Enterprise AI adoption: how a large company catches up on AI

In the two weeks from 5 to 18 October 2026, 24.6% of US businesses told the US Census Bureau that they had used artificial intelligence (AI) in a business function [1]. Among businesses with 250 or more employees, the share was 43.6% [1]. That large-firm figure moves more from one survey period to the next: the three periods before read 36.5%, 44.0% and 38.4% [1].

This guide is for an executive at a large company that wants to catch up on AI. Competitors may be announcing AI products, staff may already use chat tools with no rules, and the board may have asked for a plan. The guide covers what the official numbers say, what the rules require as of 26 October 2026, how to pick the first work, how to make it safe, and how to measure what it returns. Each part links to a page that goes deeper.

A note on the name. Executive Order 14434, signed on 29 September 2026, tells US executive agencies to write "Super Intelligence" and "SI" in place of "Artificial Intelligence" and "AI" [2]. Because of that order, the Census Bureau now calls its AI figures "Super Intelligence" or "SI", from 22 October 2026 [3]. Its survey question asked about "Artificial Intelligence (AI)" until the collection that began on 19 October 2026, and every Census figure in this guide was collected before then, so this guide says AI [3].

Where large companies stand

Each country measures AI use in its own way. The US survey asks about the last two weeks, Canada's asks about the last 12 months, and the European and British surveys count businesses of different sizes. Read each figure with its question and its date.

Area	Who is counted	Share using AI	Period	Source
United States	Businesses with 250 or more employees	43.6%	5 to 18 October 2026, last two weeks	Census Bureau [1]
United States	All businesses in the survey	24.6%	5 to 18 October 2026, last two weeks	Census Bureau [1]
European Union	Enterprises with 250 or more employees	55.03%	2025	Eurostat [4]
European Union	Enterprises with 10 or more employees	19.95%	2025	Eurostat [4]
United Kingdom	Businesses with 10 or more employees	38%	September 2026	Office for National Statistics [5]
Canada	Businesses with 100 or more employees	27.8%	12 months before a survey run from 1 April to 6 May 2026	Statistics Canada [6]

The share has risen in each area. In the US, the share of all businesses using AI rose from 17.3% in the first period under the current question wording, collected 17 to 30 November 2025, to 24.6% in October 2026 [1]. In the European Union (EU), the share of large enterprises using AI went from 28.41% in 2021 to 55.03% in 2025 [7]. Eurostat surveyed 157,000 of the 1.53 million enterprises in the EU for its 2025 figures [4]. In the United Kingdom (UK), 38% of businesses with 10 or more employees used AI in September 2026, up 26 percentage points from September 2023 [5].

Other surveys give higher numbers, and the UK's Office for National Statistics (ONS) explains why: "Lower estimates tend to capture direct, bottom-up use (for example, by workers or specific business functions). Higher estimates reflect a broader, top-down view of whether firms use any AI technology across their operations" [8]. A question about any AI use anywhere in a firm counts more companies than a question about use in one task.

Reveneau's view is that a large company should compare itself with the official figure for its own size and sector, and measure its own staff's use separately. The page how many companies use AI gives the figures by size and sector, with the reasons the surveys disagree.

What changed in 2026

Several rules and frameworks that a large company plans around changed in 2025 and 2026. This table gives their status as of 26 October 2026.

Rule or framework	What it covers	Status on 26 October 2026	Source
EU AI Act high-risk duties for Annex III systems	Uses such as credit scoring and the pricing of life and health insurance	Apply from 2 December 2027, moved by Regulation (EU) 2026/1744	[9]
EU AI Act Article 4, AI literacy	Staff knowledge of AI	Rewritten by Regulation (EU) 2026/1744: providers and deployers must take measures to support AI literacy	[9]
NIST AI Risk Management Framework 1.0	A voluntary US framework for managing AI risk	Being revised under the White House AI Action Plan; no revised version published	[10]
ISO/IEC 42001:2023	A management system standard for AI	Published December 2023; certification is voluntary	[11]
OWASP Top 10 for LLM Applications	The main security risks of applications built on large language models	The 2025 edition is the current list	[12]
Model Context Protocol	An open standard for connecting AI applications to data and tools	Version 2026-07-28 is the latest specification	[14]
Executive Order 14434	US government terms for AI	Signed 29 September 2026; Census labels changed from 22 October 2026	[2] [3]

NIST is the National Institute of Standards and Technology, the US agency for measurement and standards. ISO/IEC 42001 is a standard from the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). OWASP is the OWASP Gen AI Security Project, which publishes lists of common security risks. A large language model (LLM) is an AI model trained on large amounts of text, which writes text in reply to a request.

Two of these changes apply to a large company with staff or customers in the EU. Regulation (EU) 2026/1744 moved the start of the high-risk duties for Annex III systems to "2 December 2027", and for Annex I systems to 2 August 2028 [9]. The original date for Annex III systems was 2 August 2026. It also rewrote the AI literacy duty in Article 4. Providers and deployers of AI systems must now "take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf", and the new text says the duty "does not require providers or deployers to guarantee any specific level of AI literacy of any individual" [9]. A deployer is an organisation that uses an AI system under its own authority, so a company that gives its staff an AI tool is a deployer of that tool. The page AI training for staff covers the new duty, and AI governance for a large company covers the high-risk duties and the frameworks.

