Where Does Your Business Stand? The AI Maturity Model Explained Stage by Stage

The Five Stages of an AI Maturity Model

Most organisations cluster in the low-middle stages, and few reach the top. MIT CISR’s Enterprise AI Maturity Model, which uses four stages, placed 28% of firms in its first stage (experiment and prepare), 34% in the second (build pilots and capabilities), 31% in the third (develop AI ways of working) and 7% in the fourth (AI future-ready), with the lower stages tracking below-industry financial performance and the top stages above it; those are MIT CISR’s four stages, and reading them against the five stages here is Synthesised.ai’s editorial crosswalk. Public models differ: Gartner’s current AI Maturity Model runs Foundational, Emerging, Operational, Scaled and Transformational, and the MITRE AI Maturity Model runs six pillars across five assessment levels. The stage count varies by author. The evidence gate between stages does not.

An AI maturity model is a staged framework that ranks an organisation’s AI adoption capability from ad hoc experiments to enterprise-wide transformation, naming the current stage and the single data or governance foundation that gates the next one.

Why Tool-First Maturity Climbing Fails

An AI maturity model gates each stage on data and governance foundations, not on tool count. An AI maturity model works like an ISO 42001 audit scope. ISO/IEC 42001:2023 sets its requirements in clauses 4 to 10, and Standards Australia’s overview of AS ISO/IEC 42001:2023 lists its normative Annex A reference controls alongside typical artefacts such as an AI risk assessment and treatment plan with a statement of applicability. Certification is voluntary and, as ISO’s ISO/IEC 42001 explainer notes, ISO does not certify organisations; independent certification bodies confirm that an AI management system meets the standard’s requirements. Stage-skipping fails because each level is gated by foundations, so buying more AI tools leaves the stage unchanged.

More than 80% of AI projects fail by some estimates, twice the failure rate of IT projects that do not involve AI, and RAND Corporation’s 2024 research into AI project failure traces the leading root causes to stakeholder misalignment on the problem first and a shortage of usable training data second, not to a shortage of tools. In MIT NANDA’s preliminary State of AI in Business 2025 report — based on roughly 300 public initiatives, 52 interviews and 153 conference-sourced survey responses, with representativeness and measurement limits the report acknowledges — 95% of the enterprise generative-AI pilots studied delivered no measurable profit-and-loss return, the pattern it calls the GenAI Divide; on Synthesised.ai’s reading, tool spend does not close that divide, foundations do. The abandonment curve is steepening too. Firms abandoning the majority of their AI initiatives before production rose from 17% to 42% year over year, and on average organisations said 46% of projects are scrapped between proof of concept and broad adoption, according to S&P Global Market Intelligence’s Voice of the Enterprise: AI & Machine Learning survey (2025) of 1,006 respondents in North America and Europe. Only 7% of firms reach the top stage in MIT CISR’s distribution, so climbing stays rare; Synthesised.ai reads these figures as pointing to a foundation gap rather than a shopping list, though the surveys do not establish governance foundations as the sole cause.

Scoring Your Stage With Evidence, Not Opinion

The scoring method runs as a fixed sequence. It inventories the data estate before any stage claim gets scored. It maps existing governance artefacts to the ISO 42001 clause set. It tests each stage gate against artefacts, not interviews. It records the verified stage and the single gate blocking the next stage.

Self-scoring inflates the stage because a claimed stage carries no evidence requirement, while an evidenced stage carries the artefact behind it. Repeatability separates the top of the market from the rest. 62% of Pacesetter organisations in Cisco’s 2025 AI Readiness Index run a mature, repeatable process for generating and scaling AI use cases, against 13% of organisations overall; Synthesised.ai’s evidence-based scoring method is a repeatable process in the same spirit, run before the next build, rather than the specific construct Cisco measured. The scoring artefact set maps onto the requirements in clauses four through ten of ISO/IEC 42001:2023 and the reference control objectives and controls in its normative Annex A, so a maturity score doubles as an input to an AI management system pre-audit. MITRE’s own assessment tool scores 20 dimensions across five levels and predicates each level on the prior level’s benchmarks, independent confirmation that maturity gets evidenced level by level, not declared.

Preventing a Relapse Into Ad Hoc Adoption

Relapse is a common risk rather than an inevitability. Organisations already report scrapping 46% of projects between proof of concept and broad adoption, and a decayed gate can reopen that same abandonment path on a system already live. The control that prevents relapse is the repeatable process the top of the market runs, 62% of Pacesetters against 13% overall, applied as a maintenance cadence rather than a one-off score. A maturity stage works as a maintained state, not a trophy, and the same evidence that proves a stage is the only thing that holds it, remove the evidence and the stage lapses regardless of which tools stay running.

How ISO 42001 and NIST AI RMF Map to Each Stage (an optional crosswalk)

This is Synthesised.ai’s optional crosswalk: ISO 42001 clauses and NIST AI RMF functions supply a useful evidence vocabulary for the stage gates here, though neither instrument assigns these maturity stages. ISO/IEC 42001 is a certifiable management-system standard whose certification is based on audit evidence; the NIST AI Risk Management Framework is voluntary and non-prescriptive, not a certifiable standard or audit scheme. Read that way, a stage claim is strongest where a clause or function is actually evidenced.

ISO/IEC 42001’s clauses map onto the maturity stages in sequence, the context and planning clauses evidence the experimenting stage, the operation clause evidences the operational stage, and the performance-evaluation and audit clauses evidence the systematic and transformational stages. NIST’s AI Risk Management Framework (AI RMF 1.0, 2023) assigns no maturity grade of its own, it organises AI risk work into four functions, GOVERN, MAP, MEASURE and MANAGE, and each function supplies the evidence a maturity stage gets scored against, MEASURE for the operational stage and GOVERN for the systematic stage. For an organisation adopting AI in Australia, Australia’s DISR Guidance for AI Adoption sets six essential practices across the AI supply chain, which DISR published on 21 October 2025 as an update that evolves and condenses the earlier Voluntary AI Safety Standard’s ten guardrails, and a governance stage names which of those practices an organisation currently evidences.

This page states that ISO 42001 and NIST AI RMF map to the maturity stages and supply their evidence vocabulary. A dedicated model extends the AI governance maturity model built specifically around the ISO 42001 path, for a governance team scoring that dimension in isolation.

From Maturity Score to Readiness Assessment

A maturity model names the stage and the blocking gate. A readiness assessment produces the scored, owner-assigned evidence that closes that gate, the method that moves a stage rather than claims one. The assessment sits as the entry gate of Synthesised.ai’s Discover, Prototype and Productionise delivery method, and the same engineers who scope the gap map build the systems that follow it.

An AI readiness assessment gates your next project with evidence before spend gets approved, and the enquiry form on that page opens the scoping conversation. See where your business stands before the next tool purchase gets made.