The challenge is no longer to defend humanity's place against machines, but to decide how we want to exercise power, make decisions and remain resilient.
We still talk far too often about artificial intelligence as a competition between humans and machines.
Who will be faster? Who will make better decisions? Which jobs will disappear? Which skills will remain exclusively human?
This narrative is compelling, but it confines us to a question that is far too narrow: who will win?
While we search for a winner, organisations face much more immediate questions. Which decisions should involve artificial intelligence? Based on what data? Subject to which controls? Who will remain accountable? And how will operations continue if the system makes a mistake, becomes unavailable or comes under attack?
The real dividing line will probably not be between humans and machines. It will separate organisations capable of using these technologies with sound judgement from those that have merely automated their existing weaknesses.
Power Will Belong to Those Who Can Still Verify
METRICS Pillar: Power and Threats
Artificial intelligence is already reshaping the balance of power.
It enables the analysis of vast quantities of information, the identification of correlations, the production of persuasive content and the acceleration of certain decisions. It provides new capabilities to businesses and public institutions, but also to criminal organisations and actors pursuing destabilisation strategies.
The same technology can be used to detect a disinformation campaign or to create one. It can strengthen critical infrastructure or help identify its vulnerabilities. It can facilitate access to knowledge or flood the information environment with misleading content.
The European Union Agency for Cybersecurity's 2026 Threat Landscape report highlights the influence of geopolitical tensions and the growing interconnectedness of digital ecosystems. It also emphasises how technological dependencies expand the attack surface.[1]
In this environment, power no longer lies solely in the volume of information available. It lies in the ability to establish its provenance, cross-check it, understand its limitations and reject an answer when it is insufficiently reliable.
The strategic challenge is therefore not simply to adopt artificial intelligence. It is to preserve an independent capacity for critical assessment.
A Technological Breakthrough Only Becomes Valuable When It Can Scale
METRICS Pillar: Science and Technologies
A spectacular technological demonstration can be delivered in minutes. Turning it into an operational capability takes considerably longer.
Between the laboratory and real-world deployment lie data, infrastructure, cybersecurity, interoperability, skills, maintenance, financing and regulatory compliance. Organisations must also understand the context in which a technology will be used and the potential consequences of failure.
This explains why two organisations using exactly the same tool can achieve radically different outcomes. Technology replaces neither professional expertise nor a deep understanding of the problem.
The EU Artificial Intelligence Act translates this requirement into organisational responsibility.
Article 4 requires providers and deployers of AI systems to take measures to ensure a sufficient level of AI literacy among their personnel, taking account of their knowledge, experience and the context of use.
For systems classified as high-risk, the regulation also establishes requirements concerning risk management, transparency and human oversight.[2]
In other words, purchasing a tool is not enough. Organisations must understand what it does, what it cannot do and under which circumstances its outputs cease to be reliable.
Innovation begins with technology. Transformation begins when an organisation develops the capacity to understand and govern it.
Design for the Day the System Stops Responding
METRICS Pillar: Critical Systems and Resilience
We tend to evaluate systems when they operate under normal conditions. Yet resilience is truly measured when those conditions disappear.
What happens if data becomes corrupted? If a supplier becomes unavailable? If an update changes a model's performance? If an attack targets a component of the technology supply chain? Or if employees can no longer perform manually an operation that has become fully automated?
The European NIS2 Directive explicitly includes business continuity, crisis management, backups and supply chain security among the cybersecurity risk-management measures expected of entities within its scope.
It also assigns management bodies responsibility for approving and overseeing these measures.[3]
In the financial sector, the Digital Operational Resilience Act (DORA) takes this approach further by requiring a structured framework for digital operational resilience and risk-based testing programmes, including vulnerability assessments, scenario-based testing, security reviews and penetration testing.[4]
France's data protection authority, the CNIL, likewise recommends combining traditional IT security with an assessment of risks specific to AI systems.
Its recommendations emphasise data reliability, component documentation, awareness of system limitations, security audits and the preparation of rollback procedures.[5]
The question is therefore not:
"How well does this system perform?"
It is:
"Will we still be able to act when it no longer behaves as expected?"
Automation Redistributes Responsibility
METRICS Pillar: Economy, Governance and the Human Factor
Technology never enters an organisation in a neutral environment.
It affects responsibilities, skills, performance assessment and the circulation of information. It can challenge not only a profession, but also an individual's status, professional identity or position of authority.
