Your AI in marketing should not be a helper. It should be the colleague who tells you the campaign is not working.
What McKinsey, BCG, MIT and Gartner tell us about the gap between adoption and value. And why the shortcut of scattered tools is creating a serious GDPR, EU AI Act and cybersecurity problem inside your company.
1. Plenty of adoption, little value
Start with the numbers. In The State of AI in 2025, McKinsey surveyed almost 2,000 executives across 105 countries. It found that 88% of organisations already use AI in at least one function. That looks like a win. It is not.
In the same sample, only 39% report any EBIT impact at enterprise level. And only around 6% achieve an impact above 5%. Nearly two-thirds have still not begun scaling AI beyond pilots.
MIT reached a similar conclusion by a different route. In The GenAI Divide: State of AI in Business 2025, Project NANDA reviewed more than 300 public initiatives and interviewed dozens of organisations. It found that around 95% of enterprise generative AI pilots produced no measurable effect on the profit and loss account.
BCG completes the triangle. In The Widening AI Value Gap, only 5% of companies are genuinely built for the future. Around 35% are scaling. The remaining 60% still have nothing tangible to show.
Three firms, three methods, one verdict. Adoption is close to universal. Value is rare.
2. The knowledge stays trapped in a browser tab
Here is the part nobody raises in the board meeting.
MIT identified a “shadow AI economy”. In more than 90% of the companies surveyed, employees use personal AI tools for work. Only around 40% of those companies hold official subscriptions. In other words, real adoption is happening below the radar, inside each person’s private account.
Gartner measured the same behaviour in a separate survey. More than 57% of employees use personal generative AI accounts for work purposes. And 33% admit entering sensitive information into unapproved tools.
Think about what that means in practice.
Your performance director asks ChatGPT why the cost per acquisition went up. He gets a good answer. He closes the tab. The answer dies there.
Your CRM manager asks the same question in Gemini, with a different file, a different definition of conversion and a different date range. She gets another good answer. That one dies there too.
Your analyst asks the same question in Copilot, working from an Excel export that is three weeks old.
Three people. Three plausible answers. Three different truths. Zero organisational memory.
MIT calls this the “learning gap”. Generic models are excellent for the individual, precisely because they are flexible. But they do not hold the company context, they do not learn from yesterday’s correction, and they do not improve with use. One executive in the study put it bluntly. The tool repeats the same mistakes and forces you to explain everything again in every session.
An organisation does not win by having a thousand private conversations with an AI. It wins when a thousand conversations start from the same data, the same definitions and the same assumptions, and when every correction becomes available to everyone.
Without that, AI is not collective intelligence. It is scattered individual productivity that disappears the moment someone changes role or leaves.
3. The sprawl of tools, and where your data actually goes
While this happens, the stack grows on its own. One tool to transcribe meetings. Another to generate creative. Another to write emails. Another to summarise PDFs. A browser plugin somebody installed and nobody approved.
Each one has its own servers, sub-processors and locations. Almost none has been reviewed by legal.
The Gartner forecast is direct. By 2027, more than 40% of AI-related data breaches will come from the improper use of generative AI across borders. The reason is simple. User adoption moved faster than governance. Unintended international transfers happen mostly when AI is built into existing products without a clear notice, and when sensitive prompts are sent to APIs hosted in unknown locations.
The same analysis adds that, by 2027, AI governance will become a requirement of almost every sovereign AI law. Organisations that cannot build in those controls will be at a competitive disadvantage.
This is not a theoretical risk. It is the current design of most European marketing stacks.
4. GDPR was not suspended because AI arrived
There is a comfortable idea going around. That pasting data into an AI tool is somehow different from sending it to a supplier. It is not.
When an employee types a client name, an email address, a contract value or a health detail into an AI tool, that is processing of personal data under GDPR. There is a controller, a processor, a purpose, a lawful basis and, very often, an international transfer. In the vast majority of cases, none of it has been documented.
The enforcement climate is tightening. Cumulative GDPR fines have already passed 7 billion euros. And the European Data Protection Board chose transparency and information duties, Articles 12, 13 and 14, as the theme of its 2026 coordinated enforcement action, with 25 authorities taking part. That is exactly the weak spot of any organisation processing data through AI tools without telling anyone.
The clearest signal came from a single case. In February 2026, a senior UK tribunal warned that uploading client documents into ChatGPT breaches confidentiality and can waive legal privilege. The professional involved was reported to two regulators. He is not unusual. It is normal behaviour in thousands of offices every day.
5. “Anyone can build software now”. That is where the trouble starts
The second shortcut is more dangerous. The idea that, with a good conversation with a model, any team can build its own internal application. No developers, no review, no security.
The data is uncomfortable.
Veracode tested more than a hundred models on security sensitive coding tasks. Around 45% of the generated code introduced OWASP Top 10 vulnerabilities. The more telling point is the trend. The security pass rate stayed flat at roughly 55%, even as models became clearly better at writing working code. The models improved at what they were optimised for. Security was not on that list.
GitGuardian, in State of Secrets Sprawl 2026, recorded 28.65 million new hardcoded secrets in public code during 2025, a 34% rise on the previous year. Commits assisted by AI leaked credentials at roughly twice the baseline rate.
The Cloud Security Alliance reviewed 2.23 million code samples generated by 16 models. Almost 20% referenced packages that do not exist. Attackers now register those invented names with malicious code, waiting for someone to install them.
