Many organisations risk falling behind as AI overtakes traditional issues as the biggest GDPR headache and reviews lag by more than a year.