Agentic AI, the security of the digital supply chain, and the enforcement of the European AI Act are reshaping the priorities of IT departments. We are witnessing a shift where IT trends no longer overlay existing systems but require a redesign of architectures and internal skills.
Attacks on the Digital Supply Chain: The Weak Link in Information Systems
The majority of articles on IT trends address cybersecurity from the classic defensive angle: firewalls, EDR, SOC. The risk associated with third-party digital dependencies remains under-documented, even though it constitutes a critical exposure surface today.
ENISA emphasizes that attacks on the supply chain can cause large-scale incidents, well beyond the perimeter of the targeted organization. A compromised SaaS provider, a corrupted open-source component, or a poorly segmented cloud provider is enough to propagate a lateral compromise.
We recommend integrating the assessment of suppliers’ security posture into each risk review cycle. This involves contractual audits, incident notification clauses, and a regularly updated mapping of software dependencies. To keep track of these developments and those affecting IT on journalduwebmaster.com, industry monitoring remains the most cost-effective reflex.
The approach is not limited to the technical perimeter. Procurement and legal teams must be involved from the selection phase of a provider, with security criteria weighted at the same level as cost or SLA.
European AI Act: Concrete Obligations for IT Departments in the Implementation Phase
The AI Act has entered its general implementation phase. The obligations concerning high-risk artificial intelligence systems directly affect companies deploying scoring, automated recruitment, or monitoring tools.
The stakes are not only legal: they structure architectural choices. An AI model deployed without compliance documentation, without bias assessment, or without a human oversight mechanism exposes the company to sanctions, as well as reputational risk.
Technical Points of Vigilance
- Data traceability must be ensured from the design of the pipeline, not added afterward. This requires versioning of datasets and data governance aligned with ISO 27701 standards.
- Automated decision-making systems must integrate an accessible contestation mechanism, which directly impacts the design of APIs and user interfaces.
- Human oversight is not limited to an “override” button: it requires real-time monitoring dashboards with configurable alert thresholds.
We observe that data teams and compliance teams still often work in silos. Aligning data governance and regulatory compliance from the project phase significantly reduces the costs of subsequent compliance.
Offensive AI: When Artificial Intelligence Tools Serve Attackers
AI is no longer just a defensive tool. ENISA notes a growing use of artificial intelligence by malicious groups to automate and amplify their operations.
Documented cases include the large-scale production of synthetic content (audio and video deepfakes for social engineering), automated translation of phishing campaigns to simultaneously target multiple geographic areas, and the optimization of attack vectors through machine learning.
This shift requires rethinking defenses. Classic anti-phishing filters, trained on known linguistic patterns, lose effectiveness against emails generated by language models. Detection systems must now integrate behavioral analysis rather than purely lexical analysis.
Attacks targeting AI systems themselves (model poisoning, training data extraction, prompt injection) represent a new category of threats. Securing a model in production requires protecting not only inference but also the training pipeline and source data.
IT Skills and Digital Sovereignty: Two Interconnected Urgencies
ENISA emphasizes the importance of strengthening cybersecurity skills within organizations. The observation goes beyond simple recruitment: it is about training existing employees on threats that evolve faster than academic curricula.
Concrete Trade-offs for IT Teams
- Prioritize cloud solutions qualified SecNumCloud or equivalent for sensitive data, rather than relying solely on generic certifications from hyperscalers.
- Invest in ongoing training for teams on prompt injection techniques and AI model security, a field still absent from most training plans.
- Evaluate the portability of workloads before any multi-year commitment with a provider, by testing the effective (not just contractual) reversibility of data and configurations.
The reversibility of IT systems is no longer a theoretical issue. Organizations that do not regularly test their ability to migrate from one provider to another expose themselves to a lock-in whose exit cost increases over time.
The world of IT in 2026 is structured around a tension between technological acceleration and regulatory framework. IT departments that succeed are those that treat compliance as an architectural parameter, not as an added constraint at the end of the project.
