What is an AI maturity assessment?

Most businesses that feel behind on AI are not behind on tools. They have ChatGPT licences, a copilot in the CRM and someone quietly automating things in a spreadsheet. What they lack is a way to tell whether any of it is working. An AI maturity assessment is how you find out.

The short answer

An AI maturity assessment is a structured review that scores how capably your organisation adopts, governs and gets value from AI, then turns the gaps into a ranked plan. It is diagnostic rather than technical. Nobody looks at your model weights. Someone looks at whether you know which use cases pay, whether your data can support them, who is accountable when an output is wrong, and whether anyone is measuring the result.

The word maturity does the work here. It implies a path with stages, and the point of the exercise is to locate you on that path so the next step is obvious rather than aspirational.

Maturity or readiness: which one do you need

The two terms get used interchangeably, and the overlap is real, but the questions differ.

If you have never shipped an AI workflow, a readiness assessment is the honest starting point. If you already have half a dozen tools in play and cannot say which ones earn their keep, you need the maturity view. Our AI foundations engagement starts from whichever of the two describes you, because scoping the wrong one wastes the first month.

The levels most models use

Vendors publish dozens of maturity models and they mostly rhyme. Stripped back, five levels cover the ground.

1. Ad hoc. Individuals use AI tools privately. No policy, no visibility, no shared prompts. Value is real but invisible and unrepeatable.
2. Exploring. A team runs pilots. Someone is nominated to look into AI. Results are anecdotal and rarely compared against a baseline.
3. Operational. One or two workflows run in production with an owner, a documented process and a number attached. Failures get noticed.
4. Systematic. Use cases are chosen from a ranked pipeline, governance is written down, data feeds are reliable, and results roll into normal reporting rather than a special AI update.
5. Embedded. AI is a default consideration in how work is designed. Measurement, risk review and retirement of failed use cases are routine.

Two things matter more than the label. First, most Australian SMBs sit at level one or two and describe themselves as level three, because private tool use feels like adoption. Second, jumping levels rarely works. The gap between two and three is usually one owned workflow with a baseline, not a platform purchase.

What a real assessment examines

A credible assessment covers six areas. Skip any of them and the score flatters you.

• Strategy and use cases. Is there a ranked list of candidate use cases tied to revenue or cost, or a wish list? Ranking forces the trade-offs that make the rest of the plan real.
• Data. Can the data a use case needs be reached, trusted and refreshed? Most stalled projects die here, and they die quietly.
• People and skills. Who can specify a workflow, review an output and judge whether it is good? Tool access is not capability.
• Governance and risk. Who is accountable, what is logged, and what happens when the model is confidently wrong?
• Technology. Does the stack let systems talk to each other, or does every automation need a human copying between tabs?
• Measurement. Is there a baseline from before the tool arrived? Without one, every result is a story.

Measurement is where assessments most often go soft, and it is the area that decides whether anything survives contact with a budget review. If you cannot state what the number was beforehand, you cannot claim the change afterwards.

The governance bar in Australia is now explicit

This part has moved recently, and it changes what a maturity assessment should test. Australia’s National AI Centre publishes Guidance for AI adoption built around six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It comes in a foundations track for organisations early in their AI use and an implementation track for those building or customising systems, running higher-risk use cases or needing stronger controls.

That guidance evolves two earlier artefacts you may already have been pointed at: the ten guardrails in the Voluntary AI Safety Standard, and Australia’s eight AI Ethics Principles covering wellbeing, human-centred values, fairness, privacy and security, reliability and safety, transparency, contestability and accountability. Internationally the reference point is the NIST AI Risk Management Framework 1.0, released in January 2023, organised around four functions: govern, map, measure and manage.

Privacy is the one with teeth. The OAIC’s guidance on commercially available AI products, published in October 2024 and updated in January 2025, is direct about the obligations. Personal information put into an AI system can generally only be used for the purpose it was collected for. Privacy policies must say clearly that AI is in use, and public-facing tools such as chatbots must be identifiable as AI. Where AI infers personal information, that counts as collection. Accuracy obligations apply to outputs used in decisions affecting people, with human oversight expected. The OAIC’s plain recommendation is to keep personal information, especially sensitive information, out of publicly available AI tools altogether.

The practical read for a maturity assessment: accountability, an AI register, human oversight and records of testing and incidents are no longer advanced practice. They are the baseline an Australian business is expected to meet, and an assessment that does not check them is not measuring maturity.

The gap most assessments miss

There is a newer dimension that barely appears in older maturity models, and it costs businesses customers rather than compliance points: whether AI engines can find and recommend you.

Buyers increasingly ask ChatGPT, Perplexity or Google AI Overviews who to buy from, and the engines answer by naming a handful of sources. An organisation can be genuinely mature at using AI internally and completely absent from those answers. The two capabilities are unrelated, and only one of them shows up in a standard maturity grid. If your buyers research this way, a proper assessment should probe the engines with the questions those buyers actually ask and record whether you are recommended, cited, mentioned or missing. That is the work our AI visibility service covers, and it is measured rather than asserted.

How to run one without stalling

Assessments fail in two directions. Too light and you get a score with no plan. Too heavy and the assessment becomes the project, which is a comfortable way to spend a quarter without shipping anything.

A workable shape:

1. Fix the scope. One business unit or one workflow family, not the whole organisation.
2. Get a baseline first. Whatever you plan to improve, write down what it measures today, before anyone touches a tool.
3. Interview the people doing the work. The gap between the documented process and the real one is usually where the value is.
4. Rank gaps by value, not by ease. Then pick from the top of that list, accepting the harder work when the payback justifies it.
5. Name two or three next moves with owners and dates. Anything longer is a wish list.
6. Re-run it in six months. Maturity is a direction of travel, and a single reading tells you nothing about whether you are moving.

Bring an outside view to the governance and measurement sections in particular. Those are the two areas where internal assessments consistently score themselves generously, because the people scoring them designed the processes being scored.

Where to start

If you want the diagnostic without the quarter-long engagement, that is exactly what our free AI Readiness Assessment is. It runs on your own data within two business days and comes back with where you stand, the gaps that matter most, and the next two or three moves worth making. No lock-in, and if the honest answer is that AI is not your bottleneck right now, it will say so.

For the wider picture of how the work is scoped and sequenced once a direction is chosen, see AI strategy consulting.