Looming Regulations, Limited Knowledge: Only 2% of Large Businesses Aware of EU AI Act, Says VinciWorks Survey

Our new survey reveals a crack in business preparedness for the upcoming EU Artificial Intelligence (AI) Act. The survey exposes alarmingly low awareness among larger organisations, with only 2% of large companies reporting a full understanding of the Act.

While the EU AI Act is not yet formally passed (expected to come into force in 2025), it’s anticipated to significantly impact organisations operating in the EU. The Act aims to regulate the development, deployment, and use of AI to ensure it’s fair, safe, and trustworthy.

Non-compliance can lead to substantial penalties, reaching up to €35 million or 7% of global turnover, whichever is higher.

Key Survey Findings: 

  • Awareness: 27% of compliance professionals globally had never heard of the EU AI Act before the survey, highlighting the need for widespread education as the Act approaches full implementation.
  • Training: 81% of companies worldwide haven’t implemented AI training, leaving them potentially vulnerable to compliance challenges.
  • Concerns: Not being prepared (38%) and not understanding the regulations (27%) are the top concerns for businesses globally.

Company Size Breakdown: 

  • Awareness: While awareness varies slightly across company sizes, all segments show a gap in knowledge and preparedness: 30% (small), 27% (medium), and 27% (large) were unfamiliar with the Act. Only 2% of respondents from large companies said they were completely aware of the Act.
  • Training: Training implementation also remains low across the board, with 84% (small), 79% (medium), and 79% (large) lacking such programmes.
  • Concerns: The biggest concerns vary by size:
    • Large enterprises (50%) are most concerned about not being fully prepared.
    • Small companies (38%) are most uncertain about their applicability under the Act.
    • Medium-sized companies (36%) are most concerned about understanding the regulations.

Geographical Breakdown:

  • UK: Compared to non-UK respondents, the UK shows slightly lower awareness, with 29% of compliance professionals unaware of the Act before the survey, and 85% having no AI training implemented. Notably, 12% have no plans for AI training. 
  • Regarding their biggest concerns, 35% of UK respondents said not being prepared, followed by misunderstanding the regulations (26%).
  • Outside the UK: While awareness remains higher than their UK counterparts, 24% were unaware of the Act. Training implementation remains low (70%), with mirrored concerns (45% not prepared, 28% regulation confusion).

“The EU AI Act marks a turning point in the global conversation on responsible AI. Artificial Intelligence has infected so many standard tools we use every day, from email servers to word processors. Everyone needs to get ahead of the AI revolution before AI runs ahead of them,” said Nick Henderson-Mayo, Director of Learning and Content at VinciWorks

“Ignoring the Act, regardless of company size and stature, could lead to serious financial and reputational consequences, and erode consumer trust. Just like the internet revolution, which brought everyone online, no business can hide from AI. Now is the time to get prepared for both the technological transition and the regulatory reaction.”

To support compliance professionals in navigating the complexities of the EU AI Act and prepare for the evolving AI regulatory landscape, we have released a comprehensive Understanding the EU AI Act free guide.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.