An AI audit for a small or mid-sized company typically runs 3 to 5 weeks and costs between 3,000 and 15,000 € excluding tax, depending on scope. France's public Diag Data IA scheme sets the reference price: 10,000 € for 8 consultant-days, with 40 % covered by the France 2030 programme, leaving 6,000 € for the company.
Read the full guide
AI in Business 2026: Complete SME Guide (Strategy, ROI, Adoption)
Answer a few questions and get a personalized assessment with recommendations tailored to your industry.
Assess my AI maturityRelated articles
Dive deeper with these complementary articles.
AI in business means handing software systems the tasks that used to require skilled human time: writing, analysis, sorting, customer replies. In 2026, the question for an SME is no longer whether to experiment, but which two or three uses to pick, measure and sustain.
An AI audit for a small or mid-sized company typically runs 3 to 5 weeks and costs between 3,000 and 15,000 € excluding tax, depending on scope. France's public Diag Data IA scheme sets the reference price: 10,000 € for 8 consultant-days, with 40 % covered by the France 2030 programme, leaving 6,000 € for the company.
That figure is the most useful starting point on the whole topic, and almost no article mentions it. It gives you a yardstick: a private quote well above 10,000 € for a 30-person company should be explained by a wider scope, not by the consultancy's reputation. This article covers what an AI audit actually involves, what it must produce, what it costs, and how to spot the one that will end up in a drawer. It complements our complete guide to AI in business for SMEs, which places this step in a broader approach.
An AI audit has one useful purpose: leaving you with a short list of processes to tackle, costed, ranked and assigned to someone. Anything further from that is seminar material.
The vocabulary is muddled on the market. AI audit, AI diagnostic, Diag Data IA, maturity assessment all describe roughly the same exercise: a stocktake followed by prioritisation. "Diag Data IA" is simply the name of the state-cofunded format. Do not waste time on terminology, look at the promised deliverable.
Two services are regularly sold as audits without being one:
A real audit starts from your actual workflows. It asks how many hours a week your office manager spends re-keying purchase orders, where quotes get lost, why customer response time sits at 48 hours. Then it looks at what generative AI changes on those specific points, and what it does not.
The Diag Data IA, delivered by Bpifrance Conseil on behalf of the French state under the Osez l'IA plan, costs 10,000 € excluding tax for 8 consultant-days, with 40 % covered by France 2030. The company therefore pays 6,000 €.
The stated scope has three parts: an initial technical and operational stocktake, identification of concrete and applicable use cases, then prioritisation by value added. Eligibility is broad: SMEs and mid-caps with 10 to 2,000 employees registered with the French companies register. These figures are published by the Direction générale des Entreprises on its page covering the national Osez l'IA plan.
For larger organisations, the same plan offers the Accélérateurs IA: an 18-month programme including a 12-day 360-degree diagnostic with an AI focus, two 13-day modules, 46 % covered by France 2030, restricted to companies with more than 50 staff, revenue above 8 million euros and at least 3 years of existence.
These schemes do not suit everyone. A 12-person business does not need 8 consultant-days of external expertise to discover it should start by automating its invoice reminders. But they give you a scale. If a provider quotes 25,000 € for an audit on a comparable scope, ask what justifies the gap with the public benchmark.
The ranges below reflect prices commonly charged in 2026 for French SMEs. They vary with the number of departments involved, not with total headcount.
| Format | Scope | Duration | Price excl. tax |
|---|---|---|---|
| Flash audit | 1 department, 3 to 5 processes | 2 to 4 days | 1,500 to 3,500 € |
| Process audit | 2 to 3 departments | 3 to 5 weeks | 5,000 to 12,000 € |
| Diag Data IA (cofunded) | Cross-functional, 8 consultant-days | 4 to 6 weeks | 6,000 € net of subsidy |
| Strategic audit | Cross-functional plus 12-month roadmap | 6 to 8 weeks | 15,000 to 30,000 € |
Three caveats. First, high prices are not illegitimate: a cross-functional audit in a 200-person company running four business systems genuinely takes several weeks. Second, be wary of free audits offered by software vendors: the report fairly consistently concludes that their product fits the need. Third, the real cost is not the provider's invoice, it is your team's time. Budget 1 to 2 hours of interview per person, plus data collection. On a process audit that often adds up to 20 to 30 internal hours, which belong in the budget if you are thinking in full cost, as we explain in our article on the cost of AI for an SME in 2026.
A serious AI audit always follows the same sequence: inventory, interviews, costing, prioritisation, action plan. Skipping a step is the main reason audits end up unusable.
