The following framework allows leadership to benchmark their organization across five distinct stages. Each level is assessed across four dimensions: Usage (who is using AI and how broadly), Sophistication (what types of tasks AI handles), Governance (what controls and policies are in place), and Infrastructure (what technical foundations support AI operations).
The table below provides a quick-reference overview. The narrative that follows focuses on the critical transitions where organizations most commonly stall.
(FIGURE: AI Maturity Staircase – Five-level progression diagram showing Levels 0-4 with the two critical transition points (L0-to-L1 and L2-to-L3) highlighted as chasms. Design team to create.)
Level 0: Awareness (The “Shadow AI” Stage)
Most enterprises have employees operating at this level, whether leadership realizes it or not. Individuals use personal accounts on public AI services with no organizational visibility into what tools are being used, by whom, or with what data. Usage is limited to simple, standalone tasks such as information retrieval, text summarization, and draft writing, with no policies, no audit trails, and no integration with enterprise systems.
This is the most dangerous stage, because the organization bears all the risks of AI adoption (data leakage, compliance exposure, ungoverned decision-making) while capturing none of the strategic benefits. As Cyberhaven’s research shows, the question for most enterprises is not whether Shadow AI exists within their walls, but how much.
The First Critical Transition: From Shadow AI to Sanctioned Pilots (Level 0 to Level 1)
Moving from Level 0 to Level 1 is primarily a leadership and policy challenge, not a technology one, and the shift requires three things:
Visibility. The organization must first understand the scope of unsanctioned AI usage. This means auditing what tools employees are using, what data they are sharing, and where the highest-risk exposure points are.
Sanctioned alternatives. Employees use Shadow AI because it makes them more productive. Banning AI without providing a sanctioned alternative simply pushes usage further underground. The organization needs enterprise-tier instances that offer the same productivity benefits with appropriate data controls.
Baseline governance. A registry of approved tools, basic usage policies, and light monitoring. These do not need to be comprehensive at this stage, but they need to exist.
Critically, this transition is as much about change management as it is about policy.
Employees hide AI usage because they fear it will be taken away or because they worry about being seen as replaceable. Leadership needs to reframe the narrative on AI adoption as a strategic priority, not a threat to anyone’s role. Executive sponsorship, internal champions who can model productive AI use, and clear communication that AI is meant to augment rather than eliminate positions are what turn a policy announcement into an actual shift in behavior.
Level 1: Experimental (The Pilot Stage)
At this level, usage shifts from scattered individuals to isolated teams. Marketing tests a copy-generation tool, IT experiments with code assistance, and customer support pilots a chatbot. These experiments are sanctioned but siloed.
The sophistication remains limited. AI handles individual tasks within a department but does not connect to other systems or workflows. Governance is reactive, written in response to incidents rather than designed proactively. Infrastructure plugs the most immediate data leakage risks through enterprise-tier SaaS, but deep integration with business systems is still missing.
The Trap. This is where “pilot purgatory” begins. IDC’s finding that 88% of AI POCs fail to reach production happens primarily at this level. The organization runs interesting experiments but lacks the infrastructure and governance to move any of them into production workflows. Each pilot is built independently, creating technical debt that compounds over time. AI has a champion, usually a mid-level leader or innovation team, but it is not yet a C-suite strategic priority.
Level 2: Operational (The Integration Stage)
Level 2 is where AI transitions from novelty to business tool, and where organizations first capture real, measurable ROI. Agentic AI workflows are deployed across multiple business functions such as customer support triage, HR onboarding automation, invoice processing, and anomaly detection. Usage is measured and tracked.
This is where agentic workflows first appear. AI systems handle multi-step tasks that span multiple tools and data sources. Human-in-the-loop (HITL) protocols are standard for any decisions with meaningful business impact. The AI proposes and executes while a human reviews and approves at defined checkpoints.
Governance formalizes at this stage. Role-Based Access Control (RBAC) is enforced so that an AI agent handling HR data cannot access financial systems, and vice versa. Compliance checks run automatically, and usage logs capture what each agent does, what data it accesses, and what decisions it makes.
The critical architectural shift happens here and requires the introduction of an orchestration layer. Rather than deploying AI as standalone chat interfaces, the organization builds middleware that connects AI models to enterprise systems, from legacy databases and procurement platforms to ticketing systems and document repositories, allowing agents to fetch real-time data, execute actions, and maintain business logic within the organization’s own infrastructure.
This is where legacy system integration becomes a real obstacle. Most enterprises run core operations on ERP and CRM platforms that are 10 to 20 years old, with custom configurations, outdated APIs, and fragile integrations that were never designed to support real-time AI interaction. The orchestration layer must bridge that gap without requiring a full replatforming effort, connecting modern AI capabilities to the systems the business actually runs on, not the systems it wishes it had.
In Practice: JPMorgan Chase deployed its LLM Suite across 200,000 daily users with over 450 use cases in production, spanning operations, risk management, and client services. The bank’s investment in orchestration infrastructure, connecting AI models to internal systems under formal governance, is what enabled deployment at that scale rather than remaining a collection of isolated pilots.
Deloitte reports that companies achieving this integration stage see 26-55% productivity gains. However, it is also where the hardest transition begins.
