Contents · 10 sections↓
- 01What is an AI maturity model?
- 02How AI maturity models work
- 03The five stages of AI agent maturity
- 04When to use a maturity model (and when not)
- 05AI maturity self-assessment (copy this)
- 06Worked example: an insurer scores itself
- 07How to move up one stage
- 08Common mistakes
- 09Frequently asked questions
- 10Next steps
An AI maturity model describes how far a company has come with AI, from scattered experiments to AI agents that do real work under control. Most models online stop at chat tools and strategy slides. This one follows the path many large companies are on now, and it ends with agents in production. It gives five stages, what each stage needs, a self-assessment you can score in one meeting, and the moves that take you to the next stage.
What is an AI maturity model?
An AI maturity model is a set of stages that describes how well an organization uses AI across ownership, use cases, data, technology, controls and people. You use it to find where you are today, agree on what to build next, and avoid skipping steps. There is no single standard model. The five stages in this guide focus on AI agents: software that takes actions, not only answers questions.
Your stage is your weakest dimension, not your average. Agents in production with no audit log is not an advanced stage.
Each stage has a gate. Move on when the controls for the next stage work, not when a demo does.
Departments can be at different stages. Assess them one by one.
Most companies are early. In McKinsey's 2025 survey, about two-thirds had not yet begun to scale AI across the enterprise.
[02]
How AI maturity models work
A maturity model rates a few dimensions on the same scale and describes what each stage looks like. This guide uses six dimensions:
Ownership and strategy: who owns AI, who pays, and how use cases are chosen.
Use cases and value: what AI does and whether anyone measures the result.
Data: which data AI may use, and with whose permissions.
Platform and tools: the approved tools, and the technology agents run on.
Controls: approvals, limits, logs, reviews and incident steps.
People and skills: training, champions, builders and owners.
Several published models exist, and each is useful for a different question:
Model | Stages | Good for |
|---|---|---|
MIT CISR Enterprise AI Maturity Model (December 2024) | 4: Experiment and Prepare, Build Pilots and Capabilities, Develop AI Ways of Working, Become AI Future Ready | Linking maturity to business results. Enterprises in the first two stages had financial performance below their industry average; those in stages 3 and 4 were well above it |
Microsoft agentic AI adoption maturity model (updated 2026) | 5 levels, from 100 Initial to 500 Efficient, across five pillars | Detailed pillar guidance, especially for companies on Microsoft's agent products |
This guide | 5, from experimenting to scaled agents | A one-meeting self-assessment aimed at agents that act |
The MIT CISR survey, which mostly reflects analytical AI, put 28% of enterprises in stage 1, 34% in stage 2, 31% in stage 3 and 7% in stage 4. McKinsey's State of AI 2025 (November 2025) shows agents at an earlier point: 88% of respondents said their organizations use AI regularly in at least one business function, 23% said they are scaling an agentic AI system somewhere in the enterprise, and another 39% said they are experimenting with agents.
[03]
The five stages of AI agent maturity
Stage | What it looks like | What it needs to move on |
|---|---|---|
1. Experimenting | Individuals use chat tools, often on personal accounts. Nobody owns AI and nobody knows who uses what | An owner, approved tools and usage rules for the data you already classify |
2. Enabled | Staff have approved AI assistants with company sign-in, training and clear usage rules | One use case with a measured baseline, plus logging and identity for agents |
3. Piloting agents | One or two agents read internal data and draft work that a person checks and sends | Approvals, limits, audit logs and an owner on call, before any agent acts |
4. Agents in production | Agents act on business systems within limits: they create tickets, update records, issue small refunds | A shared platform, an agent register and a fixed review schedule |
5. Scaled and managed | Many agents on a shared platform; some run unattended on schedules and events; autonomy grows with evidence | Continuous review. Stage 5 is kept up, not finished |
Stage 1: Experimenting
You are here if staff use AI on their own and leadership can't say which tools or data are involved. The risk is company data in personal accounts. The next move is not a big strategy. Name an owner, approve one or two tools, and publish usage rules based on the data classification you already have.
