What is an AI maturity model?
An AI maturity model answers the question “Where do we stand with AI?” with a finding instead of a gut feeling.
It breaks AI adoption into dimensions, describes observable stages for each one and so shows where a company stands and what the next step is.
Road.MAP for AI is the maturity model I developed at Storm Reply together with colleagues. It started from an analysis of seven existing maturity models. Three findings surprised us: none of them has a cost dimension, none has an agentic target stage, and none separates organisational maturity from process suitability. Methodologically the model rests on ten scientific frameworks, from which around 150 questions are derived.
AI amplifies what is already there – but only in one direction. If you are far ahead on the accelerators and lag behind on the guardrails of governance, security and cost steering, you don’t get the average – you get harm at the speed of your strongest dimension.
That is the reading rule the whole model revolves around. The reverse is not risk but idle capacity: strong guardrails with little actual use are not maturity, they are its absence.
The five stages of AI maturity
- Experiment – individuals try AI on their own initiative, often on private accounts. The organisation does not know about it and steers nothing.
- Pilot – policy, budget and use cases are decided, but none of it is enforced technically. This is the stage where most organisations get stuck.
- Controlled Rollout – the rules take effect in the system: only approved models, enforced permissions, budgets and an owner per use case.
- Scaled Operations – measured, charged back, auditable. For most organisations this is the right target in the dimensions their use cases need.
- Agentic Organization – new use cases and governance evidence arise from running operations, agents act in settled permission chains. This stage presupposes agentic operation.
The hardest line runs between stage 2 and stage 3, between “decided” and “enforced”. Everything is decided, nothing is enforced: that is stage 2 in one sentence. Stages apply per dimension. A company is not at one stage but at nine, and rarely at the same one.
Each stage describes a state, not an activity. A training session that took place is an activity; whether the organisation works differently three months later is a state. Only states can be checked.
The nine dimensions
The dimensions are cut along the Technology–Organization–Environment framework1. Two concern the environment (Strategy & Portfolio, Governance & Legal), three technology (Infrastructure & Permissions, Security & Risk, Knowledge & Data) and four the organisation (Cost & Steering, Organization & Enablement, Culture & Change, Processes & Value Contribution). Each dimension has a guiding question and, for each stage, an anchor that lets you recognise your own stage2:
| Dimension | Stage 1 Experiment | Stage 2 Pilot | Stage 3 Controlled Rollout | Stage 4 Scaled Operations | Stage 5 Agentic Organization |
|---|---|---|---|---|---|
| Strategy & PortfolioWhat is the company using AI for – and who decided? | No target picture; whoever has an idea tries it out. | Statements of intent and a list of ideas, but no joint decision and no selection grid. | Target picture formulated, candidates rated for value and feasibility. | Target picture agreed and linked to business goals, portfolio steered in a standing review. | Target picture and portfolio continuously sharpened from market and operational data. |
| Governance & LegalWho may do what, with which model, under which rule? | No binding rule in place. | Use policy adopted and communicated. | Only approved models are technically reachable. | Every production use case is classified and auditable. | Rules exist as code, evidence is produced automatically. |
| Infrastructure & PermissionsHow does AI run – technically, securely and across the whole company? | Use through SaaS front ends only, no integration. | First connection to individual systems, access via shared keys. | Central platform with SSO and server-side authentication. | The agent acts on behalf of the user and inherits their rights. | Agent-to-agent with an unbroken permission chain. |
| Security & RiskWhat happens when things go wrong – and would anyone notice? | No risk view; inputs reach third parties unchecked. | Risks are named, controls are missing. | Injection and leakage controls take effect technically. | AI activity logged, incident process rehearsed with an AI scenario. | Red teaming and attack detection run in production. |
| Knowledge & DataWhat does the AI draw on – and at what quality? | Context arrives by copy and paste. | A single source is connected; everything else comes by hand. | Several sources via connectors, permission-aware. | Company-wide knowledge base (knowledge hub) with a source register; quality is measured. | Knowledge is available as a service to people and agents. |
