AI maturity model: six controls you can test in ten minutes

In this lesson you'll learn:

• the six controls and the test that proves each one;
• why a decided control scores as absent, and why the level is deliberately unweighted;
• how to run the check in ten minutes, and what to build next.

Sound familiar?#

• The maturity slide counts AI tools adopted, and the number only ever goes up.
• Every control was marked present, and the refund the cap should have stopped still went out.
• The team says it is "not ready for level four yet", as if the levels were a staircase.

The first rewards buying tools, the second scores intent, and the third mistakes a checklist for a ladder.

What is an AI maturity model?#

A way to say how safely and repeatably a team delivers with AI, and what to improve next. Most maturity models are staged ladders, in the tradition of the Capability Maturity Model's five levels. For agentic delivery that shape misleads, because the controls that matter are independent and very unequal in cost: capping a tool in its signature is an afternoon's work, while production evidence by segment takes a quarter. A team with many AI tools and no gates is less mature, ships less safely and costs more than a team with one tool and tight control.

Run the check, step by step#

Step 1 · Score each control by running its test#

Every test is something you run, not something you recall. Tick only what could be shown to you in ten minutes. Run the self-check

Step 2 · Mark a decided control as absent#

Decided is not enforced. At SkyWays, this manual's fictional airline, the refund cap was decided, written into the autonomy record and repeated in the system prompt, so control 4 was marked present. On day 82 a $2,000 refund went out that was not owed, because the refund tool's signature accepted any amount. The test exists to catch exactly this.

Step 3 · Read the list, not the number#

The level is the count, deliberately unweighted, so that it cannot be argued about. The price is that a team can score four with the two hardest controls missing, so report which controls are missing, not only how many.

Step 4 · Build the next control, and only that one#

The next control to build is the first one missing from the list. Name an owner, a date and the test you will run on that date. Six improvement actions at once produce none.

Step 5 · Re-run it every quarter, and expect the score to fall once#

Controls decay: a context file goes stale, a new tool is added without a cap, a harness check is switched from required to optional during a crunch. A score that only ever rises is not being measured.

Where you'll use it#

• Every quarter, per team, in ten minutes.
• When a board asks how mature the organisation is: answer with a number out of six and the next control, not with a tool count.
• Before widening an agent's use, where controls 4 to 6 are the ones that matter.

Why it matters#

Adoption metrics reward buying tools; this rewards controlling them. Each of the six maps to a failure this tutorial covers: an uninformed agent, an unmeasured bar, a regression hidden in an average, a cap talked past, a leak in a log, drift nobody saw. So the score is a count of failures a team has closed.

Key takeaways#

1. Count controls, not tools: six of them, each present or absent.
2. Score by running the test: decided is not enforced.
3. Build the first missing control, one at a time, and re-run the check every quarter.

FAQ#

What is an AI maturity model?#

A structured way to assess how safely and repeatably an organisation delivers with AI, and what to improve next. This one counts six enforced controls rather than tools adopted or stages reached, because the controls are independent and each can be verified in minutes.

How do you measure AI maturity?#

Run a test for each control rather than asking whether it exists: grep the prompts for caps, push a change that should fail the harness, search the trace for personal data, check that a drift alert re-opens the release gate. The number of controls that pass is the level.

What are the levels of AI maturity?#

Here the level is simply the count, from zero to six, deliberately unweighted. Staged models such as CMMI assume an order to climb; these controls do not have one, and a cheap control should never wait behind an expensive one.

How often should you reassess AI maturity?#

Every quarter, and whenever tools, models or teams change. Controls decay silently, so a score that has never gone down is a sign that it is being remembered rather than measured.

Apply it in your role#

Across the enterprise. Run the six-control check across every team each quarter. Publish the list, not only the number, and fund the first missing control per team rather than a programme-wide initiative.

The ten-minute workflow. The self-check, scored by tests rather than by memory:

Run a maturity self-check on this repository by testing, not asking: (1) a context file exists and
changed this month; (2) three random stories each have a spec, a bar and an owner; (3) the harness is a
required check that blocks a slice below its bar; (4) no cap exists only in a prompt; (5) the trace
redacts personal data; (6) a drift alert re-opens the release gate. Report each with its evidence.

Sources and credits#