--- title: "CISOs pressed to balance AI, compliance and supplier dependencies — Marsanne Studio AI watch" description: "A CESIN study shows generative AI governance is still in its infancy in organisations, with 27% having no defined usage policy." url: "https://marsanne.studio/en/ai-watch/cisos-pressed-to-balance-ai-compliance-and-supplier-af8d9b/" lang: "en" --- [Marsanne Studio](https://marsanne.studio/en/) [← Back to home](https://marsanne.studio/en/ai-watch) [← The AI watch](https://marsanne.studio/en/ai-watch) Data study · 17 September 2026 # CISOs pressed to balance AI, compliance and supplier dependencies Original title, in French: “Les RSSI sommés d'arbitrer entre IA, conformité et dépendances fournisseurs” **Publication** Silicon.fr (France) **Author** Philippe Leroy **Published on** 17 September 2026 · read in the page structured data · updated on 17 September 2026 ## Summary According to a CESIN survey conducted through 21 weekly mini-polls of its CISO members for the first half of 2026, generative AI governance is struggling to keep pace with its growing adoption in companies. 27% of respondents, mostly in mid-sized organisations, have not defined any usage policy for generative AI, and only 18% of organisations have a specific policy for AI-enhanced development environments. The study also notes an increase in malicious uses of generative AI, with 54% of large companies having suffered a deepfake attack, compared with 19% of mid-sized companies and 5% of micro-businesses and SMEs. In addition, regulatory compliance ranks first among 2026 priorities, particularly for smaller organisations. CESIN chairman Fabrice Bru points to a CISO role that is becoming more complex rather than a decline in maturity. Summary based on the full text of the article. [Read the article on Silicon.fr →](https://www.silicon.fr/cybersecurite-1371/les-rssi-sommes-darbitrer-entre-ia-conformite-et-dependances-fournisseurs-229170) ## Figures cited - 27 % share of respondents with no generative AI usage policy CESIN members, mostly mid-sized organisations, H1 2026 > « 27 % des répondants, plutôt issus d’organisations de taille intermédiaire, n’ont défini aucune politique d’usage de l’IA générative. » Source: CESIN, Instantanés S1 2026 - 18 % share of organisations with a specific policy for developers using AI CESIN members, H1 2026 > « seuls 18 % des organisations disposent d’une politique spécifique pour les développeurs » Source: CESIN, Instantanés S1 2026 - 54 % share of large companies that have suffered a deepfake attack large companies, CESIN members, H1 2026 > « 54 % des grandes entreprises interrogées déclarent avoir déjà subi une attaque de type « deepfake » contre 19 % des ETI et 5 % des TPE/PME. » Source: CESIN, Instantanés S1 2026 - 19 % share of mid-sized companies that have suffered a deepfake attack mid-sized companies, CESIN members, H1 2026 > « 54 % des grandes entreprises interrogées déclarent avoir déjà subi une attaque de type « deepfake » contre 19 % des ETI et 5 % des TPE/PME. » Source: CESIN, Instantanés S1 2026 - 5 % share of micro-businesses and SMEs that have suffered a deepfake attack micro-businesses and SMEs, CESIN members, H1 2026 > « 54 % des grandes entreprises interrogées déclarent avoir déjà subi une attaque de type « deepfake » contre 19 % des ETI et 5 % des TPE/PME. » Source: CESIN, Instantanés S1 2026 - 46 % share of large companies ranking compliance among their top three priorities for 2026 large companies, CESIN members > « Elle figure parmi les trois chantiers prioritaires pour 46 % des grandes entreprises, 61 % des ETI et 72 % des TPE/PME. » Source: CESIN, Instantanés S1 2026 ## Classification **Country** France **Company size** Large companies, Mid-sized companies, SMEs **Industries** Software vendors, IT services companies, telecoms · All industries, or industry not specified **Companies** CESIN (study author) **Keywords** ai governance, cybersecurity, ciso, deepfake, regulatory compliance, generative ai Entry written by Marsanne Studio from the cited article, with the help of an AI model (claude-sonnet-5). The rights to the article and its illustrations belong to Silicon.fr and its author. Entry translated from French by Claude Sonnet 5.5.