Stage 2: Enabled
You are here if most staff use approved assistants with company sign-in, usage is measured, and training covers how to check AI answers for errors. The risk is a plateau: people write faster, but no process changes. The next move is to pick one workflow worth automating and measure how it performs today, so you can tell later whether an agent helped. How to roll out AI to your team covers getting here.
Stage 3: Piloting agents
You are here if an agent reads internal data, such as tickets, contracts or orders, and drafts work for a person. Tools are read-only and every call is logged, as AI agent observability describes for engineers. The risk is the "pilot that never ends": it works, but nobody trusts it enough to let it act. The next move is to build the controls an acting agent needs before you give it a single write tool.
Stage 4: Agents in production
You are here if agents change things in business systems, with approvals for risky actions, budgets, an audit log and a named owner who is reachable when something breaks. The risk is sprawl: each team builds its own agent stack with different controls. The next move is a shared platform and one agent register.
Stage 5: Scaled and managed
You are here if new agents launch on a shared platform in weeks, every agent is in the register, and autonomy grows per action, based on approval and error rates. Agents run unattended on schedules and events, inside a runtime that can limit and pause them (what is an agentic runtime?). The risk is complacency: controls nobody tests, agents nobody uses. Stage 5 needs the same reviews as stage 4, on a schedule.
[04]
When to use a maturity model (and when not)
Use one to plan a budget year, to agree on priorities between IT, security and the business, and to explain to leadership why an agent project waits for controls. It also helps compare departments with a common vocabulary.
Don't use it as a score to win, or as a reason to block a team that is ready. Don't let it replace measuring value: a high stage with no measured result is still a cost. How to measure the ROI of AI covers that part. Be careful with vendor maturity models whose top stage happens to require that vendor's product.
[05]
AI maturity self-assessment (copy this)
For each dimension, pick the highest line that is fully true today. If a line is only partly true, pick the one below it. Score with three to five people from IT, security and the business, and talk through any dimension where your answers differ.
A. OWNERSHIP AND STRATEGY
1 Nobody owns AI; individuals decide for themselves
2 A named owner and budget for AI tools; a short list of approved tools
3 Each agent pilot has a sponsor; pilots are chosen by value and risk
4 Each production agent has a business owner and a technical owner
5 Agents are funded, reviewed and retired like other products
B. USE CASES AND VALUE
1 Personal productivity only; nothing is measured
2 Usage is measured: who uses which tool, and how often
3 One or two pilots, each with a baseline and a target metric
4 Production agents report results against the baseline every month
5 Value and cost per agent reach leadership; low-value agents are retired
C. DATA
1 People paste whatever they need into whatever tool
2 Usage rules say which data classes may go into which approved tools
3 Pilot agents read internal data with the user's own permissions
4 Every data source used by agents has an owner; access is reviewed
5 Data sources for agents are documented, permissioned and monitored
D. PLATFORM AND TOOLS
1 Consumer apps and personal accounts
2 Company accounts with sign-in through our identity provider
3 Agents use read-only tools; every model and tool call is logged
4 Write tools sit behind approvals and budgets; agents can be paused
5 A shared platform with a model gateway, tool catalog and templates
E. CONTROLS
1 Nothing beyond general IT policies
2 Usage rules, a training sign-off and a list of approved tools
3 Every pilot agent is in a register; logs are kept; it can be stopped
4 Approvals for risky actions, limits, audit log, incident steps, reviews
5 Autonomy expands per action from evidence; controls are tested on schedule
F. PEOPLE AND SKILLS
1 A few self-taught enthusiasts
2 Basic training for all staff; a champion in each team
3 A small team that can build, test and fix agents
4 Owners on call for agents; approvers trained on what they approve
5 Business teams design agent workflows with the platform team
YOUR STAGE = the LOWEST of A to F
A __ B __ C __ D __ E __ F __ Stage: __Your stage is the lowest score. A dimension two or more points above your lowest is running ahead of the rest. That isn't a problem in itself, but it shows where the next investment should not go.
[06]
Worked example: an insurer scores itself
A hypothetical insurer with 4,000 staff scores itself: ownership 3, use cases 3, data 2, platform 3, controls 2, people 3. Its stage is 2, even though the claims team runs an agent pilot. The pilot is a stage 3 activity on stage 2 controls: it has no register entry, its logs are kept only by the vendor, and nobody has defined what happens if it misbehaves.