And Georgia Tech’s Vibe Security Radar had catalogued 74 CVEs directly traceable to AI coding tools by March 2026.
Gartner takes the forecast to its limit. By 2028, prompt-to-app approaches adopted by citizen developers are expected to increase software defects by 2,500%.
The pattern never changes. The application works. The demo goes well. The flaw sits in production until somebody finds it. And quite often, the person who finds it first does not work for you.
6. The real regulatory calendar, without the myths
There is a belief that the EU AI Act has been postponed and that there is plenty of time. It is half true, and it is the wrong half.
What already applies today:
- The Article 5 prohibitions and the Article 4 AI literacy duty, since 2 February 2025.
- Obligations for general-purpose AI models, since 2 August 2025.
What was confirmed in 2026 through the Digital Omnibus, approved by Parliament on 16 June and given final clearance by the Council on 29 June:
- Article 50 transparency obligations still apply from 2 August 2026, with one exception for systems already on the market, moved to 2 December 2026.
- High-risk obligations under Annex III move to 2 December 2027.
- High-risk obligations under Annex I move to 2 August 2028.
So the relief is real, but it is narrow. Transparency and AI literacy stay on the original timetable. And none of this suspends GDPR, which still applies to every prompt containing personal data, or NIS2, which holds covered organisations accountable for the security of their supply chain. If you sell to banking, telecoms, health, energy or public administration, your AI stack is already auditable through your client.
7. Six questions to ask at your next board meeting
- Which AI tools are in use across this company, and how many did we approve?
- Where is the data in our prompts processed, and under which jurisdiction?
- Is there one single set of metric definitions that the AI uses when answering everyone?
- When somebody corrects a wrong answer, does that correction reach the rest of the team?
- Which internal applications were built with AI and never went through a security review?
- If a regulator asked tomorrow for our record of AI processing activities, could we hand it over?
If the answers are vague, the problem is not technical. It is governance. And as the McKinsey data shows, the variable most closely linked to financial impact is not the model you choose. It is the redesign of the processes around it.
8. A practical example: how IDIRA.chat was built the other way round
When we designed IDIRA.chat, we started from compliance and worked towards the product, not the other way round. That order changes everything.
Your data stays in your environment. IDIRA.chat connects to your live sources, validated today for Google Analytics 4, Google Ads and Meta Ads, unified in BigQuery hosted in the European Union. The connection uses the Model Context Protocol, an open and secure standard. You do not need to understand MCP to use the product. You only need to know that your data does not leave your environment.
Nothing feeds public models. Your proprietary data is never used to train public models. That is an architectural decision, not a policy written in a PDF.
You choose the model and the data residency. Multi LLM routing lets you select between Gemini, Azure OpenAI, Claude, Mistral or compatible local endpoints, based on cost, performance and data residency requirements. You are not locked to a single supplier.
The AI does not answer without data. MCP acts as a data gate. The assistant will not generate an answer before retrieving real, validated figures from the connected platforms. Before showing an insight, it checks that the numbers agree across platforms. If they do not, it tells you.
Privacy by default. Automated scrubbing of personal data, explicit consent mechanisms, right to erasure workflows and transparency disclosures aligned with Article 50 of the EU AI Act.
And, above all, the organisation learns together. This is the difference that rarely appears on a product sheet. Because every question starts from the same data layer and the same definitions, built through the five stages of IDIRA®, Integration, Data Collection, Insights, Reports and Artificial Intelligence, the answer your sales director receives rests on the same assumptions as the answer given to the media team. Knowledge stops being a closed browser tab. It becomes a shared asset.
9. What is really at stake
The gap that McKinsey, MIT and BCG describe does not close by buying more licences. It closes when AI starts working on governed data, common definitions and known rules.
The alternative is already happening in many companies. Dozens of tools, none approved, data crossing borders with no record, internal applications built without security review, and a set of brilliant answers that never turn into shared knowledge.
Compliance is not the brake in this race. It is the chassis that lets you go fast without leaving the road.
Want to see how this looks in your case?
Discover IDIRA.chat or talk to us at ittechbuz.com/contactos.
Sources
- McKinsey & Company, The State of AI in 2025: Agents, innovation, and transformation, November 2025. View report
- MIT Project NANDA, The GenAI Divide: State of AI in Business 2025, July 2025. View PDF
- Boston Consulting Group, The Widening AI Value Gap: Build for the Future 2025, September 2025. View publication
- Boston Consulting Group, AI Radar 2026: As AI Investments Surge, CEOs Take the Lead, January 2026. View publication
- Gartner, Gartner Predicts 40% of AI Data Breaches Will Arise from Cross-Border GenAI Misuse by 2027, February 2025. View press release
- Gartner, employee survey on the use of personal generative AI accounts, May to November 2025, and forecast on software defects by 2028. Data cited in OX Security
- Veracode, 2025 GenAI Code Security Report. View report and 2026 update
- GitGuardian, State of Secrets Sprawl 2026, March 2026. View report
- Cloud Security Alliance, research notes on vulnerabilities in AI generated code, including data from Georgia Tech’s Vibe Security Radar, April 2026. View note
- Regulation (EU) 2024/1689, EU AI Act. View official text. Analysis of the Digital Omnibus on AI and the revised timetable: Gibson Dunn and DLA Piper
- European Data Protection Board, 2026 coordinated enforcement action on transparency and information obligations. View announcement
