AI governance for SMEs: a 10-day AI audit

Why audit AI use now

AI is already inside your company, whether or not anyone decided it. Employees use it, often on personal accounts, with data that should not leave the building. Three recent surveys measure the gap between use and rules.

48%

of French organisations have not identified the AI systems in use internally, and 80% have no clear view of AI-related risks.

EQS Group, Privacy Barometer 2026, 206 professionals, February 2026

2 in 3

organisations see unmanaged AI use. Only 44% have formalised ethical rules on AI.

ESSCA and Forvis Mazars, 2nd AI Barometer, 826 respondents in France, the UK, Germany and Spain, October 2026

1 in 5

organisations hit by a data breach were breached because of shadow AI, with an average extra cost of $670,000 where shadow AI use was high.

IBM and Ponemon Institute, Cost of a Data Breach 2025, 600 organisations, July 2025

These surveys have different scopes and do not add up. They agree on one point: AI use comes before the rules. To understand the issue, read our entries on shadow AI and the Shadow AI Barometer 2026.

What the EU AI Act already changes

2 February 2025Article 4 of the AI Act applies to every organisation that deploys AI, whatever the risk level. An SME whose teams use a chat assistant is covered: it must take measures to develop its staff's AI literacy.
27 July 2026The Digital Omnibus regulation (EU 2026/1744) enters into force. It rewords Article 4 without removing it: no precise level is imposed, but the duty to take measures remains.
August 2026Enforcement sits with national market surveillance authorities, with penalties set by national law.
2 December 2027Obligations for high-risk systems apply, for example to a tool that screens job applications.

The European Commission states that an internal record of the actions taken is enough as evidence for Article 4. The usage policy and the training plan from Le Cadrage IA are the basis for it. Details in our entries on AI literacy and Article 4 and the AI Act's revised timeline for leadership teams.

What this AI audit covers, and what it does not

"AI audit" means three different engagements on the market. An opportunity audit lists the tasks to automate. A compliance audit checks one specific AI system, especially a high-risk one. Le Cadrage IA answers a third question that comes before both: what your teams already do with AI, and under which rules.

Le Cadrage IA covers

Real AI use, by team and by type of data
Usage rules: allowed, forbidden, subject to approval
The choice of a validated, properly hosted tool
Human review of outputs that commit the company
A training plan for your teams

It does not cover

The technical audit of a high-risk AI system
Building, integrating or rolling out tools
Delivering the team training itself
Legal advice: legal points are confirmed with your counsel

The four deliverables

Each deliverable matches a decision your leadership team has to make. None is a report of principles.

01

The exposure map

Where AI is used, by which teams, with which data and at what level of risk. A quantified picture, not an impression.

02

The written usage policy

A short text in plain language, ready for management to sign. It sets what is allowed, forbidden or subject to approval, taking the GDPR and the AI Act into account.

03

The validated, hosted tool

The credible alternative to shadow AI: a tool chosen for your use cases, with hosting, access and the contract terms on data reuse checked.

04

The human-review matrix

For each use, who reviews an AI output before it leaves the company, who approves, who signs.

On top of these come the 45-minute debrief to your leadership team and a training plan for your teams.

The method, day by day

The scope is narrow, which is what makes ten days possible. Each phase produces a result that feeds the next one.

0Your request, then the quoteA fifteen-minute online questionnaire: context, current AI use, software in place, regulatory constraints. We confirm the scope and send the quote. You decide from there.Before day 1 · no commitment
1The confidential usage auditWe observe before we prescribe: a structured questionnaire and two to three interviews. Which tools, for which tasks, with which data, including on personal accounts.You receive: the exposure map.Days 1 to 3
2The tool and the usage policyTwo workstreams run together, because a rule depends on the tool available. We compare options by cross-checking several AI models, then a person decides and signs.You receive: the usage policy and a reasoned tool recommendation.Days 4 to 7
3The leadership debriefForty-five minutes to present the findings, the rules and the decisions to make.You receive: the human-review matrix and the training plan.Days 8 to 10

The detailed timeline and the mistakes to avoid are in our guide AI framing in 10 days: what to expect and what it costs.

