What Does an AI Maturity Assessment Actually Measure?

An AI maturity assessment measures how far your organisation has got with AI and how well it is run, across four areas: strategy, outcomes, risk and governance, and the people and capability to keep up. A credible one gives you a maturity score, a separate AI risk rating, and a view of where AI is actually being used across the business.

It is not a count of the AI tools you have bought, and it is not a compliance audit, although a good one will tell you how ready you are for frameworks such as the NIST AI RMF, the EU AI Act and ISO/IEC 42001.

This post is for boards, CEOs and technology leaders who need a defensible answer to "where are we with AI?". If you are still working out what AI means for your business, start with What Does AI Mean for Your Business?.

What is an AI maturity assessment?

An AI maturity assessment is a structured set of questions, scored against a consistent rubric, that places your organisation on a scale from "AI is on the radar" to "AI is core to how we operate, and we measure it". The output is a score and a named level, with the detail behind it.

The point is comparability. "We have rolled out a few AI tools and started some pilots" cannot be compared with last quarter or with a peer. A score built from fixed rules can.

What does a credible AI maturity assessment measure?

The names vary, but a credible assessment comes down to the questions a board would ask anyway.

Strategy: are we positioned to win?

Is there a stated AI ambition, and does it connect to the business strategy? Is the organisation playing defence (protecting margin, matching competitors) or offence (new products, new markets), and over what horizon? Lots of AI activity with no stated direction scores lower here than the activity suggests.

Outcomes: is it actually working?

This is the area that activity-based assessments can easily skip, and it is the one that matters most. It covers measurable results: productivity gains, return on spend, depth of adoption rather than the number of licences. A good assessment asks whether outcomes are measured at all, not just whether people feel positive about the tools.

Risk and governance: what could go wrong?

Data exposure, intellectual property, acceptable use, third-party AI vendors, incident response, and monitoring of AI outputs for accuracy and bias. These tend to be the first questions auditors ask, and they are where informal practice is easiest to hide.

People and execution: can we keep up?

Do people have the skills, the tools and the permission to use AI well? Is there a path from a promising pilot to production? This is about capability and speed, not enthusiasm.

Where AI is being used, function by function

AI use is rarely even across functions: one department can be well ahead while another has not started, and a single score hides that. A good assessment cuts the picture by department so you can see where adoption is concentrated.

Why AI risk should be scored separately from AI maturity

Maturity and risk are different measures, and combining them into one number hides the thing a board most needs to see.

An organisation can be adopting AI quickly and carrying serious risk at the same time. Picture a business that has given every team access to generative AI tools, has strong usage and some early productivity wins, but has no acceptable use policy, no review of AI vendors and no plan for an AI-related incident. Blend those answers together and you get a respectable middle score that describes neither the progress nor the exposure.

Reported separately, the same answers say something useful: "we are moving fast, and our guardrails have not kept pace." That is a conversation a board can act on. Separation also stops a cautious organisation with good policies and little adoption from looking more mature than it is.

How NIST AI RMF, the EU AI Act and ISO/IEC 42001 relate to AI readiness

A voluntary framework, a law and a certifiable standard are different things, so be clear which is which before reading a readiness percentage against one.

NIST AI Risk Management Framework

The NIST AI RMF 1.0 was released by the US National Institute of Standards and Technology on 26 January 2023. It is voluntary. It organises AI risk management into four functions: Govern, Map, Measure and Manage. NIST added a Generative AI Profile (NIST AI 600-1) in July 2024, and has said the framework is being revised under the White House AI Action Plan, so check which version an assessment maps to.

EU AI Act

The EU AI Act (Regulation (EU) 2024/1689) is law. It entered into force on 1 August 2024 and applies in stages: prohibited practices and AI literacy obligations from 2 February 2025, obligations for general-purpose AI models from 2 August 2025, and most remaining provisions from 2 August 2026. Amendments that took effect in July 2026 added a further prohibition from December 2026 and recast the AI literacy duty as one of taking measures to support literacy. They also pushed back the high-risk deadlines: to 2 December 2027 for standalone high-risk uses such as employment and education, and to 2 August 2028 for AI embedded in regulated products, according to the European Commission.

It sorts AI uses by risk: prohibited, high-risk, transparency obligations, and minimal risk. It can apply to organisations outside the EU, for example when they place AI systems on the EU market or when the output of their AI is used in the EU. Many organisations are "deployers" (using AI systems) rather than "providers" (building and selling them), and the obligations differ, so know which you are. A deployer that rebrands or substantially modifies a high-risk system can take on provider obligations.