| Cost & SteeringWhat does AI cost, who is accountable for it, how is it capped? | Costs are unknown. | Budget is set but not steered. | Cost per use case is visible, limits bite technically. | Costs are charged back per use case and user. | Cost-benefit steering runs automatically at runtime. |
| Organization & EnablementWho can handle it – and who owns running it? | Lone enthusiasts, nobody is accountable. | Voluntary sessions, accountability unsettled. | Learning paths per role, owners per use case. | Binding curriculum, operating model in place. | Learning and ownership sustain themselves in operations. |
| Culture & ChangeAre people taking up AI – and who clears the resistance out of the way? | Mood unknown, worries circulate unmanaged. | Worries are known, support is sporadic. | Change support per rollout, leaders visibly use AI. | Standing change programme, adoption measured and steered. | Change carries itself, the workforce asks for AI. |
| Processes & Value ContributionWhich processes does AI improve – and how does anyone know it pays off? | Isolated experiments, value merely asserted. | Candidates named, processes unchanged, benefit not measured. | Processes assessed systematically, targets per case, operating path defined. | Processes redesigned, benefit measured per case. | Cases arise from process data, benefit tracked continuously. |
Catalogue 3.0 added Strategy & Portfolio: what the company uses AI for, who decided that and how much risk it is willing to take. Use Cases & Value Contribution became Processes & Value Contribution, because the difference lies in whether processes are redesigned for AI or merely sped up.
Organization & Enablement and Culture & Change started out as one topic. We split them because they answer two different questions: whether people can work with AI, and whether they want to. A team can be perfectly trained and still work around the tool.
Why a profile instead of a single score?
An example: 3.4 out of 5 sounds like solid AI maturity. The profile behind it shows four dimensions in scaled operations, but Governance & Legal stuck at stage 2. The policy is adopted, but it lives in a document, not in the technology. The organisation can scale AI technically but has no enforceable framework for it.
The average smooths away exactly the imbalance that matters. What counts is where the bottleneck lies. Three dimensions set the guardrails: Governance & Legal, Security & Risk and Cost & Steering. A bottleneck there raises the risk of harm through legal breaches, security incidents or costs, and the faster the other dimensions move, the more it does. The other six accelerate. A bottleneck among them slows things down and, in case of doubt, leaves capacity idle. The goal is speed with guardrails.
That is why the model also caps a dimension: it cannot be at stage 4 if one of its core questions is at stage 2.
The goal is not stage 5
Next to the current state, the AI Readiness Profile, stands the target, the AI Target Profile. It depends on industry, regulation, risk appetite and the planned use cases. Two examples: an insurer with agents in its core process needs Governance & Legal and Security & Risk at stage 4 before the first agent works in production. A machine builder with internal knowledge search gets by with stage 3 there, but benefits from stage 4 in Knowledge & Data, Infrastructure & Permissions and Processes & Value Contribution.
The Road.MAP is the path from the current state to the target. The model describes it in 146 building blocks across all dimensions and stages, such as “enforce access through a central gateway” or “bring co-determination to the table early”. Which building blocks are due follows from the gap between current state and target; their order follows dependencies and benefit. That order is the actual strategic decision.
How software vendors (ISVs) use a Road.MAP to tackle the cloud journey and the AI journey together is shown in the article ISVs on Two Journeys: Cloud and AI with One Road.MAP.
How is maturity assessed?
- AI Readiness Pulse Check: 18 questions, two per dimension, 10 to 15 minutes, online at ki-reifecheck.de3. The result is a first estimate, not an assessment.
- 360° AI Readiness Assessment: around 150 questions to nine roles, from executive leadership through IT & platform and process owners to employee representatives. Each role only answers what it can judge. It runs in five steps: kick-off and scoping, survey of the roles, evaluation, target workshop and prioritised Road.MAP.
- Behaviourally anchored answers: every core question has five observable state descriptions instead of a number scale. The chosen option is the stage.
