply chain, through the GDPR and through CARPA transfer fraud. Here is what is enforceable today, and in what order to act.
Read the article →October 15, 2026 · 8 min readNIS2 Luxembourg: are accounting firms and fiduciaries in scope?
The Law of 5 May 2026 never once mentions accountancy. That does not make your firm safe: three entry points remain, and only one really concerns Luxembourg fiduciaries.
Read the article →October 14, 2026 · 7 min readWindows zero-day: the download warning is gone (13/10/2026)
A Windows Shell flaw already used in attacks strips the « this file came from the internet » warning. A second exploited flaw hits Ivanti remote access. Both fixes are dated 13 October 2026.
Read the article →