A five-level model for where AI adoption actually stands in an organisation, developed from reviewing more than 200 SME transformation projects. Maturity is a sequence, not a shopping list: understand the current level, contain the risks at that level, then climb deliberately.
AI is not yet part of the management conversation. Data, workflows and digital systems are fragmented.
Risk at this level: The business mistakes lack of AI activity for lack of AI risk.
Next disciplined move: Map workflows, data sources and the first operational friction points worth exploring.
Employees are using ChatGPT or other AI tools informally, usually without shared rules or leadership visibility.
Risk at this level: Productivity gains appear, but confidentiality, quality and accountability become unclear.
Next disciplined move: Create minimum viable governance and identify safe, approved use cases.
Leadership selects specific, low-risk use cases and gives teams basic rules, ownership and training.
Risk at this level: Pilots remain isolated if workflow, data and adoption planning are not addressed.
Next disciplined move: Score use cases by value, feasibility, data readiness and governance risk.
AI is embedded into operational workflows such as quoting, CRM, reporting, finance or customer service.
Risk at this level: Poor data quality or unclear human oversight can turn automation into faster inconsistency.
Next disciplined move: Stabilise operating procedures, improve data quality and define measurement loops.
AI is governed, measured, trained into the organisation and steered as a strategic capability.
Risk at this level: The business can become complacent if governance, training and model performance are not reviewed.
Next disciplined move: Operate AI as a managed capability with recurring review, training and strategic refresh.
These questions do not replace a full readiness assessment, but they reveal whether an organisation is still experimenting informally or beginning to build managed capability.
Likely Level 1.
Moving toward Level 2.
May be reaching Level 3.
Building Level 4 capability.
Want to score your own organisation against this model?