ISO/IEC 42001

ISO/IEC 42001, published on 18 December 2023, sets out requirements for an AI management system. It uses the harmonised management-system structure shared with ISO/IEC 27001, and organisations can seek third-party certification against it from accredited certification bodies.

What a framework readiness percentage does and does not tell you

A readiness percentage tells you how much of what an assessment checks against a framework is in place. It is useful for finding gaps early.

It is not a certification, a legal opinion or an audit. No questionnaire covers every control in a published standard, so check what share of the framework the assessment actually evaluates. A high percentage against a small subset of controls means less than it looks.

How to read an AI maturity assessment result

Read a result in this order.

1. Start with the named level, not the number. A level describes what is true of the organisation. Small moves in the score can be noise, so if a result sits near a band boundary, look at what changed in the answers before treating a change of level as progress.
2. Read the risk rating next to the maturity level. High maturity with high risk means you are outrunning your guardrails. Low maturity with low risk often means caution has turned into standing still.
3. Look at the spread across areas. An average hides a weak pillar. If strategy scores well and outcomes do not, spend is probably running ahead of evidence.
4. Treat "don't know" as a finding. If the person answering cannot vouch for a capability, the board cannot rely on it either. It may be a visibility gap rather than a capability gap, but either way it needs an owner.
5. Use the department view to find concentration. If all your AI maturity sits in one function, you have a dependency, not a capability.
6. Re-run it. One score is a snapshot. The second and third tell you whether your plan is working.

What to ask before you trust any AI maturity score

Before an AI maturity score goes into a board paper, ask:

• Is the score calculated by fixed rules from the answers, so the same answers always produce the same number?
• Is the rubric published, so you can see what each level means?
• How are "not applicable" and "don't know" treated? If "don't know" is simply excluded, a respondent can raise the score by dodging hard questions.
• Is risk reported separately from maturity?
• Does it measure outcomes, or only activity?
• What share of each framework does it actually assess?
• Is it independent of the vendors whose AI tools or implementation work it might recommend?

How the StackUp AI Maturity Assessment works

We built the StackUp AI Maturity Assessment around those questions. It takes about thirty minutes, is free to start, and does not need a credit card. Here is what it measures and how, all of which is published on the scoring page.

The four board questions. Scoring questions are grouped under the four questions boards ask about AI: Are we positioned to win?, Is it actually working?, What could go wrong? and Can we keep up?. A handful of context questions inform the report narrative without affecting the score.

One rubric. Every scoring question is rated on the same five levels: absent or negative; informal or ad hoc; "we have it but it's not really used"; documented and applied; and mature, governed, measured and continuous. Each pillar is scored out of 100, and the overall AI Maturity Score is the simple average of the four. Because "Is it actually working?" has fewer questions than "Can we keep up?" or "What could go wrong?", each outcomes question carries more weight in its pillar. That is deliberate: actual outcomes matter more than process maturity.

Four named levels. The score maps to one of four named levels: AI Aware, AI Adopting, AI Embedded or AI Leading.

A separate AI Risk Rating. Low, Medium or High, taken from a fixed set of risk questions on what data flows into AI tools, what AI vendors may do with your inputs, third-party AI vendor risk and AI incident response. Risk answers still count towards the maturity score under What could go wrong?, but the Risk Rating reports them on their own so a strong adoption story cannot average them away.

Honest gaps. "Don't know" is scored as a gap, the same way an auditor treats an unproven control. If a department does not exist in your organisation, mark it Not applicable and it is left out of the heatmap rather than scored as zero.

Framework readiness. The report gives readiness percentages against frameworks including NIST AI RMF, the EU AI Act and ISO 42001. Coverage reflects the subset of each framework's factors that StackUp assesses, not every control in the published standard.

AI by department. A heatmap scores Marketing, Sales, Finance, HR, Operations and Technology on the same rubric. Department scores are a parallel view and are not rolled into the overall score.

The free report includes the score, level, risk rating, framework readiness, the per-pillar breakdown, the department heatmap and an executive summary. Premium adds prioritised recommendations linked to the answers that drove them, a benchmark against other organisations on StackUp, a per-control framework gap analysis, the AI Evidence Vault for uploading supporting artefacts, and a board-ready PDF and editable deck. You can see the whole thing in the illustrative sample report before you start.

If the gap you are worried about is your leadership team's AI judgement rather than the organisation's AI maturity, the AI Leadership Skills Assessment measures that separately, and the Technology Assessment covers the rest of the technology function that AI depends on.

Where to start

You do not need a consulting engagement to answer "where are we with AI?". You need consistent questions, a published rubric, risk kept separate from maturity, and a result you can re-run. Usually a CTO, CIO or head of data can answer it from what they already know.

Start the free AI Maturity Assessment, or read how the scoring works first.