The year 2024 has reshuffled the cards on several technological fronts simultaneously. Between the gradual implementation of the European AI Regulation, the maturation of sovereign cloud architectures, and the acceleration of general-purpose AI models, companies are facing technical trade-offs that impact both their compliance and competitiveness.
European AI Act: obligations that change the deployment of AI in business
The Regulation (EU) 2024/1689 on AI came into effect on August 1, 2024. Its effects are not theoretical. The staggered application timeline between 2025 and 2030 requires technical teams to review their development pipelines now.
Since February 2, 2025, AI practices classified as “unacceptable risk” are legally prohibited in the EU: behavioral manipulation, social scoring, certain forms of real-time biometric recognition. From August 2, 2025, the obligations for general-purpose AI (GPAI) models will be in effect. Technical documentation, risk management, robustness requirements: providers of large models like ChatGPT, Claude, or Gemini must comply.
Starting August 2, 2026, the majority of transparency obligations outlined in Article 50 of the AI Act will apply. Machine-readable marking of AI-generated or modified content will become mandatory. The European AI Office will then have enhanced oversight powers.
We observe that most articles on 2024 trends address generative AI from the perspective of use cases, overlooking this regulatory layer. This is a strategic mistake. A company deploying a GPAI model without anticipating risk classification exposes itself to gradual sanctions, and especially to costs of retroactive compliance that far exceed those of a native integration of requirements.
As detailed in the Les News technology blog, these regulatory developments are reshaping how R&D teams structure their artificial intelligence projects, far beyond the simple choice of a model.
Sovereign cloud and edge computing: convergence of data architectures
The question of the cloud is no longer “should we migrate” but “where to draw the line between centralized processing and edge processing.” Edge computing is not an alternative to the cloud. Both architectures are converging towards a hybrid model driven by latency and data compliance.
The constraints of GDPR, combined with sector-specific requirements (health, finance, defense), are pushing European companies towards qualified cloud solutions. The need for digital sovereignty is no longer just political rhetoric: it now conditions public tenders and the infrastructure choices of large groups.
Criteria guiding architecture choice
- The acceptable latency for the target application: industrial use cases (predictive maintenance, online quality control) require local processing in a few milliseconds, incompatible with a cloud round trip
- The regulatory location of personal or sensitive data, which determines the use of a sovereign cloud or on-premise hosting
- The bandwidth cost for massive video or IoT streams, which makes edge computing economically relevant beyond a certain volume
We recommend approaching these decisions with a technical framework rather than marketing labels. A “sovereign cloud” whose control plan is still operated from an American hyperscaler does not provide the same guarantees as an infrastructure fully operated within European jurisdiction.
Applied generative AI: beyond text generation
The maturity of generative models in 2024 is measured less by the quality of the produced text than by their ability to integrate into existing business workflows. Code generation, legal document synthesis, 3D model creation, and the production of synthetic data for training other models are use cases that generate measurable return on investment.
The main barrier remains the reliability of outputs, not raw performance. Companies deploying these tools in production are investing heavily in layers of human verification, RAG (Retrieval-Augmented Generation), and monitoring for hallucinations. Without these safeguards, the legal and reputational risk far outweighs the productivity gain.
GPAI models and vendor dependency
The AI Act introduces a distinction between standard GPAI models and models presenting a “systemic risk.” This classification will have a direct impact on the choice of suppliers. Companies building their application stack on a single proprietary model expose themselves to simultaneous technical and regulatory lock-in.
The observable trend among the most advanced players is to maintain a layer of abstraction between the business application and the underlying model. This allows switching from one supplier to another without rewriting the application logic, an approach we consider a standard architecture for any new project.
Cybersecurity and quantum computing: the post-quantum threat is being prepared now
Post-quantum cryptography is no longer an academic research topic confined to laboratories. NIST finalized its first standards for quantum-resistant algorithms in 2024. Companies handling long-lived data (health data, industrial secrets, archived financial data) must anticipate the so-called “harvest now, decrypt later” threat.
The principle is simple: malicious actors intercept encrypted communications today, store them, and will wait until they have a sufficiently powerful quantum computer to decrypt them. The transition period to post-quantum algorithms is measured in years, not months. Cryptographic migrations affect certificates, communication protocols, storage systems, and signature chains.
- Inventory all cryptographic algorithms used in the infrastructure (TLS, signatures, encryption at rest)
- Identify data whose confidentiality duration exceeds ten years
- Test NIST-standardized post-quantum algorithms in pre-production environments before any migration to production
- Plan a transition budget that includes updating HSMs (Hardware Security Modules) and internal PKIs
The technological trends of 2024 are not just about gadgets or marketing promises. The AI Act redefines the legal framework for AI in Europe, cloud architectures are evolving under the combined pressure of performance and sovereignty, and the quantum threat imposes cryptographic projects starting today. These are engineering topics, not passive monitoring.