- Evidence requirement: from stage 3, a rating only counts if a nameable artefact exists – a policy, a dashboard, a log, a role description. Without evidence, the rating is capped at stage 2. Conversations are not evidence.
- Perception gaps: if answers to the same question differ by two stages or more, that is a finding in its own right, from three stages a risk. Averaging only happens afterwards.
An example of such a gap: executive leadership sees Culture & Change at stage 4, the licences are rolled out. IT & platform also sees stage 4, its own team uses AI every day. The process owners see stage 1, because nobody has talked to their team about what AI means for their own work. None of the three ratings is wrong. That is exactly where the Road.MAP starts.
Why the organisation is the larger part of the work is the subject of the German article Menschen und Agenten als ein Team: Warum KI-Einführung vor allem Change-Management ist.
The methodological foundation
The model is not made up. Its central design decisions rest on established frameworks:
- Dimensions along the Technology–Organization–Environment framework1.
- Stage logic following CMMI4 and ISO/IEC 155045 (SPICE, now ISO/IEC 330xx): a stage only counts once its characteristics are met.
- Answer scales as Behaviourally Anchored Rating Scales6.
- Acceptance and culture via UTAUT/TAM (Venkatesh et al., 20037; Davis, 19898) and psychological safety9.
- Building blocks for Culture & Change in the order of ADKAR10; Kotter’s model11 serves to diagnose missing elements.
- Prioritisation of current state and target as an importance-performance analysis12.
- Evidence requirement from stage 3 as protection against flattering self-assessments.
- Perception gaps as a finding, methodologically related to agreement between raters (Cohen, 196013; Shrout & Fleiss, 197914).
- Governance and security cut against the EU AI Act15, ISO/IEC 4200116 and the NIST AI RMF17 – so that stages 3 to 5 are designed to connect to audits.
The limits are part of it: the question batteries lean on validated scales but are not validated in this combination themselves. Self-assessment remains self-assessment; the evidence requirement mitigates that but does not replace an external audit. And stage 5 is hard to evidence in practice because too few organisations are there. Its anchors are constructed, not observed.
And software development?
Software development has its own map: how far may AI agents work autonomously in each step, and how far does verification carry? The guiding principle there: autonomy only as far as verification carries. More on the Agentic Engineering topic page.
Frequently asked questions about AI maturity
What is Road.MAP for AI?
Road.MAP for AI is a maturity model for adopting AI in companies. It rates nine dimensions – Strategy & Portfolio, Governance & Legal, Infrastructure & Permissions, Security & Risk, Knowledge & Data, Cost & Steering, Organization & Enablement, Culture & Change, and Processes & Value Contribution – on five stages each. It was developed by Dr. Sven Seiler at Storm Reply, together with colleagues.
What are the stages of AI maturity?
Five: Experiment, Pilot, Controlled Rollout, Scaled Operations and Agentic Organization. Stages apply per dimension, so a company has nine stages, not one. The biggest hurdle lies between stages 2 and 3, where decided rules become technically enforced ones.
Why is there no overall score?
Because an average hides exactly the imbalance that is the problem. If the bottleneck lies in the guardrails of Governance & Legal, Security & Risk or Cost & Steering, the risk of harm rises. If it lies in one of the six accelerating dimensions, it slows things down. The result is therefore a profile across nine dimensions.
Does every company need to reach stage 5?
No. For most organisations, stage 4 is the right target in the dimensions their use cases need. Stage 5 presupposes agentic operation. That is why the assessment captures the target as well as the current state: the AI Target Profile.
How does Road.MAP for AI differ from other AI maturity models?
Three things were missing from all seven models we analysed: a dimension of its own for cost and steering, an agentic target stage, and the separation of organisational maturity from process suitability. On top come the evidence requirement from stage 3, the survey of several roles and the absence of an overall score.
What is the 360° AI Readiness Assessment?
