The AI landscape doesn't move in one direction — it lurches. Some techniques leap from experiment to table stakes in a single quarter; others stall against regulatory walls, technical ceilings, or organisational inertia that no amount of hype can dislodge. Knowing which is which is the hard part. The State of Play cuts through the noise with a rigorously maintained index of AI techniques across every major business domain — classified by maturity, evidenced by real-world adoption, and updated daily so you always know where you stand relative to the field. Stop guessing. Start knowing.
A daily newsletter distilling the past two weeks of movement in a domain or two — delivered to your inbox while the index updates in the background.
Each dot marks the weighted maturity of practices within a domain — hover for a brief summary, click for more detail
AI that automates GDPR, CCPA, and other data protection compliance tasks including DPIA, consent management, and breach response. Includes data subject request processing and privacy impact assessment; distinct from data anonymisation which applies technical privacy controls rather than managing compliance processes.
Privacy compliance automation has a proven ecosystem, quantified ROI, and analyst-validated tooling — yet the practice's defining tension is that most organisations still aren't using it effectively. Platforms can now automate data subject requests, consent orchestration, privacy impact assessments, and breach response workflows across GDPR, CCPA, and a growing patchwork of global regulations. The business case is settled: documented outcomes include 90% reductions in DSR cycle times and six-figure annual cost savings. But only 28% of organisations achieve GDPR compliance and 11% meet CCPA/CPRA requirements, while over 80% of compliance professionals still rely primarily on manual processes. Regulatory enforcement has intensified sharply in Q2 2026, with regulators now verifying operational compliance (not just notice presence) — a shift evidenced by enforcement actions targeting specific technical failures in consent systems (GPC signal handling, opt-out effectiveness, audit trails). The bottleneck is no longer vendor capability. It is organisational readiness — the process discipline, integration work, and change management required to operationalise what these platforms offer. This makes privacy compliance automation a rollout challenge, not a proof-of-concept one.
OneTrust remains the category leader, earning Forrester's top position in its Q4 2025 Privacy Management Software Wave, while competitors like TrustArc, DataGrail, and Ketch carve out niches — often by absorbing customers frustrated with OneTrust's implementation costs (3-6 month deployments, $100K+ consulting fees) and aggressive renewal pricing. The vendor ecosystem is mature and competitive, with OneTrust's Winter 2026 release introducing AI-powered agents for automated review and governance workflows. TrustArc's ROI data documents DSR processing costs dropping from $1,200 to $150-225 per request and cycle times compressing from 35-40 days to 4-5. These are compelling numbers, but they describe what is possible, not what is typical.
The gap between platform capability and field reality remains stark. A Regology survey of 204 compliance professionals found over 80% still rely primarily on manual processes despite available tooling, and 73.5% have faced enforcement consequences. Cumulative GDPR fines have reached EUR 6.72 billion since 2018, with April 2026 enforcement intensity accelerating on technical grounds (e.g. Disney $2.75M for incomplete GPC signal handling across devices; PlayOn Sports $1.1M for broken opt-out mechanisms; Ford $375K for unauthorized opt-out verification requirements). Regulatory scope is also expanding: AI governance now intersects privacy compliance, with 90% of advanced AI adopters reporting governance limitations and the EU AI Act enforcement approaching in August 2026. The European Data Protection Board's March 10 2026 standardized DPIA template mandates systematic risk assessment capabilities expected in platforms by June 2026, signaling regulatory expectation that compliance automation tools support design-risk assessment and AI Act alignment. The French CNIL and EU EDPS have issued official guidance mandating DPIAs for AI systems, establishing regulatory precedent for when compliance automation must be operationalized as a gating control in development pipelines. Vendor lock-in compounds the challenge — proprietary data formats, API dependencies, and contractual entrenchment raise migration costs, as organisations like Dexcom and Branch discovered when switching platforms. The market is projected to reach $6.7 billion by 2033, but growth depends less on new features than on closing the organisational readiness gap that defines this practice's ceiling. Adoption acceleration is measured: TrustArc's 2026 benchmarks show organizations with 6+ integrated automation initiatives score 75% maturity versus 21% for fragmented programs—a 4X gap driven by integration discipline, not vendor capability. Only 16% of compliance teams operate at advanced automation maturity per AscentAI, though 35% are projected within 12 months and 74% are planning compliance tech investment. Cost pressure accelerates adoption: DataGrail reports data subject request (DSR) volumes increasing for the fifth consecutive year, with manual DSAR management costing ~$1.5 million annually for mid-sized companies receiving 5 million annual website visitors. However, deployment of AI itself creates new compliance barriers: Aithos research shows frontier AI models (Claude, GPT-4, others) fail GDPR and EU AI Act compliance tests at 46-93% rates, revealing a critical maturity barrier for deploying AI in compliance-sensitive workflows and validating the need for specialized compliance automation tools with mandatory human oversight.
— EU regulatory authority mandates DPIAs for generative AI systems and establishes privacy compliance frameworks as legal requirements, signaling broad adoption of DPIA and risk assessment automation.
— Major data management vendor (Veeam) launches three AI agents for privacy operations (Consent, DSR, Assessment) with 50% faster DSR form launch, addressing operational scale challenge in AI-native compliance.
— Practitioner guidance identifies organizational gap: SMEs completing GDPR DPIAs often fail to incorporate EU AI Act requirements (FRIA); documents operational risk of treating GDPR and AI governance assessment separately.
— DataGrail reports DSR volumes increasing for fifth consecutive year; manual DSAR management costs ~$1.5M annually for mid-sized companies; deletion requests surged 398% in 2025, validating business case for DSAR automation.
— Aithos LARA framework research shows frontier AI models fail GDPR and EU AI Act compliance at 46-93% rates, revealing critical maturity barrier for deploying AI in compliance-sensitive data protection workflows and validating need for specialized automation tools with human oversight.
— Quantifies compliance automation ROI: eliminates 60-80% of repetitive administrative work; evidence collection reduced from 200-400 annual labor hours to 20-40 hours; documents realistic boundary between automatable frequency/volume tasks and human judgment decisions.
— Survey of 1,844 organizations shows 4X maturity gap (75% vs 21%) between companies with 6+ integrated automation initiatives vs fewer than 5 disconnected programs; ROI shifts from -0.4% (compliance-only) to 61% with trust/revenue uplift.
— French Data Protection Authority official guidance on DPIA mandatory triggers for AI systems, establishing regulatory expectation for compliance automation to operationalize DPIA as gating control.