Enterprise AI Maturity Assessment: Model and Scorecard

An enterprise AI maturity assessment evaluates how consistently an organization turns AI use into governed, secure and measurable business outcomes. Use the free Excel scorecard below to assess eight areas, assign supported maturity levels and turn gaps into owned actions.

Methodology: GS Consulting. Updated October 17, 2026. This is a planning assessment, not an independent audit or certification. Read the method and limitations.

Maturity describes demonstrated capability today. AI readiness asks whether a proposed initiative has the prerequisites to proceed. For one proposed workflow, use the separate workflow readiness assessment.

Download the Free AI Maturity Assessment Scorecard

The Excel workbook is free to download without a form or account. It includes an editable scorecard for eight assessment areas, the five level scoring rubric and a fictional two unit example. Record evidence, current and target levels, owners, priorities, next actions and review dates. The workbook calculates the gap to target and flags missing review fields.

Download Excel Scorecard

See the scoring questions or get a facilitated assessment. Keep controlled evidence in its approved repository and record references in the workbook.

For help turning the findings into investment and operating decisions, explore enterprise AI strategy services and the enterprise AI insights hub.

The Five Levels of Enterprise AI Maturity

This GS Consulting planning model uses the same five levels as the downloadable scorecard. Assign a level to each assessment area within the declared scope.

These levels describe demonstrated practice. They are not industry benchmarks or certification results. A target below Level 5 can be appropriate for the organization’s scope and needs.

AI Maturity Assessment Questions and Scoring Rubric

Define the business unit, workflows, data boundaries and review period first. For each area, choose the highest level fully supported by dated evidence. Higher levels require the practices of the lower levels. Record the reviewer and rationale so another person can understand the decision.

The questions and anchors below make the shared scale concrete. Levels 4 and 5 apply the broader coverage and improvement tests above to each area.

Set the target to match the intended scope; not every workflow needs Level 5. The workbook calculates the gap as target minus current level, with a minimum of zero. Missing or invalid scores leave the gap blank. Completing a row records it for review; it does not independently validate the evidence.

Worked Example: From Evidence to a Maturity Score

Fictional example: Finance assesses an internal reporting pilot using approved data. The target for data readiness is Level 3. The reviewer finds an approved source map and access review, but quality checks have only been demonstrated during the pilot.

1. Assign Level 2. The pilot sources are approved and classified, so the Level 2 data criterion is supported.
2. Keep the target at Level 3. Routine quality and lineage checks have not yet been demonstrated. A policy describing those checks is not evidence that they recur.
3. Record a gap of 1. Target 3 minus current 2 equals 1 on this ordinal planning scale. It is not a percentage of maturity or a cost estimate.
4. Assign the action. The data owner establishes recurring checks and retains results for the next agreed review date.
5. Review expansion separately. The workflow owner records any restriction on expansion until the missing controls are demonstrated.

How to Handle Missing or Conflicting Evidence

Leave an area unscored when the evidence cannot support a level. If a policy says a control operates but records show exceptions, document the disagreement and test the affected scope. Assign only the level fully demonstrated by the available evidence. Do not average conflicting reviewer opinions into a score.

Distinguish an unknown from a confirmed weakness. Name who will collect or reconcile the evidence and when the area will be reviewed again.

How to Compare AI Maturity Across Business Units

Apply the same questions and evidence thresholds to comparable workflows over the same review period. Record differences in sensitive data, decision impact and shared services. A central policy is evidence of a shared service, but each unit still needs to show how it applies that policy.

Illustrative example: Finance and Operations assess internal reporting workflows. Finance has recurring operating records for use cases and infrastructure, but only pilot evidence for data controls. Operations has not supplied a complete source inventory or access evidence. These are fictional examples, not client results or benchmarks.

The workbook contains all eight areas for both units. It uses Level 3 as an illustrative target. Operations’ data gap stays unscored and its expansion is on hold; strong scores elsewhere do not cancel that concern. Report the domain profile, unknowns and critical gaps instead of announcing a single enterprise average.

