Evidence
Every number we publish, with its source, sample and date. If a figure cannot survive being checked, it does not belong on our site.
Last reviewed: 3 August 2026.
How to read this page
- Sample: who was actually asked, and how many.
- Scope: which countries and which period the fieldwork covers.
- Wording: the finding as the source states it, not as it is usually repeated.
The numbers
| Figure | What it actually says | Source, sample and scope |
|---|---|---|
| 95% | "Despite $30-40 billion in enterprise investment into GenAI, this report uncovers a surprising result in that 95% of organizations are getting zero return." The unit is organizations, not pilots and not dollars. | MIT NANDA, The GenAI Divide: State of AI in Business 2025. July 2025. Based on 300+ public AI initiatives, 52 interviews and 153 leader surveys. The report describes itself as preliminary findings. mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf |
| $30-40B | Estimated global enterprise investment in generative AI covered by the same MIT NANDA study. | MIT NANDA, The GenAI Divide: State of AI in Business 2025. July 2025. mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf |
| 6% | "Respondents who attribute EBIT impact of 5 percent or more to AI use and say their organization has seen 'significant' value from AI use, our definition of AI high performers, representing about 6 percent of respondents." Separately, 39% report EBIT impact at enterprise level, for most of them below 5% of EBIT. | McKinsey, The state of AI in 2025: Agents, innovation, and transformation. 5 November 2025. Global respondent survey. mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai |
| 3x | "High performers are three times more likely than their peers to strongly agree that senior leaders at their organizations demonstrate ownership of and commitment to their AI initiatives." | McKinsey, The state of AI in 2025. 5 November 2025. mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai |
| Two thirds | "Nearly two-thirds of respondents say their organizations have not yet begun scaling AI", with approximately one third reporting they have begun to scale. "Not yet begun scaling" includes organizations that have not started at all, so it is broader than "stuck in pilots". | McKinsey, The state of AI in 2025. 5 November 2025. mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai |
| 25 attributes | "Out of 25 attributes tested for organizations of all sizes, the redesign of workflows has the biggest effect on an organization's ability to see EBIT impact from its use of gen AI." Scoped to generative AI specifically. | McKinsey, The state of AI: How organizations are rewiring to capture value. March 2025. mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-how-organizations-are-rewiring-to-capture-value |
| 21% | Only 21% of companies deploying or planning AI agents report a mature governance model for agentic AI. The denominator is companies working with agents, not all organizations. | Deloitte, State of AI in the Enterprise 2026: The untapped edge. Published 21 January 2026. 3,235 director to C-suite business and IT leaders, 24 countries, six industries. Fieldwork August and September 2025. deloitte.com/us/en/about/press-room/state-of-ai-report-2026.html |
| 84% | "84% of companies have not redesigned jobs around AI capabilities." | Deloitte, State of AI in the Enterprise 2026. 21 January 2026. n=3,235, 24 countries. deloitte.com/us/en/about/press-room/state-of-ai-report-2026.html |
| 34% / 37% | 34% of companies report using AI to "deeply transform" the business, creating new products and services or reinventing core processes. 37% report using AI at a surface level with little or no change to underlying processes. Both self-reported. | Deloitte, State of AI in the Enterprise 2026. 21 January 2026. n=3,235, 24 countries. deloitte.com/us/en/about/press-room/state-of-ai-report-2026.html |
| 74% / 20% | "74% of organizations hoping to grow revenue through their AI initiatives in the future compared to just 20% that are already doing so." The 20% are already growing revenue, which is narrower than "showing measurable impact". | Deloitte, State of AI in the Enterprise 2026. 21 January 2026. n=3,235, 24 countries. deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/content/state-of-ai-in-the-enterprise.html |
