Most European Firms Use AI. Few Have Written the Rules

A survey cited in AWS’s Reimagine 2026 report, reported by Help Net Security on September 28, found that more than half of European SMEs and large enterprises use AI. Only 24% have a documented approach to responsible AI use, and just 10% have a data governance strategy.

Put plainly, many organizations are using AI tools well before they have written down how those tools should be used.

How to Read the Numbers

A few caveats are worth keeping in view. The figures come from a Strand Partners survey commissioned by AWS. The coverage does not state the base the percentages are drawn from, and the survey spans European businesses across all sectors, not pharma specifically.

So treat them as directional, not exact. The pattern they describe is still useful: adoption has moved faster than documentation.

What the Gap Looks Like in a Writing Team

In a medical writing or regulatory team, an undocumented approach usually shows up in small ways:

• Nobody has a list of which AI tools writers actually use.
• It is unclear which kinds of content may be entered into a tool and which may not.
• Tools were chosen by individuals, so data terms were never compared.
• No one owns the question of what happens when a vendor changes its policy.

None of this requires bad intent. It is what happens when a useful tool spreads faster than the paperwork.

Why It Matters for Pharma and Healthcare

Health data carries stricter requirements under GDPR, as special category data. A draft with patient-level detail, even in free text, can bring those requirements into play. A team that cannot say which tools touched that draft, and under what terms, is in a weak position if a regulator or a sponsor asks.

Regulators are also paying closer attention to how health data is handled, as recent enforcement involving patient databases has shown.

A One-Page Approach You Can Actually Finish

A documented approach does not need to be a long policy. One page can cover the essentials:

1. An inventory. List the AI tools in use, including ones writers adopted themselves.
2. An approved list. Name the tools that are cleared, and who cleared them.
3. Data rules. State which content types are never entered into unapproved tools.
4. Vendor criteria. Use the same questions for every tool.
5. An owner and a review date. Assign one person and revisit twice a year.

The Vendor Questions That Fit on the Page

The same short list works for any writing or detection tool:

• Is content stored after the session, and for how long?
• Is any content used to train a model?
• Where is data processed, and by which subprocessors?
• What agreement will you sign, such as a DPA or BAA?
• What evidence backs your compliance claims?

A vendor that answers these plainly makes your documentation easier. One that cannot makes it harder.

Where Trinka’s Confidential Data Plan Fits

A tool does not create a governance strategy. But it can make writing one easier. Trinka’s Confidential Data Plan gives clear answers to the questions above: content is processed in memory with zero data retention, it is never used to train a model, and data is encrypted in transit and at rest. The platform carries GDPR, HIPAA, SOC 2, and ISO 27001 alignment, and an offline Windows app is available for settings that cannot send data out.

Because grammar, consistency, citation, plagiarism, and AI detection checks all sit within one plan, a team can list one tool in its inventory instead of several. That is a small simplification, and it adds up.

Conclusion

The headline number is that fewer than one in four European businesses have a documented responsible-AI approach. For a writing team, closing that gap does not take a large program. It takes a short list of tools, a few clear data rules, and vendors who can answer plain questions in writing.

Key Takeaways

• AI use in European businesses has outpaced written rules for how to use it.
• The survey was commissioned by AWS and its base is not stated, so read the numbers as directional.
• A one-page approach covering inventory, approved tools, data rules, vendor criteria, and ownership is a realistic start.
• Clear vendor data terms make that documentation easier to write and to keep.