How to Conduct an Enterprise AI Maturity Assessment

1. Define scope and inventory AI use. Name the business unit, workflows, data boundaries and review period. Include approved tools, informal use and embedded vendor AI features.
2. Interview the owners. Bring business, data, technology, security, compliance and workforce leads together to review outcomes and constraints.
3. Review the use case portfolio. Identify measured value, ownership, dependencies and risks before deciding which pilots deserve expansion.
4. Inspect operating evidence. Review data access, security tests, integration reliability and monitoring records. Record missing evidence explicitly.
5. Score each area. Apply the shared rubric, resolve conflicting evidence and agree on targets. Keep critical gaps separate from the domain scores.
6. Assign the next action. Record an owner, due date and evidence needed for reassessment. Carry funding and delivery decisions into enterprise AI portfolio management.

Decide what must be fixed before expansion and what can improve in parallel. A high score in another area does not clear a data, security or compliance concern.

Turn Gaps into Next Actions

• Missing inventory or ownership: identify the tools, workflows, data sources and accountable owners before extending the scope.
• Pilot evidence only: establish recurring checks and retain operating records before claiming Level 3.
• Data, security or compliance concerns: record the expansion constraint and the evidence needed to resolve it.
• Weak benefits evidence: establish a baseline and review measured outcomes before further investment.

A 30-60-90 Day AI Maturity Plan

1. Days 1-30Create visibility.

   Inventory AI usage, tools, vendors, business pain points, sensitive data exposure, and current pilots. Identify obvious shadow AI risks and temporary guardrails.

2. Days 31-60Score maturity and prioritize use cases.

   Assess maturity across use cases, data, governance, workforce skills, security, infrastructure, compliance, and executive alignment.

3. Days 61-90Build the roadmap.

   Define governance improvements, data cleanup priorities, security requirements, workforce training, integration needs, pilot plans, ROI metrics, and executive reporting.

By the end of 90 days, the organization should have a practical path from AI activity to AI maturity.

Enterprise AI Maturity Assessment Consulting

GS Consulting helps leaders turn an evidence review into practical investment and implementation decisions. Start by agreeing on the business units, workflows, stakeholders and decision the assessment must support. Scope determines the effort and schedule.

• Who participates: an executive sponsor, business owners and the relevant data, technology, security, compliance and workforce leads.
• What you provide: existing use case inventories, architecture and data documentation, policies, evaluation results and benefit measures. Initial scoping can use non sensitive descriptions.
• What we review: evidence across the eight areas, differences between units and dependencies that may block expansion.
• What you receive: a domain maturity profile, evidence gaps, prioritized actions and an executive briefing on decisions and ownership.
• How it becomes a roadmap: sequence controls, data work, workforce support and implementation around agreed risk and business priorities.

Explore our enterprise AI strategy services and the enterprise AI insights hub. Use portfolio management to carry assessment decisions into recurring funding and delivery reviews.

Discuss an Enterprise AI Maturity Assessment

What an Enterprise AI Maturity Assessment Should Produce

A useful assessment should produce practical deliverables, including:

• An AI use case inventory.
• A maturity score by domain.
• A shadow AI risk summary.
• A data readiness assessment.
• A governance gap analysis.
• A workforce skills assessment.
• A security and compliance exposure map.
• An infrastructure and integration readiness review.
• A prioritized AI use case portfolio.
• A 90 day action plan and a roadmap covering 6 to 12 months.
• An executive briefing with key decisions.

Keep the evidence references, score rationale and decisions together so a later review can explain what changed.

Evidence to Collect Across the Eight Assessment Areas

Use this reference when collecting evidence for the questions above. Match the review depth to the workflow’s risk and intended scope.

Use the research domains to guide evidence collection. Their evidence burden scores do not establish maturity scores or automatic weighting. Review data, governance, measurement, monitoring and security explicitly, then set priorities for the organization’s actual scope and risk.