| 20% / 43% / 40% | Perceptions of high preparedness fell year over year for talent (20%), technical infrastructure (43%) and data management (40%). Preparedness for risk and governance stood at 30% and rose year over year, alongside strategy at 42%. | Deloitte, State of AI in the Enterprise 2026. 21 January 2026. n=3,235, 24 countries. deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/content/state-of-ai-in-the-enterprise.html |
| 50% growth in access | "Workforce access to AI has expanded by 50% in just one year, growing from fewer than 40% to around 60%." This measures how many workers can reach sanctioned AI tools. It is not a measure of budget. | Deloitte, State of AI in the Enterprise 2026. 21 January 2026. n=3,235, 24 countries. deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/content/state-of-ai-in-the-enterprise.html |
| 21% operating model | Only 21% of companies had fundamentally redesigned their operating model around AI. Companies attributing 5% or more of EBIT to AI were three times more likely to pursue broad operating model redesign. | McKinsey, The operating model advantage: Why AI winners are rewiring their organizations. July 2026. mckinsey.com/industries/industrials/our-insights/the-operating-model-advantage-why-ai-winners-are-rewiring-their-organizations |
| 42% | "The percentage of companies abandoning the majority of their AI initiatives before they reach production has surged from 17% to 42% year over year." The qualifier "before they reach production" is part of the finding. | S&P Global Market Intelligence / 451 Research, Voice of the Enterprise: AI & Machine Learning, Use Cases 2025. Published January 2025. 1,006 midlevel and senior IT and line of business professionals, North America and Europe. spglobal.com/market-intelligence/en/news-insights/research/ai-experiences-rapid-adoption-but-with-mixed-outcomes-highlights-from-vote-ai-machine-learning |
| 50% abandoned after PoC | "At least 50% of generative AI projects were abandoned after proof of concept", covering the period through the end of 2025. Gartner attributes this to several causes together: unclear business value, poor data quality, insufficient risk controls, rising costs and change management. | Gartner, Why 50% of GenAI Projects Fail And How to Beat the Odds. Arun Chandrasekaran, 26 January 2026. gartner.com/en/articles/genai-project-failure |
Regulatory dates
Regulatory exposure is already active, but obligations phase in on different timelines. These are the dates we work to.
| Date | What applies | Instrument |
|---|---|---|
| 2 February 2025 | Prohibited AI practices (Article 5) and AI literacy obligations (Article 4) apply. | EU AI Act, Regulation (EU) 2024/1689 |
| 17 January 2025 | DORA applies to financial entities: ICT risk management, incident reporting, third party oversight. | Regulation (EU) 2022/2554 |
| 2 August 2025 | Obligations for providers of general purpose AI models apply: documentation, copyright policy, training data summary. | EU AI Act |
| 2 August 2026 | Enforcement powers and the penalty regime become applicable, and Article 50 transparency obligations apply: disclosure of AI interaction, marking of synthetic content, deepfake labelling. | EU AI Act |
| 11 September 2026 | Reporting of actively exploited vulnerabilities and severe incidents begins. | Cyber Resilience Act, Regulation (EU) 2024/2847 |
| 2 December 2026 | End of the grace period for machine readable marking of content from generative systems placed on the market before 2 August 2026. | EU AI Act, Article 50(2) |
| 2 December 2027 | High risk obligations for Annex III systems apply, deferred from 2 August 2026 by the Digital Omnibus. | EU AI Act |
| 11 December 2027 | Full Cyber Resilience Act obligations apply. | Cyber Resilience Act |
| 2 August 2028 | High risk obligations for Annex I systems embedded in regulated products apply, deferred from 2 August 2027. | EU AI Act |
NIS2 raises cybersecurity accountability to management body level under Article 20. Personal liability and enforcement are determined by national transposition, which is complete in some member states and still in progress in others. Exposure depends on the jurisdictions you operate in, which is why it needs a map rather than an assumption.
What we do not claim
- We are not a law firm. Nothing here is legal advice and no engagement substitutes for counsel.
- We are not an auditor or a certification body. We build the evidence base that auditors and regulators examine.
- No architecture makes an organization permanently compliant. Obligations change, and so must the controls.
- Where a figure is contested or preliminary, we say so on this page rather than in a footnote nobody reads.