This week: one named owner + deputy. An inventory of what you ship vs what you merely use. SRP registration done now, not during an incident. A timestamped awareness log — the platform has no "when did you find out" field, so your record is the proof. Then rehearse it once.
Every CRA budget I've seen is aimed at December 2027: documentation, conformity assessment, templates. The one duty already live since 11 September is a 24-hour report — and it runs entirely on incident response, the weakest capability SMEs have. 2.6 out of 5 in ENISA's own survey.
Awareness won't come from your telemetry. It arrives as a customer email or a CERT ping — clock already running. Mean time to exploit is now minus seven days; 29% of 2025's exploited CVEs showed activity on or before publication day. Lateness is the fineable, documented failure.
Data quality is a flow, not a stock. Up to 25% of CRM data decays per year, duplicates sit at 15–20% of records.
Before buying any diagnostic: one definition of revenue, one system of record, one named owner with hours in their week. Then the audit validates instead of discovers.
France ran "Osez l'IA" for a year. 35,000 companies sensibilised. 70 Diagnostics Data IA actually engaged.
0.2%.
The awareness layer scaled beautifully. The layer that touches real data didn't. That's not a marketing failure — it's a pricing signal.
Eurostat: 27.9% of small EU enterprises have employees doing data analytics, vs 78.8% of large ones. Only 24.7% run a CRM at all.
The diagnostics keep finding duplicate customer records because in three quarters of small firms there is no system of record to deduplicate.
Practical move: put one high-volume workflow on a metered API key — ticket triage, document extraction. Not to save money. To manufacture a price signal. You can't negotiate a seat you can't benchmark. Re-price that seat against your metered cost every quarter.
The AI price collapse is being reported as an economy-wide deflation. It's a channel-specific one. Effective token prices fell 41% to $0.68 since March. That's an API number. If your invoice reads "per user," none of that discount was ever routed to you.
So the buying question mutated from "which model is best" to "which tier is good enough." Small firms structurally cannot answer it. 3.6% of businesses run model-routing infra. 72% of paying SMBs buy exactly one AI service. The question assumes machinery nobody has.
So don't hire an "AI person." Audit your own week, automate the three biggest admin sinks, spend the recovered hours on a doer who serves customers. Biggest payoff in the data: clinics under 10 people, ~19%, hiring hygienists and therapists. Not technologists.
Big companies blamed AI for 112,713 job cuts through July. Nine-person companies running the same tools hired roughly 11% more people. The variable isn't the technology. It's who was drowning in admin.
That 0% is the real finding. The dividend dies the moment a firm is big enough to already shield the owner's calendar. AI didn't make these businesses smarter. It handed the founder back part of the ~16 admin hours a week. In a 9-person shop that's one hire.
Three clauses that matter more than seat price:
1. Monthly spend ceiling with auto-pause you control
2. Named owner, in writing, for a wrong agent action
3. Export of prompts, configs, workflow logic
EU Data Act bans egress fees from Jan 2027 — for data, not for what you built.
Everyone negotiating an agent contract is negotiating the wrong number.
$0.10 per action isn't a price. It's a floor.
On Salesforce's Flex Credit rate card, any single action over 10,000 tokens counts as multiple actions — and unused credits don't roll over at term end.
79% of firms with 1,000+ employees hit AI cost overruns in the last 12 months. Only 26% have real-time visibility into run cost.
Those companies have FinOps functions — 98% of practitioners now manage AI spend, up from 31% in 2024.
A 40-person firm has none of that apparatus.