1. AI Use Cases and Business Value

The first question is simple: where is AI being used today? Most organizations discover more AI usage than they expected. Some of it is approved. Some of it is informal. Some of it may be happening inside tools the company already owns. Some of it may be happening through public or personal accounts.

Inventory current and planned AI use cases across the functions in scope. Identify the business outcome and owner for each workflow.

A weak use case sounds like "We want to use AI in operations." A stronger use case sounds like "We want to use AI to identify late operational exceptions, summarize root causes, assign owners, and reduce manual weekly reporting time by 40%." The difference is measurability.

• Do we know where AI is currently being used?
• Are use cases tied to business goals?
• Do use cases have owners?
• Do we know which pilots are worth scaling?
• Do we have a process for approving new AI use cases?

2. Data Readiness

AI maturity depends heavily on data readiness. If the data is inaccurate, scattered, outdated, duplicated, poorly labeled, or locked in systems that AI cannot safely access, AI performance will suffer.

Review source ownership, quality, classification and access. Trace how prompts, outputs, logs and embeddings are retained and protected.

Data readiness is also an evidence problem. Leaders should be able to show which data sources AI may use, who owns them, how quality is checked, which sensitive data is excluded, how AI generated records are retained, and how data changes are handled over time.

This is especially important because AI does not just consume data. It can also create new data. A summary of a sensitive employee issue, security incident, customer complaint, financial exception, or regulated record may need to be protected like the original source.

• Do we know which data is approved for AI use?
• Do we know which data is prohibited?
• Are systems of record clearly identified?
• Are sensitive data categories classified?
• Are AI outputs governed when they contain sensitive information?

3. AI Governance

Governance is where many organizations are least mature. They may have AI tools, pilots, and policies, but not a working governance model.

AI governance should define how AI is approved, built, used, monitored, changed, and retired. ISO/IEC 42001 is relevant because it provides a management system approach for organizations developing, providing, or using AI systems. ISO describes it as a structured way to manage AI risks and opportunities while balancing innovation with governance.

Name the owners for use case approval, risk review, vendor review and business outcomes. Document monitoring, stop authority and change approval.

That operating model should be visible in reusable artifacts: use case intake forms, risk tiers, approval records, model or tool inventories, vendor review notes, monitoring responsibilities, escalation paths, and change control logs.

• Do we have an AI governance body or process?
• Are roles and decision rights clear?
• Do we classify AI use cases by risk?
• Do we have approved and prohibited AI uses?
• Do we monitor AI after deployment?

4. Workforce Skills and AI Fluency

AI maturity is not just a technology issue. It is a workforce issue.

Employees need to understand how to use AI well. Managers need to understand how AI changes workflows. Executives need to understand where AI creates value and where it creates risk. Technical teams need skills in integration, security, data engineering, prompt design, model evaluation, and monitoring.

Deloitte's 2026 enterprise AI report found that the AI skills gap is viewed as the biggest barrier to integration, and that education was the top way companies adjusted talent strategies due to AI. An organization can have excellent tools and still fail if employees do not know how to use them.

• Do employees know which AI tools are approved?
• Do they know what data not to enter?
• Can they evaluate AI outputs critically?
• Do managers know how AI changes workflows?
• Are people using unofficial AI because approved tools are inadequate?

5. Security and Risk Posture

AI adds new risk to the enterprise environment. Some risks are familiar: data leakage, weak access controls, poor vendor oversight, insecure APIs, and excessive permissions. Others are more specific to AI: prompt injection, hallucinated outputs, model drift, sensitive information disclosure, insecure plugins, vector database exposure, and excessive agency.

OWASP's Top 10 for LLM and generative AI applications highlights risks such as prompt injection, sensitive information disclosure, and excessive agency. CISA and international partners have also released guidance on secure adoption of agentic AI, including recommendations to avoid granting broad or unrestricted access, especially to sensitive data or critical systems.