Ask for the list of deliverables in the proposal, before you sign. A provider who stays vague on this point will produce a vague report.
A seventh deliverable is often forgotten and worth requesting: the list of discarded use cases, with reasons. It prevents someone from relaunching, a year later, an idea already examined and rejected on good grounds.
The most common cause of failure is not technical, it is the absence of an owner. A prioritised use case with no name against it stays an intention.
Four other reasons come up regularly:
The audit is entrusted to a provider who also sells the solution. The conflict of interest is not always dishonest, it is structural: you see the problems you know how to solve. If you cannot separate the two, at least require the proposal to mention alternatives to the in-house tool.
The data is not accessible. Many promising use cases assume you can work with data locked inside a business application with no programming interface. That check belongs in the audit, not after it. An audit that never looks at the technical feasibility of data access produces a wish list.
The scope is too wide. Auditing the whole company at once dilutes attention and stretches timelines. Starting with the most motivated department gives a visible result in 90 days, which then serves as internal proof.
Nothing is measured beforehand. If you do not know the current processing time, you will never be able to demonstrate the gain. Measuring the baseline is part of the audit, not of the project that follows.
The inventory produced by an AI audit covers a good share of the mapping work required by European regulation. It is a real saving, provided you ask for it at the scoping stage.
The European AI regulation requires organisations deploying AI systems to know what they use and to ensure that the people using those tools have a sufficient level of AI literacy. In practice that means knowing which systems are in place, for which purposes, with which data, and who has been trained.
A well-scoped AI audit produces the first three. If your provider structures the inventory so that it doubles as a compliance register, you do not pay twice for the same work. Spell it out in the brief: a "processing purpose" column and a "risk category" column cost nothing to fill in during the audit, and cost a lot to reconstruct six months later. Our article on the AI Act conformity assessment covers the points to address.
Conversely, do not confuse the two exercises. A compliance audit checks that you meet a legal text. An AI audit looks for productivity gains. They share an inventory, not a purpose.
How long does an AI audit take in an SME? Count 3 to 5 weeks for a process audit across two or three departments, of which roughly 5 to 8 days is actual provider work. Timelines stretch mainly because of your team's availability for interviews, rarely because of the analysis itself.
Should you audit before training your teams? Not necessarily in that order. Basic AI literacy before the audit noticeably improves interview quality: staff who know what an AI agent does will suggest relevant use cases, those with no idea will answer beside the point. Half a day of awareness training beforehand is usually enough.
Is an AI audit eligible for OPCO funding? No for the consulting work itself, which does not qualify as vocational training. French OPCOs fund training actions, not diagnostic assignments. The training paths that follow the audit are eligible, however, provided the provider holds Qualiopi certification. The Diag Data IA runs through a different channel, France 2030.
Can you run an AI audit in-house? Yes, and it often makes sense below 20 employees. The inventory and interview stages require method and time rather than special expertise. The internal difficulty lies elsewhere: costing honestly the processes you designed yourself takes a discipline that an outside view makes easier.
What if the audit concludes that no use case is worth it? That is a result, not a failure, and it does happen. Better to spend 6,000 € avoiding a 40,000 € project with no return. Be wary of the provider whose every audit concludes there is strong potential.
Should the audit cover tools already used without authorisation? Yes, as a priority. It is often the most profitable finding of the exercise: usage already embedded, sometimes effective, but with no security framework or suitable licence. Regularising it costs less than banning it, and removes a genuine risk to your data.
What is the difference between an AI audit and a digital audit? A digital audit covers infrastructure, software and company processes as a whole. An AI audit focuses on what intelligent automation can change on specific tasks. The two overlap on data access, which determines almost everything.
We are not a general audit firm, and we do not sell software: our business is training. That changes two things in how we approach this step.
First, we consistently recommend a short AI literacy phase before any audit. Our AI literacy training for businesses gives teams the vocabulary and reference points they need to identify relevant use cases in their own work. Audits that follow this step produce noticeably more operational lists.
Second, we build use cases with your teams rather than for them. The Operational AI for SMEs programme works directly on your processes and your data, which incidentally produces much of the raw material of an audit: inventory of existing usage, estimates of time spent, first prioritisations.
GrowthPerf is Qualiopi certified, which makes these programmes eligible for OPCO funding. If you are hesitating between starting with an external audit or with skills building, a 30-minute conversation is usually enough to settle it based on your size and maturity. To place that decision in a wider approach, our complete guide to AI in business for SMEs covers every step, from scoping to deployment.