The second barometer of tech-sector leaders, run by Hiscox with OpinionWay and unveiled at VivaTech, reads first as a confirmation. Generative AI has gone from under 50% adoption in 2024 to 77% of companies in the sector — thirty-one points in two years. Another 14% say they plan to adopt it shortly, which takes the potential rate past ninety. Seventy per cent of leaders now consider it essential to their company's growth, nineteen points more than in 2024, and 84% expect their organisation to be deeply transformed within three years.
Then comes the number that does not fit. Out of fourteen identified risks, AI ranks twelfth in those leaders' perception. Only 24% see it as a very important risk.
The reflex reading is written into the headline of the piece reporting the study: they are underestimating it. Possibly. It is also, to my mind, the least interesting explanation — and the least likely, because the population surveyed is the best equipped there is to understand what is at stake. These are not leaders discovering the technology. They are the ones selling it.
What the barometer measures, and what it does not say
Before going further, a word on what the measurement is worth. This is a sector barometer, produced for an insurer: Hiscox sells cyber cover, and a barometer concluding that digital risk is underestimated serves its commercial interests. That does not make the figures wrong — they are internally consistent, and the gap with the 2024 edition is measured on the same method — but it is a reason to read the conclusions differently from the data. The article publishes neither the sample size nor the fieldwork dates: I am not going to invent them.
Victorine Bailleul, who heads the cyber offering at Hiscox, sums the finding up in one sentence worth quoting as it stands: we adopted AI faster than we wrote the rules for using it. That is accurate, and it is the starting point. It is not yet an explanation.
A category error, not a lapse of attention
A risk register is a list of comparable lines. It holds the cyberattack, the data breach, the supply disruption, the vendor failure, the regulatory exposure, the reputational hit. Each line carries a probability, an impact, an owner and a plan. That is what makes them rankable against one another.
The AI that appears on these lists is not a line at all. It is not a feared event; it is a vector running through the other thirteen. It changes the probability of a data leak, because a prompt is an outbound copy. It changes the scale of a cyberattack — which Bailleul says explicitly, noting that attackers already industrialise their attacks with it. It changes how detectable non-compliance is, because a processing operation with no ticket has no record. Asking a leader to rank AI between supply disruption and currency exposure is asking them to compare two things that are not on the same axis.
Faced with that exercise, a reasonable person does exactly what the barometer observes: they file the vector near the bottom, because no incident is ever called AI, and they save their high marks for events they can name.
The proof is inside the survey
This hypothesis has one advantage over the negligence reading: it can be checked against the published data, and the check takes two numbers.
Twenty-four per cent of leaders see AI as a very important risk. But 73% acknowledge that data loss through human error, or GDPR non-compliance, are real brakes — and, in the same barometer, 68% report using ChatGPT inside their company, with financial, HR and operational data passing through consumer tools with no defined framework.
Put plainly: the same leaders score the cause at 24% and its direct consequence at 73%. That is not a contradiction in their heads. It is a contradiction in the instrument, which counts one risk twice on two separate lines and makes it impossible to see that they are the same. A leader who had understood the subject perfectly would fill in the form exactly the same way.
It is also what separates this study from a plain finding of immaturity. We covered the adjacent angle with Cisco's numbers — only 14% of companies ready to deploy agentic AI at scale — but readiness and perception are different problems. A readiness gap can be closed with a budget. A blind spot cannot: you change the instrument.
Declared sovereignty hits the same defect
The barometer contains a second gap, more widely commented on, and it is of the same kind. Sixty-six per cent of leaders consider national or European sovereignty in AI crucial for their company; 89% rely on at least one US-origin generative AI tool. ChatGPT, Claude and Gemini take the podium, well ahead of Mistral AI, the only European player in the ranking.
The easy reading is hypocrisy. It does not hold either. Bailleul offers an explanation of trajectory — the American tools were built first, the habits were formed, and that is an observation rather than a regret — and she is right. I would add a mechanical reason.
Sovereignty is a property that can only be exercised at one precise moment: the moment of choice. A sovereignty policy applies to a tender, a contract renewal, an architecture decision. Yet the 68% ChatGPT usage largely describes tools that went through none of those moments. They arrived through individual use, one browser tab at a time. No policy, however well written, can apply to a choice that was never made.
That is precisely the mechanism we described about shadow AI in the public sector: usage precedes the decision, so the decision has nothing left to arbitrate. The barometer shows that the sector building these tools escapes it no better than its customers do.
What works instead: rewrite the thirteen lines
If the diagnosis is a faulty instrument, the remedy is not to add a fifteenth line called artificial intelligence. It is to take the thirteen existing ones and ask, for each, what AI changes about three properties:
- its probability — a data leak does not have the same frequency once every employee holds a frictionless export channel;
- its detectability — an operation triggered from a personal account does not leave the same trace as one running through the corporate systems, and that is often the real change: the incident is not more likely, it is less visible;
- its reversibility — can an automated action that runs without an intermediate approval be undone, and by whom?
This exercise has a virtue the ranking lacks: it produces actionable lines with an owner, instead of an overall score on an object nobody owns. It also has an honest cost worth stating — it takes longer than ticking a box, and the result is less presentable in a board pack than a single number.
What changes when software is built by agents
In our own patch — products built by agents under human governance — the distinction between the vector and the event is not theoretical. It is the reason organisational rules do not live in a document on the side but are injected at the start of every agent session and logged exactly as they were received.
The reason is what the barometer describes. A rule living in a register is a line reread once a quarter; an injected rule is a constraint that applies at the moment the risk occurs, which is during execution. And a rule whose wording is kept frozen is the only one you can point to afterwards: without it, the agent complied with our constraints is an unverifiable claim — exactly as we treat AI as a risk is today for 24% of the leaders surveyed.
I am not claiming this settles sovereignty, which plays out a floor above. It settles the part the barometer points at: the gap between what an organisation declares and what it can establish.
The number to watch is not that one
The next edition of the barometer is due in 2028. If AI climbs the risk ranking by then, it will not necessarily be good news: it will probably mean a spectacular enough incident has given the event a name, and that it finally has a line of its own.
The useful number to watch is elsewhere, and it is already in the study: the 63% of leaders who belong to a business network, 23% of them having joined since 2024. It is the only indicator in the set that measures an active search for bearings rather than an opinion. The usage rules nobody wrote will be written there, or not at all.
Sources
- "Adoption massive de l'IA : les dirigeants de la tech sous-estiment encore largement les risques", Maddyness, 29 June 2026 (in French). Report on the second Hiscox × OpinionWay barometer of tech-sector leaders, unveiled at VivaTech, including the quotes from Victorine Bailleul, head of the cyber offering at Hiscox. Every figure in this article comes from it. Hiscox is an insurer and sells cyber cover.
