The AI landscape doesn't move in one direction — it lurches. Some techniques leap from experiment to table stakes in a single quarter; others stall against regulatory walls, technical ceilings, or organisational inertia that no amount of hype can dislodge. Knowing which is which is the hard part. The State of Play cuts through the noise with a rigorously maintained index of AI techniques across every major business domain — classified by maturity, evidenced by real-world adoption, and updated daily so you always know where you stand relative to the field. Stop guessing. Start knowing.
A daily newsletter distilling the past two weeks of movement in a domain or two — delivered to your inbox while the index updates in the background.
Each dot marks the weighted maturity of practices within a domain — hover for a brief summary, click for more detail
Governance frameworks for managing data used in AI training and fine-tuning, including provenance, consent, data rights, and opt-out management. Includes training data documentation and deletion-from-model workflows; distinct from general data privacy which manages operational rather than AI-specific data.
Data governance for AI sits in a precarious split: the infrastructure half has matured while the hardest technical problem remains unsolved. Governance platforms now provide production-grade lineage, access control, and documentation capabilities, and regulatory mandates like the EU AI Act and U.S. federal procurement standards have made these table-stakes for regulated deployment. That side of the practice works. The other side -- verifiable deletion of training data from models -- does not. Peer-reviewed research continues to show that machine unlearning methods suppress rather than truly remove learned information, and no scalable proof-of-deletion mechanism exists. This bifurcation defines the bleeding-edge status: organisations can govern what goes into training pipelines, but they cannot yet prove data has been removed once a model has learned from it. The gap between regulatory expectation and technical capability is the defining tension, and it is not closing.
Governance infrastructure has reached production maturity and market saturation, now focusing on agentic AI as the operational frontier. Databricks, Microsoft Azure, AWS, and specialist vendors (Collibra, Immuta, Informatica, OpenMetadata) offer GA platforms for lineage tracking, access governance, and automated compliance workflows. Collibra's March 2026 AI Governance product unifies use-case, model, and agent registries; Immuta's April 2026 "Agentic Data Access" and June 2, 2026 Snowflake integration treat AI agents as first-class governed data users with ephemeral, scoped access and dual-identity audit trails—addressing governance emergence as agentic deployment accelerates. Governance has shifted from compliance checkbox to scaling enabler: enterprises with governance frameworks achieve 12x higher production project success and 6x greater autonomous system scale (Databricks May 2026 study, 20,000+ enterprises). Yet deployment significantly lags governance readiness: a June 2026 Gartner analysis found 57% of IT leaders pushed to adopt AI before organizationally ready, with only 14% confident data is secured/governed. Rights exercise has moved from theoretical to operational: DataGrail reports deletion requests surged 567% since 2021 (now 87% of all data subject requests), with manual handling costing enterprises $1.5M/year on average, creating market pressure for automated governance platforms. Hong Kong Privacy Commissioner audit (May 2026) of 60 organizations shows 95% use AI but governance gaps—only 29% retained personal data post-processing, only 29% disclosed AI in privacy notices—revealing enforcement-driven maturity indicators across jurisdictions.
Real production failures continue to expose governance gaps. May 2026 evidence reveals persistent disconnect between governance platforms (mature) and deployment readiness (immature): Gartner data shows 57% of IT leaders pushed to adopt AI before organizationally ready, with only 14% confident data is secured/governed. Case studies document failures in practice—ungoverned AI agents encountering sensitive data (SSNs, billing records) in tickets, healthcare models perpetuating bias through uncontrolled training data, governance tools treating accessibility compliance differently across vendors. Agentics analysis confirms governance (not cost, talent, or technology) is the #1 blocker to scaling AI across regulated industries. Governance multiplier effects are measurable: enterprises with governance frameworks see 12x more projects reach production and 6x more scale autonomous systems. Yet 40% still lack adequate governance despite deployment, and enterprises deploying agentic AI report 90%+ struggle with audit trail opacity and data lineage uncertainty—governance governance architectural debt compounding at scale.
Regulatory enforcement and compliance barriers intensified through June 2026, with DPA guidance operationalizing rights management architecture. GDPR enforcement reached EUR 5 billion in cumulative fines; the EU AI Act's August 2, 2026 compliance deadline for high-risk systems (EUR 35M or 7% revenue penalties) drives urgent governance adoption. CNIL (French DPA) published January 2026 guidance operationalizing GDPR principles (purpose, roles, rights facilitation, retention) for AI, acknowledging "particular and unprecedented difficulties" in exercising rights on model weights while recommending proportionate implementation patterns. EDPS (European Data Protection Supervisor) issued June 8, 2026 formal orientations to EU institutions on generative AI governance, signaling movement from advisory to enforcement posture. Analysis of 19 regulatory guidelines across jurisdictions reveals enforcement divergence masked by surface consensus: Italy fined OpenAI EUR 15 million for inadequate legal basis and transparency; Brazil's ANPD suspended Meta's AI training; Hong Kong Privacy Commissioner documented governance gaps in 60 audited organizations. The core deletion problem shows early technical advances offset by persistent verification gaps. May 2026 SoK paper documents that both unlearnability and unlearning suffer "shallow dememorization" with falsely claimed forgetting and lack formal guarantees. However, June 2026 peer-reviewed research (UMD, Model State Arithmetic/MSA) demonstrated selective unlearning without full retraining using training checkpoints, enabling Article 17 erasure rights compliance at feasible operational cost. May-June 2026 research convergence: ALU framework enables mass deletion via public data augmentation; D² paradigm addresses latent knowledge re-emergence; yet June 2026 papers on reconstruction attacks and reversibility show unlearning brittleness under adversarial queries—information can be rapidly restored via fine-tuning. Organisations now face asymmetric information: governance platforms control data input maturely, deletion-from-model mechanisms show early-stage feasibility but lack formal verification guarantees, and regulatory authorities acknowledge both paths while demanding proportionate compliance solutions by August 2, 2026.
— Fresh (June 8) European Data Protection Supervisor formal guidance to EU institutions on gen AI data governance (DPIAs, data minimization, fairness, rights exercise); signals supervisory-authority enforcement posture moving from advisory to mandatory compliance.
— Systematization of 14 reconstruction attacks against synthetic data generation; NIST-validated finding that differential privacy protection plateaus at high epsilon and synthesizer choice dominates risk—essential for evaluating data governance tool effectiveness.
— Snowflake Summit announcement (June 2, 2026) of Collibra AI Command Center integration enabling production agentic AI governance; signals ecosystem maturity for governed data access at enterprise scale.
— Immuta-Snowflake agentic data access implementation: agents receive ephemeral, provisioned access scoped to user permissions with dual-identity audit trails; demonstrates production architecture for governing AI agent data access at scale.
— ICLR 2026 research (Model State Arithmetic/MSA) enabling selective unlearning via training checkpoints without full retraining; demonstrates technical feasibility of Article 17 erasure rights compliance at scale without model rebuilding.
— Regulatory authority audit of 60 organizations: 95% use AI but governance gaps evident—only 29% retained personal data post-processing for rights exercise, only 29% disclosed AI in privacy notices, revealing enforcement-driven governance maturity indicators.
— Quantified adoption signals: deletion requests surged 567% since 2021; 87% of data subject requests are now deletions; manual DSR handling costs $1.5M/year—demonstrating scaling of rights exercise operationalization and governance market maturity.
— IAPP legal analysis identifies governance flaw: consent validity becomes questionable when processing design makes withdrawal structurally impossible. Signals regulatory gap in data rights management.