The insurer's next 90 days follow from the two lowest scores. For controls, it puts the pilot agent in a register with an owner, exports its logs to the security team and writes down who can stop it. For data, it confirms the classification of the claims document store and checks that the agent reads it with each adjuster's own permissions. Then it scores again.
[07]
How to move up one stage
Move | Do these three things | Proof you're there |
|---|---|---|
1 to 2 | Name an owner and approve tools; publish usage rules for the data you already classify; train every team | Most staff use approved tools, and personal accounts are rare |
2 to 3 | Choose one use case by value and risk; measure today's baseline; connect read-only tools with the user's identity and full logging | A pilot with a measured result against the baseline |
3 to 4 | Add approvals for write actions, budgets per run and per day, an audit log, an owner on call and incident steps | An agent acts in production and every action can be traced to a person or rule |
4 to 5 | Build a shared platform; keep one agent register with review dates; expand autonomy only from approval and error data | New agents launch on the platform in weeks, and every agent has a current review |
How to choose AI use cases helps with the step from 2 to 3. AI agent governance in practice covers the controls for 3 to 4, and enterprise AI agent architecture covers the platform for 4 to 5.
[08]
Common mistakes
Mistake | Why it fails | Fix |
|---|---|---|
Averaging the scores | The average hides the weak control that will cause the incident | Use the lowest score as your stage |
Rating the whole company at once | The best team's pilot becomes the company's stage | Assess each department or business unit separately |
Skipping stage 2 | Without approved tools, staff keep using personal accounts | Give everyone approved tools and rules before building agents |
Treating stage 5 as the goal for every process | Some work doesn't need agents at all | Set a target stage per use case |
Moving up on the strength of a demo | Demos don't test approvals, limits or incidents | Use the "proof" column as the gate |
Rating yourself generously | Optimism turns the model into a slide | Ask for evidence for every line, and include someone from security or internal audit |
[09]
Frequently asked questions
What are the stages of an AI maturity model?
This guide uses five: experimenting, enabled, piloting agents, agents in production, and scaled and managed. Other models use four (MIT CISR) or five levels (Microsoft). They share the same arc: from individual experiments, through pilots and approved tools, to AI built into how work gets done, with controls that grow at each step.
What is an AI agent maturity model?
It is a maturity model that tracks how far an organization has come with AI agents: software that takes actions such as updating records or sending messages, not only answering. Its later stages are about controls for acting agents: approvals, limits, audit logs, owners and a platform that many teams share. See what is an AI agent? for the basics.
How do you assess AI maturity?
Rate each dimension (ownership, use cases, data, platform, controls and people) against plain statements, choosing the highest one that is fully true today. Score with people from IT, security and the business, and ask for evidence. Your stage is the lowest dimension score, because the weakest area limits what you can safely do.
How long does it take to move up a stage?
There's no reliable standard figure, and it depends on company size and starting point. Plan in 90-day steps: pick the two lowest dimensions, make the changes in the "how to move up" table, and score again each quarter. Treat any fixed timeline from a vendor with caution.
Which AI maturity model should we use?
The one you'll use consistently. MIT CISR's model suits conversations about business performance. Microsoft's is detailed if you build on its agent products. This guide's model is built for a quick self-assessment focused on agents. Mixing models from one quarter to the next makes progress impossible to compare.
Can one department be at a different stage from the rest of the company?
Yes, and that is normal. A customer service team may run production agents while finance is still at stage 2. Score each one separately. Shared foundations, such as identity, logging and the platform, can't run ahead of the department that needs them most.
[10]
Next steps
Build the controls for stages 3 and 4: AI agent governance in practice.
Design the shared platform for stage 5: enterprise AI agent architecture.
Compare platforms when you get there: AI agent platform evaluation checklist.
Pick the first agent use case: how to choose AI use cases.
When agents start to act: what is human-in-the-loop AI?
Keep staff safe at stages 1 and 2: is it safe to use ChatGPT at work?