Resistance should therefore not automatically be interpreted as opposition to progress.
It may reflect entirely legitimate questions: Who will control the outcome? Who will be accountable for mistakes? How will my work be assessed? Will I gain greater autonomy, or simply be expected to produce more?
According to the International Labour Organization, approximately one in four workers is employed in an occupation with some degree of exposure to generative artificial intelligence.
However, the ILO considers job transformation more likely than complete job displacement, particularly because many tasks continue to require human involvement. It therefore calls for this transition to be managed through social dialogue.[6]
This transformation cannot be governed solely through productivity indicators.
A dashboard can measure the number of automated tasks or the time saved. It is far less capable of revealing a team's loss of confidence, the gradual erosion of a critical skill or the fact that employees no longer feel able to challenge a system's recommendations.
The OECD's revised AI Principles place particular emphasis on transparency, robustness, traceability and accountability throughout the AI system lifecycle.[7]
Serious governance is therefore not about asking people to trust technology.
It is about creating the conditions under which trust can be earned, qualified or withdrawn.
The Real Value of a Solution Begins After the Demonstration
METRICS Pillar: Experimentation and Partner Solutions
Technology demonstrations generally take place in controlled environments. Organisations operate in far less predictable conditions.
Their data is imperfect. Legacy systems struggle to communicate. Responsibilities are shared. Legal, financial and human constraints overlap.
This is why solutions must be tested against realistic scenarios: cyber crises, supply chain disruptions, supplier outages, information attacks, sensor failures or decisions made under extreme pressure.
Testing must assess not only the technology, but also the organisation using it.
Who detects an incident? Who has the authority to shut down the system? Is there a fallback solution? Can teams operate without the tool? Can data and models be migrated or rolled back? Are responsibilities between the developer, integrator, supplier and user clearly defined?
Experimentation then becomes an instrument of governance.
It allows organisations to test promises against reality, expose dependencies and establish the conditions under which innovation can genuinely contribute to resilience.
Choosing What We Want to Strengthen
We do not yet know the ultimate limits of artificial intelligence.
Attempting to identify today the skills that AI will never be able to reproduce may therefore distract us from more urgent decisions.
What we can choose, however, is which capabilities we want to strengthen: critical judgement, preparedness, cooperation, accountability and the freedom to challenge an automated decision.
This is the perspective at the heart of METRICS.
Bringing together threat specialists, scientists, industrial leaders, critical infrastructure operators, executives, legal professionals and financial stakeholders allows us to move beyond a purely technological vision of progress.
Because an organisation does not become resilient simply by possessing the most advanced tools.
It becomes resilient when it understands why it uses them, what responsibilities it delegates to them and how it will continue making decisions when those tools reach their limits.
METRICS SUMMIT 2027 — From Risk to Resilience
7–8 July 2027 | Paris, France
Bringing together science, technology, security, industry, governance and the human factor to strengthen Europe's strategic resilience.
Discover METRICS https://www.metrics-summit.org/fr/themes
Notes and References
[1] ENISA — Threat Landscape 2026. Analysis of threats affecting the European Union and the impact of digital dependencies. European Union Agency for Cybersecurity. ENISA Threat Landscape https://www.enisa.europa.eu/topics/cyber-threats/threats-and-trends
[2] Regulation (EU) 2024/1689 — Artificial Intelligence Act. In particular, Articles 4, 9, 13 and 14 concerning AI literacy, risk management, transparency and human oversight. Official text — EUR-Lex https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
[3] Directive (EU) 2022/2555 — NIS2. In particular, Articles 20 and 21 concerning management accountability, business continuity, crisis management and supply chain security. Official text — EUR-Lex https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng
[4] Regulation (EU) 2022/2554 — Digital Operational Resilience Act (DORA). In particular, Articles 24–27 concerning digital operational resilience testing programmes. Official text — EUR-Lex https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng
[5] CNIL — Securing the Development of an AI System. Recommendations concerning risk assessments, audits, usage limitations, output controls and rollback procedures. CNIL https://www.cnil.fr/en
[6] International Labour Organization — Generative AI and Jobs: A Refined Global Index of Occupational Exposure (2025). Research on occupational exposure to generative AI and the transformation of employment. ILO https://www.ilo.org/
[7] OECD — AI Principles, revised in 2024. Transparency, explainability, robustness, safety, security and accountability. OECD AI Principles https://oecd.ai/en/ai-principles