Who it is for, and who it is not for

Le Cadrage IA is for you if

Your teams use AI and nobody has written any rules
You banned public tools and the use moved elsewhere
You handle sensitive data: clients, health, finance, professional secrecy
Your leadership team wants to decide on facts, not impressions
You want a budget and a date known before starting

It is not for you if

You need a high-risk AI system audited
You want a provider to build or integrate an AI agent
You only want a list of use cases to automate
Your AI governance is already written, tooled and applied

In-house, with a consultancy, or with Le Cadrage IA

Three ways to bring AI under control in a company. None is wrong in principle, but they do not require the same resources.

Comparison of the three approaches
Criterion	In-house	Consultancy or integrator	Le Cadrage IA
Budget	No invoice, but management and team time	Often billed by time spent, known at the end	€2,900 excl. VAT, set before day 1
Timeline	Depends on team availability	Depends on a scope that tends to grow	10 working days, debrief date known
Deliverables	To be defined	On quote	4 named deliverables, debrief and training plan
Tool choice	Often the tool already known	A vendor or integrator has a stake in the answer	Independent: WYP sells no tool
Outside view	No	Yes	Yes, with findings anonymised by team

Price and ordering

A fixed-scope, fixed-price package. Anything outside the scope is a separate decision, never a silent overrun.

Fixed scope, fixed price

Le Cadrage IA

Delivered in 10 working days · debrief included

€2,900 fixed price · excl. VAT, depending on your country

✓Confidential usage audit and exposure map
✓Written usage policy, ready to sign
✓Validated, properly hosted tool
✓Human-review matrix
✓45-minute leadership debrief and training plan
✓Contractual confidentiality

Request Le Cadrage →

Delivered and signed by a senior · Full confidentiality

After your request, we get back to you to confirm the scope and send the quote. No commitment before your approval.

Who delivers Le Cadrage IA

Le Cadrage IA is led and signed by Xavier Fisselier, founder of WYP.agency, a strategy consultancy for executives and a brand of ABSPARITION SL, based in Barcelona.

The method does not change: several AI models are confronted (Claude, ChatGPT, Gemini, Perplexity, Mistral, Grok), their answers cross-checked, the blind spots flagged. Then a person reviews, decides and signs. AI sharpens the decision, it does not make it.

WYP publishes no tool, resells none and takes no vendor commission. More about WYP.agency · Xavier Fisselier on LinkedIn

Frequently asked questions

How much does an AI audit cost for a company?

Offers range from free online diagnostics to quoted engagements billed by the hour or day. WYP's Le Cadrage IA is a fixed package of €2,900 excl. VAT, known before day one. VAT applies depending on your country.

How long does Le Cadrage IA take?

Ten working days, starting once the quote is approved and your questionnaire is received. The debrief date is set before day one.

How is it different from an AI Act compliance audit?

An AI Act compliance audit checks one specific AI system against the regulation, especially high-risk systems. Le Cadrage IA looks at how your teams use AI: who uses what, with which data, under which rules. It helps document the AI literacy measures required by Article 4, but it does not replace the technical audit of a high-risk system.

Do employees have to disclose their AI use?

The audit is confidential. Findings are reported by team and by type of use, never by name. A survey that punishes gets silence, and the goal is to learn how AI is really used.

Does Le Cadrage IA impose a specific AI tool?

No. WYP neither publishes nor resells any tool, and takes no vendor commission. The tool is chosen from your data and your tasks, options are compared and the decision is documented.

Does it replace legal advice?

No. Le Cadrage IA is a consulting engagement. The usage policy takes the GDPR and the AI Act into account, but strictly legal points should be confirmed with your lawyer or data protection officer.

What happens after the 10 days?

The leadership team decides what comes next. The deliverables can be used on their own. Team training, roll-out and integration fall under a separate engagement, which you launch or not.

Can it be delivered in English or Spanish?

Yes. Le Cadrage IA is delivered in French, English or Spanish, for organisations in France, Belgium, Switzerland, Luxembourg and Spain.

AI governance for SMEs: Le Cadrage IA, in 10 working days