AI agents in Europe: from adoption to control
OpenAI reports that Codex and ChatGPT Work now represent more than half of output tokens in its European enterprise sample. That signal measures neither value created, compliance, nor sovereignty. For a Belgian or French company, the real task is to turn usage intensity into controlled business processes.
1. What the study actually measures
The report covers ChatGPT Enterprise and Business accounts observed by OpenAI. In this sample, agentic tools exceed half of output tokens. Among SMEs—defined here as organisations with no more than 200 associated users—weekly active users of Codex and ChatGPT Work increased 8.1-fold since May 2026.
Intensity remains highly uneven: agentic output-token share ranges from 22% to 85% across countries in the sample. In September, European firms in the top 10% by usage produced over four times more tokens per user than typical European firms, yet less than half the level of leading firms outside the EU. These are one vendor's usage metrics, not a representative measure of the entire European economy or proof of productivity.
2. What changes for a Belgian or French company
Moving from assistant to agent shifts the risk. Imperfect text can be corrected; an imperfect action can alter a CRM record, quotation, invoice, code repository, or access right. SMEs and mid-market firms should therefore select a few measurable processes before broadening adoption. Large enterprises and public administrations must also manage segregation of duties, procurement, sector obligations, and audit evidence.
Token counts and active-user figures are insufficient to steer this transition. Organisations need to measure correctly completed tasks, actual human time saved, manual rework, incidents, full cost, service quality, and impact on business lead times. An agent that generates more activity without controllable outcomes can increase operational debt.
3. Underside analysis: govern the chain, not only the model
For an agent connected to Odoo, RAG, or a business API, governance must cover the entire chain: a dedicated revocable identity, least privilege, documented sources, classified data, authorised tools, decision and action logs, human approval for sensitive writes, budgets, and a shutdown procedure. Prompts and the model are only part of the system.
Sovereignty requires the same end-to-end view. Service location alone is insufficient: the organisation needs to know processing regions, subprocessors, support access, retention, keys, model dependencies, and export options. Local, cloud, or hybrid architecture should be selected by data class and continuity requirements, with a tested replacement scenario.
4. A deployment path based on four forms of evidence
Start with a bounded, reversible process. Establish a pre-agent baseline, then test quality, cost, latency, and human workload on a representative sample. Enable writes only after validating rights, logs, thresholds, and rollback. Finally, decide whether to expand based on business outcomes rather than usage volume.
Operational recommendation. Maintain one record for every agent covering its business owner, purpose, data, model, tools, identity, permissions, budget, human approvals, logs, metrics, shutdown procedure, and exit option. Update it whenever the agent changes.
Frame an agentic deployment