The AI landscape doesn't move in one direction — it lurches. Some techniques leap from experiment to table stakes in a single quarter; others stall against regulatory walls, technical ceilings, or organisational inertia that no amount of hype can dislodge. Knowing which is which is the hard part. The State of Play cuts through the noise with a rigorously maintained index of AI techniques across every major business domain — classified by maturity, evidenced by real-world adoption, and updated daily so you always know where you stand relative to the field. Stop guessing. Start knowing.
A daily newsletter distilling the past two weeks of movement in a domain or two — delivered to your inbox while the index updates in the background.
Each dot marks the weighted maturity of practices within a domain — hover for a brief summary, click for more detail
AI that automates GDPR, CCPA, and other data protection compliance tasks including DPIA, consent management, and breach response. Includes data subject request processing and privacy impact assessment; distinct from data anonymisation which applies technical privacy controls rather than managing compliance processes.
Privacy compliance automation has a proven ecosystem, quantified ROI, and analyst-validated tooling — yet the practice's defining tension is that most organisations still aren't using it effectively. Platforms can now automate data subject requests, consent orchestration, privacy impact assessments, and breach response workflows across GDPR, CCPA, and a growing patchwork of global regulations. The business case is settled: documented outcomes include 90% reductions in DSR cycle times and six-figure annual cost savings. But only 28% of organisations achieve GDPR compliance and 11% meet CCPA/CPRA requirements, while over 80% of compliance professionals still rely primarily on manual processes. Regulatory enforcement has intensified sharply in Q2 2026, with regulators now verifying operational compliance (not just notice presence) — a shift evidenced by enforcement actions targeting specific technical failures in consent systems (GPC signal handling, opt-out effectiveness, audit trails). The bottleneck is no longer vendor capability. It is organisational readiness — the process discipline, integration work, and change management required to operationalise what these platforms offer. This makes privacy compliance automation a rollout challenge, not a proof-of-concept one.
OneTrust remains the category leader, earning Forrester's top position in its Q4 2025 Privacy Management Software Wave, while competitors like TrustArc, DataGrail, and Ketch carve out niches — often by absorbing customers frustrated with OneTrust's implementation costs (3-6 month deployments, $100K+ consulting fees) and aggressive renewal pricing. The vendor ecosystem is mature and competitive, with OneTrust's Winter 2026 release introducing AI-powered agents for automated review and governance workflows. TrustArc's ROI data documents DSR processing costs dropping from $1,200 to $150-225 per request and cycle times compressing from 35-40 days to 4-5. These are compelling numbers, but they describe what is possible, not what is typical.
The gap between platform capability and field reality remains stark. A Regology survey of 204 compliance professionals found over 80% still rely primarily on manual processes despite available tooling, and 73.5% have faced enforcement consequences. Cumulative GDPR fines have reached EUR 6.72 billion since 2018, with April 2026 enforcement intensity accelerating on technical grounds (e.g. Disney $2.75M for incomplete GPC signal handling across devices; PlayOn Sports $1.1M for broken opt-out mechanisms; Ford $375K for unauthorized opt-out verification requirements). Regulatory scope is also expanding: AI governance now intersects privacy compliance, with 90% of advanced AI adopters reporting governance limitations and the EU AI Act enforcement approaching in August 2026. The European Data Protection Board's March 10 2026 standardized DPIA template mandates systematic risk assessment capabilities expected in platforms by June 2026, signaling regulatory expectation that compliance automation tools support design-risk assessment and AI Act alignment. Vendor lock-in compounds the challenge — proprietary data formats, API dependencies, and contractual entrenchment raise migration costs, as organisations like Dexcom and Branch discovered when switching platforms. The market is projected to reach $6.7 billion by 2033, but growth depends less on new features than on closing the organisational readiness gap that defines this practice's ceiling. Adoption acceleration is measured: AscentAI survey shows only 16% of compliance teams at advanced automation maturity, with 35% projected within 12 months and 74% planning compliance tech investment.
— AscentAI survey shows compliance automation adoption acceleration: 58% at basic maturity, 16% advanced; projected to reach 35% advanced within 12 months; 74% plan compliance tech investment; 46% view AI tools as transformational.
— UC Berkeley empirical research from 50+ company interviews and SEC filings documents data mapping, consent management, and DSR processing as areas where automation addresses identified compliance pain points.
— April 2026 enforcement data documents simultaneous multi-jurisdictional enforcement focused on technical compliance execution (retention timings, deletion procedures, consent audit logs), signaling automation as operational necessity.
— Global hospitality organization deployed OneTrust Data Discovery to establish GDPR/CCPA compliance governance; achieved organizational readiness, identified security gaps, and quantified remediation priorities.
— Global pharma deployment spans 130 sites across 35+ jurisdictions; automated assessment acceleration from days to 5 minutes and tens of thousands in external legal fee savings.
— March 10 2026 EDPB standardized DPIA template ends 8 years of fragmented national approaches and mandates systematic, automated risk assessment capabilities expected in privacy platforms by June 2026.
— Open-source Claude AI skill provides working DPIA generation, compliance checking, and data subject rights tracking (DSR deadline management, identity verification, compliance reporting) with 86% quality rating.
— Analysis of Q1 2026 enforcement surge ($9M+ in CA fines 2025) documents named cases (Disney, PlayOn Sports, Ford) with specific technical failures; regulators now verify operational compliance, not just notice presence.