What Is an AI Maturity Model?

An AI maturity model breaks the vague question of how good an organisation is at AI into levels and dimensions that can be evidenced. Gartner describes it as a structured framework that assesses capability across a set of pillars, identifies gaps and informs roadmaps and priorities (Gartner, checked November 2026). An enterprise AI maturity model applies that to the whole organisation, though the same structure can score a single function such as finance or marketing.

The idea comes from process improvement. CMMI, the best-known capability maturity model, runs organisation-wide maturity levels from 0, Incomplete, to 5, Optimizing, and rates capability separately within each practice area (CMMI Institute). AI maturity models keep the staged logic and swap in AI-specific dimensions.

A model is not an assessment: the model defines levels and the evidence each requires, and an assessment is the questionnaire that places you on them. To score your organisation, use the free readiness and maturity questionnaire, which rates 20 statements in six areas and maps the result to four levels, Exploring, Experimenting, Scaling and Operating. The levels below keep those names and add a fifth for the few organisations that redesign work around AI.

Level 1, Exploring. People try public chatbots and the AI features arriving inside existing software. Nobody can say how many AI tools are in use or what data goes into them, so shadow AI is the norm. Progress shows as a first usage policy and a list of the tools found.

Level 2, Experimenting. Sponsored pilots run in a few teams, often on different tools, and success depends on a handful of enthusiasts. Few pilots have a business case or a baseline. Gartner’s October 2026 CIO survey shows the cost of lingering here: only 13% of CIOs reported significant or transformational value from AI, and the likelihood of a use case succeeding was still about one in five.

Level 3, Scaling. Several systems run in production with named owners, risk tiers and approval gates, and a shared platform is replacing one-off stacks. Evaluation and cost tracking exist but are uneven. Demand from business units now outgrows a single team, which is when the AI operating model starts to matter.

Level 4, Operating. AI runs as a managed capability. Use cases are funded and reviewed as a portfolio, every live system has an owner and a review date, benefits are measured against baselines, and weak performers are stopped. In Gartner’s September 2026 survey of 1,303 respondents, organisations working this way reported positive returns on 81% of their AI initiatives, yet only 22% of organisations had scaled AI across several business units or adopted an AI-first approach.

Level 5, Transforming. Work is redesigned around what people and AI each do best, rather than AI being added to existing steps. In McKinsey’s 2026 State of AI survey of 1,719 respondents, about 6% qualified as AI high performers, and nearly three-quarters of them had fundamentally redesigned workflows, against about a quarter of other respondents.

Levels mean little unless they are scored per dimension. These six recur across published frameworks.

Strategy. Low: AI ideas compete for attention one at a time. High: a ranked portfolio tied to business goals, with a sponsor per priority and one method, such as the use case framework, for choosing what comes next.

Data. Low: the data AI needs is scattered and its access rules unclear. High: sources are catalogued, quality is measured and permissions carry through into AI answers. Gartner’s June 2025 survey found data availability and quality among the top barriers at every maturity level, named by 34% of leaders in low-maturity organisations and 29% in high-maturity ones.

Platform. Low: every project picks its own models and tooling. High: one shared platform with approved models, reusable components and separate development, test and production environments.

Governance and risk. Low: approvals happen by email, if at all. High: risk tiers, an inventory, logging, incident handling and periodic review run as routine. An AI governance maturity model grades this dimension alone, from ad hoc to continuous governance; one five-level ladder appears in our review of AI governance and compliance problems. McKinsey’s 2026 AI Trust Maturity Survey, which scores responsible AI on four levels across five dimensions including agentic AI governance and controls, found the average up from 2.0 to 2.3 but only about a third of organisations at level 3 or above for strategy, governance and agentic AI controls.

People and skills. Low: a few experts and no training plan. High: role-based AI literacy for everyone, trained builders in business units and career paths for specialists. Article 4 of the EU AI Act, as amended by the Digital Omnibus on AI in July 2026, requires providers and deployers to take measures supporting the AI literacy of their staff; a role-based training programme is the usual answer.