The full survey for Road.MAP for AI: around 150 questions to nine roles, from executive leadership to employee representatives. The result is the AI Readiness Profile (current state), the AI Target Profile (target), the perception gaps between the roles and a prioritised Road.MAP.
How is AI maturity assessed?
For orientation with the AI Readiness Pulse Check of 18 questions (10 to 15 minutes), in full with the 360° AI Readiness Assessment. From stage 3, a rating only counts with evidence, meaning a nameable artefact such as a policy or a dashboard.
Sources
- Tornatzky, Louis G.; Fleischer, Mitchell: “The Processes of Technological Innovation”, Lexington Books, Lexington (MA), 1990. ISBN 0-669-20348-3. openlibrary.org
- Storm Reply: “Das Reifegradmodell: neun Dimensionen, fünf Stufen” (The maturity model: nine dimensions, five stages), Road.MAP for AI, ki-etablieren.de (German). ki-etablieren.de
- Storm Reply: “KI-Reifegrad-Check”, AI Readiness Pulse Check for Road.MAP for AI, ki-reifecheck.de (German). ki-reifecheck.de
- CMMI Product Team: “CMMI for Development, Version 1.3” (CMU/SEI-2010-TR-033), technical report, Software Engineering Institute, Carnegie Mellon University, 2010. DOI: 10.1184/R1/6572342.v1. doi.org
- ISO/IEC: “ISO/IEC 15504-2:2003 Information technology — Process assessment — Part 2: Performing an assessment”, standard, 2003 (withdrawn; superseded by the ISO/IEC 330xx series). iso.org
- Smith, Patricia C.; Kendall, Lorne M.: “Retranslation of expectations: An approach to the construction of unambiguous anchors for rating scales”, Journal of Applied Psychology 47(2), pp. 149–155, 1963. DOI: 10.1037/h0047060. doi.org
- Venkatesh, Viswanath; Morris, Michael G.; Davis, Gordon B.; Davis, Fred D.: “User Acceptance of Information Technology: Toward a Unified View”, MIS Quarterly 27(3), pp. 425–478, 2003. DOI: 10.2307/30036540. doi.org
- Davis, Fred D.: “Perceived Usefulness, Perceived Ease of Use, and User Acceptance of Information Technology”, MIS Quarterly 13(3), pp. 319–340, 1989. DOI: 10.2307/249008. doi.org
- Edmondson, Amy: “Psychological Safety and Learning Behavior in Work Teams”, Administrative Science Quarterly 44(2), pp. 350–383, 1999. DOI: 10.2307/2666999. doi.org
- Hiatt, Jeffrey M.: “ADKAR: A Model for Change in Business, Government and Our Community”, Prosci Research, 2006. ISBN 978-1-930885-50-9. openlibrary.org
- Kotter, John P.: “Leading Change”, Harvard Business School Press, 1996. ISBN 0-87584-747-1. openlibrary.org
- Martilla, John A.; James, John C.: “Importance-Performance Analysis”, Journal of Marketing 41(1), pp. 77–79, 1977. DOI: 10.1177/002224297704100112. doi.org
- Cohen, Jacob: “A Coefficient of Agreement for Nominal Scales”, Educational and Psychological Measurement 20(1), pp. 37–46, 1960. DOI: 10.1177/001316446002000104. doi.org
- Shrout, Patrick E.; Fleiss, Joseph L.: “Intraclass Correlations: Uses in Assessing Rater Reliability”, Psychological Bulletin 86(2), pp. 420–428, 1979. DOI: 10.1037/0033-2909.86.2.420. doi.org
- European Parliament and Council: “Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)”, OJ L, 2024/1689, 12 July 2024. eur-lex.europa.eu
- ISO/IEC: “ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system”, standard, 2023. iso.org
- National Institute of Standards and Technology (Tabassi, Elham): “Artificial Intelligence Risk Management Framework (AI RMF 1.0)”, NIST AI 100-1, 26 January 2023. DOI: 10.6028/NIST.AI.100-1. doi.org