The Second Critical Transition: From Departmental to Enterprise-Wide AI (Level 2 to Level 3)
This is the hardest transition in the framework, and the one where most organizations stall. BCG’s research confirms the scale of the challenge: 60% of companies are “laggards” generating no material AI value, 35% are “scalers” with pockets of success, and only 5% are “future-built” with AI capabilities embedded across the organization.
The gap between Level 2 and Level 3 is not a technology problem but an organizational one. Level 2 succeeds because individual teams can deploy AI within their own domain, using their own data, under their own oversight. Level 3 requires something fundamentally different: AI systems that operate across departmental boundaries, share data and context, and coordinate actions at scale.
This transition demands changes in governance (from departmental policies to organization-wide frameworks), infrastructure (from standalone integrations to resilient, scalable platforms), and culture (from team-level champions to leadership-driven strategy). The orchestration chasm between these levels is significant enough to deserve its own dedicated analysis, which will follow in the next installment of this series.
In Practice: Klarna deployed an AI customer service agent that handled the equivalent of 853 full-time agents and projected $60M in annual savings. But customers complained about generic answers and an inability to handle nuanced questions, and the company reintroduced human oversight to manage complex cases. This illustrates exactly why the jump from departmental deployment (Level 2) to enterprise-wide scaling (Level 3) demands more than just technology. Governance, quality frameworks, and workforce planning must scale alongside the AI itself. Klarna’s initial approach displaced hundreds of support roles without a clear plan for how the remaining staff would handle the complexity that AI could not, and the quality gaps that followed were a direct consequence.
Level 3: Systemic (The Scaling Stage)
At Level 3, AI is mission-critical, and if the AI systems went offline, the business would experience meaningful disruption. Multi-agent systems coordinate complex tasks autonomously. Rather than a single AI handling one workflow, specialized agents collaborate: one agent handles data retrieval, another handles analysis, a third handles execution, and an orchestrator coordinates them. Human oversight shifts from approving individual decisions to monitoring system performance and handling exceptions.
Governance operates continuously where organization-wide policies address bias, hallucination, and adversarial attacks. Automated quality control systems, such as “LLM-as-a-judge” evaluations, verify agent outputs at scale. The infrastructure becomes resilient, including self-hosted LLMs for sensitive data that cannot leave the organization, vector databases for long-term organizational memory, and enterprise-grade observability tools that monitor every agent decision for debugging and performance optimization.
Leadership drives AI strategy at this level, continuous upskilling programs are standard, and the organization thinks “AI-first” when designing new processes and workflows.
Level 4: Transformative (The AI-Native Stage)
Very few organizations operate at Level 4 today. McKinsey reports that only about 1% of organizations feel they have achieved true AI maturity. This level represents a strategic aspiration, included in the framework to show the direction of travel and help organizations make architectural decisions today that will not block them from reaching it in the future.
At this level, AI drives strategy, and the business model shifts to capitalize on capabilities that AI makes possible. Adaptive agent ecosystems operate with minimal human intervention for routine operations, while humans focus on strategic decisions, exception handling, and system improvement. Governance becomes dynamic and real-time, with compliance automated and continuous. The technology stack is fully AI-native, with federated learning enabling collaboration across business units without centralizing sensitive data, and edge computing bringing AI capabilities closer to the point of action.
For the organizations that reach this level, AI transitions from a cost-optimization tool to a revenue engine. BCG’s research found that “future-built” companies are creating new revenue streams, redefining their industry positioning, and building competitive moats that widen over time.
Progressing Through the Framework
The path from one level to the next is not purely technical; each transition requires a different combination of governance, infrastructure, and cultural change. Moving from Level 0 to Level 1 is primarily a leadership decision: audit Shadow AI usage, provide sanctioned alternatives, and establish baseline policies. The shift from Level 1 to Level 2 is an integration challenge, connecting AI tools to enterprise systems through an orchestration layer and formalizing human-in-the-loop protocols so that agentic workflows can operate reliably within a single department. The hardest leap, from Level 2 to Level 3, is organizational rather than technical; it requires cross-functional data sharing, enterprise-wide governance frameworks, and executive sponsorship that treats AI as core infrastructure rather than a departmental experiment. Reaching Level 4 demands a strategic reinvention where AI capabilities reshape the business model itself.
At every stage, the common thread is that the technology is rarely the bottleneck. Harvard Business Review’s research on organizational barriers to AI found that the dominant factor separating companies that scale AI from those that stall is not integration or budget, but organizational design: culture, resistance to change, and rigid workflows derail initiatives even in companies with advanced tooling. Cloud Security Alliance’s State of AI Security and Governance report reinforces this finding, showing that governance maturity is the single strongest predictor of enterprise AI readiness. The organizations that advance are the ones that invest equally in the governance, workforce readiness, and process redesign that allow AI to operate safely and at scale.
What Comes Next
Where does your organization sit today? Identifying your current level is the starting point, not the destination.
The next post in this series breaks down the hardest question: how do you actually cross the orchestration chasm between Level 2 and Level 3, where most enterprises stall? It covers the specific infrastructure, governance, and organizational changes required to move from departmental AI successes to enterprise-wide systems that operate reliably at scale.