Value measurement. Low: benefits are estimated after go-live. High: every use case has a baseline, success metrics and a review date, and money moves between use cases on evidence; see the guide to AI success metrics.

Gartner’s current AI maturity assessment places organisations in five stages, Foundational, Emerging, Operational, Scaled and Transformational, across seven pillars: strategy, data, governance, engineering, operating model, culture, and AI product and value; the full toolkit is for Gartner clients. In its Q4 2024 survey of 432 respondents, Gartner rated each area from Level 1, planning or beginning, to Level 5, leadership, and high-maturity organisations averaged 4.2 to 4.5 against 1.6 to 2.2 for low-maturity ones.

The MITRE AI Maturity Model (November 2023) scores six pillars, from ethical, equitable and responsible use to performance and application, through 20 dimensions on five levels: Initial, Adopted, Defined, Managed and Optimized. MITRE says each level depends on meeting the benchmarks of the previous one, and that each pillar’s target should follow the organisation’s mission, resources and business practices. It is licensed for internal, non-commercial use, and MITRE supplies its multiple-choice assessment tool on request.

MIT CISR’s enterprise AI maturity model (Weill, Woerner and Sebastian, December 2024) has four stages: Experiment and Prepare (28% of the enterprises studied), Build Pilots and Capabilities (34%), Develop AI Ways of Working (31%) and Become AI Future Ready (7%). Drawing on a 2022 survey of 721 companies and 16 executive interviews in 2024, it links maturity to money: growth ran 12.6 percentage points below industry average at stage 1 and 17.1 above it at stage 4, and profit 9.6 below and 10.4 above.

People also search for a NIST AI maturity model, but the AI RMF has no levels: it describes outcomes under Govern, Map, Measure and Manage and compares a Current Profile with a Target Profile to find gaps, which suits the governance dimension of a wider model.

Treat the overall level as a summary and the dimension scores as the plan. The weakest dimension sets the pace: with level-4 data and level-2 governance, every new use case still waits for approval. Fix the lowest dimension in front of your next important use case first.

Exploring to Experimenting: publish a usage policy, start the inventory and run one or two pilots with measured baselines. Experimenting to Scaling: add risk tiers, approval gates and rules for stopping pilots, and move new use cases onto a shared platform. Scaling to Operating: fund use cases as a portfolio, measure benefits against baselines and give every system an owner and a review date. Operating to Transforming: redesign end-to-end workflows around people and agents rather than single tasks.

Score with evidence, not opinion: ask for the policy, inventory extract, evaluation report or benefit review behind each answer. Re-score every six to twelve months, set a target level per dimension instead of aiming for level 5 everywhere, and turn each gap into dated work in your AI roadmap.

Maturity with chat assistants says little about systems that act, so agents need a scale of their own. University of Washington researchers Feng, McDonald and Zhang define five levels of agent autonomy by the role left to the user. As operator, the user drives and the agent acts on request; as collaborator, both plan and do the work; as consultant, the agent leads and asks for feedback; as approver, it runs largely alone and asks for sign-off on consequential steps; as observer, the user only watches the logs and holds an emergency off-switch.

Raise autonomy only when the matching controls exist for that task: evaluation results, scoped tool permissions, named reviewers, logging and a tested way to stop the agent. Gartner predicted in June 2025 that over 40% of agentic AI projects would be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls, and nearly two-thirds of respondents to the McKinsey trust survey named security and risk concerns as the top barrier to scaling agentic AI.

Adoption is moving anyway: in McKinsey’s 2026 State of AI survey, 40% of respondents from organisations with revenue above $1 billion were scaling AI agents, up from 27%, against 22% at smaller organisations. Until oversight has been tested in production, most of those agents belong at the collaborator or consultant level; see human-in-the-loop design for the checkpoints.

Levels, scope and evidence base of the main published models, checked against each publisher on 4 November 2026.