Why large companies hold back

Eurostat, the EU's statistics office, asks enterprises that considered AI and did not use it why. For enterprises with 250 or more employees, the database gives these shares for 2025 [7].

Reason given for not using AI	Share of large EU enterprises that considered AI, 2025	Where this guide covers it
Lack of relevant expertise	65.11%	AI training for staff
Concerns about data protection and privacy	58.76%	AI security risks
Unclear legal consequences	51.22%	AI governance
Availability or quality of data	43.81%	Getting company data ready
Incompatibility with existing equipment, software or systems	37.99%	Connecting AI to older systems

Lack of expertise leads the list, and each of the other reasons has its own page in this guide. The figures describe large EU enterprises that considered AI. A company outside the EU should read them as one survey's answer.

Choose the work before the tools

The first decision is which work AI should do. A pre-registered experiment with 758 consultants of the Boston Consulting Group (BCG), published as a Harvard Business School working paper in September 2023, found that AI's abilities are uneven: some tasks that look equally hard fall inside what AI does well and others fall outside it [13]. On a task chosen to be outside, "consultants using AI were 19 percentage points less likely to produce correct solutions compared to those without AI" [13]. On 18 tasks inside, consultants with AI finished 12.2% more tasks, 25.1% faster [13].

Reveneau's view is that each task should be tested on the company's own work before it is scaled. The page choosing your first AI use cases shows where companies use AI today and how to rank candidate uses. The page build, buy or partner covers who builds it. In 2024, 67.23% of large EU enterprises using AI bought commercial software ready to use, 34.05% developed AI in-house, and 45.76% had it developed or modified by external providers [7]. Firms could give more than one answer.

What the research says about returns

One large field study is by Erik Brynjolfsson, Danielle Li and Lindsey Raymond, published in the Quarterly Journal of Economics on 4 February 2025. It followed 5,172 customer support agents at one Fortune 500 firm that sells business-process software. Access to an AI assistant raised the number of issues resolved per hour "by 15% on average" [15]. The authors state the limit of their study: the findings "capture medium-run effects in a single firm" [15].

A study in Denmark found no change in pay or hours. Anders Humlum and Emilie Vestergaard linked survey answers to official labour market records for workers in occupations exposed to AI chatbots. They estimate no effect on earnings or recorded hours two years after ChatGPT's launch, and rule out effects larger than 2% [16]. Their paper, revised in March 2026, is a working paper of the National Bureau of Economic Research (NBER). A tool can speed up one task while total pay and hours stay the same, so the two findings fit together. The page measuring what AI returns explains how to measure your own results and why time saved is a different figure from money saved.

Making it safe

The OWASP list puts prompt injection first: an input that changes a model's behaviour in ways nobody intended [12]. NIST's 2025 report on attacks against AI says "current mitigations do not offer full protection against all attacker techniques" [17]. In Reveneau's view, a company should design each AI system on the assumption that text from outside can try to give it orders. The page AI security risks for a large company covers the controls.

Data is the second risk. A joint information sheet from the US National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and partners, published in May 2025, defines data drift as "changes in the underlying statistical properties of the input data to an operational AI system" [18]. A model that worked on last year's data can fail on this year's. See getting company data ready for AI.

Governance ties these together. NIST released its AI Risk Management Framework 1.0 on 26 January 2023, for voluntary use [10]. Its core has four functions: govern, map, measure and manage. Under the govern function, item GOVERN 1.6 asks for a way to keep an inventory of the company's AI systems [20]. ISO/IEC 42001 certification is also voluntary, and ISO says it "does not certify organizations" itself; independent certification bodies do [11].

Older systems

A legacy system is an older system that still runs important work. In a report of July 2025, the US Government Accountability Office (GAO) reviewed 69 federal legacy systems and named the 11 most in need of modernisation; their ages ran from 23 to 60 years, and eight of the 11 used outdated programming languages [19]. Those are federal systems. A private company with old software faces the same task: the AI tool has to reach data and actions that live in that software.

The Model Context Protocol (MCP) is an open protocol for connecting AI applications to outside data sources and tools [14]. The page connecting AI to older systems shows how the main model vendors' tool designs leave the company's own code in charge of each call to an old system.

Reveneau's view and where Reveneau fits

Reveneau's view is that a large company should do two or three uses well, with written tests, before it scales any of them. An eval is a written, repeatable test of an AI system's answers against cases the company chooses, and dated eval results are what show whether a use works. The guide on why AI evals matter explains them for a buyer, and the first 90 days of an enterprise AI program is a printable plan.

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code, and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. Reveneau says it uses AI instead of hiring more engineers and puts that saving into clients' prices, and that it takes responsibility for the whole project through production and after release.

For how different kinds of firms suit a large company, see an AI development partner for a large company. A fund that wants AI across several companies should read AI adoption in portfolio companies. Banks should read AI in banking. To talk about a project, see Reveneau's services or contact Reveneau.