Review the full workflow, including identity, data access, integrations, outputs and human approvals.

For higher risk workflows, test those controls and inspect audit logs, monitoring records and incident response evidence.

• Are AI tools reviewed by security before deployment?
• Do AI workflows enforce least privilege?
• Are prompts and outputs logged where appropriate?
• Do we have incident response procedures for AI related issues?
• Are AI agents treated as identities with scoped permissions?

6. Infrastructure and Integration Readiness

AI creates the most value when it connects to real work. That means infrastructure and integration matter.

A company may have strong AI experimentation but weak integration maturity. Employees can ask a chatbot questions, but AI cannot securely access systems of record, update workflows, retrieve approved documents, or produce auditable outputs.

Map the approved integrations and their dependencies. Review deployment, evaluation, monitoring and recovery records for the systems that support the workflow.

• Can AI connect to enterprise systems securely?
• Do we have clean integration paths?
• Can AI outputs be written back to approved systems?
• Are legacy systems blocking automation?
• Are we relying on manual copy and paste workflows?

7. Compliance and Regulatory Exposure

AI maturity also depends on compliance maturity. A healthcare company, bank, government contractor, insurer, law firm, energy provider, defense supplier, or public sector organization may all need different controls.

Map applicable legal, regulatory and contractual duties to the workflow. Involve the relevant owners in privacy, records retention, sector requirements and third party risk reviews.

The assessment should also identify where AI outputs become official records or decision support artifacts. If AI drafts a customer response, summarizes an investigation, supports a hiring workflow, reviews compliance evidence, or recommends a financial action, that output may need review, retention, protection, and auditability.

• Do we know which AI use cases have compliance exposure?
• Are legal and compliance involved early enough?
• Do we retain AI outputs when required?
• Can we explain how AI was used if a regulator, auditor, or customer asks?

8. Executive Alignment and Funding

Enterprise AI maturity requires executive alignment. Without alignment, AI becomes a set of disconnected department projects. One executive wants cost reduction. Another wants innovation. Another wants risk control. Another wants workforce productivity. Those goals can coexist, but they need prioritization.

Check whether leadership has agreed on business priorities, risk limits and ownership. Review funding decisions, success measures and the division of responsibility between central services and business units.

Mature organizations treat AI as an enterprise capability, not a side project.

• Is there an executive sponsor for AI?
• Are business goals clearly connected to AI investments?
• Is funding available for data, integration, governance, and training, not just tools?
• Does leadership receive AI performance and risk reporting?
• Can executives explain the organization's AI maturity honestly?

For an infrastructure gap, use the legacy AI integration framework to identify system ownership, permissions, and recovery requirements. The legacy integration service supports assessment and implementation of those dependencies. For evidence of published implementation work, see the private AI cyber analysis case study; its scope is distinct from the fictional business unit comparison above.

Why AI Maturity Matters

AI adoption records whether people use AI. Maturity examines whether that use is owned, governed, repeatable and measured. Informal tool use can coexist with weak data controls, unclear accountability or unmeasured outcomes.

NIST’s AI Risk Management Framework organizes risk management around Govern, Map, Measure and Manage. It informs the risk review; it does not supply this article’s maturity scores.

Original Research: The Enterprise AI Maturity Evidence Gap

AI adoption and AI maturity are not the same thing. McKinsey’s 2025 global AI survey found that 88% of respondents reported regular AI use in at least one business function, while 39% attributed enterprise level EBIT impact to AI. McKinsey also found that high performers are more likely to redesign workflows rather than simply layer AI on top of existing processes. Deloitte’s 2026 enterprise AI report describes a 50% increase in worker access to AI, while 34% of surveyed companies reported using AI to deeply transform their business.

The survey figures retain their stated publication years and populations. They provide context for the assessment, not a benchmark for an individual organization.

GS Consulting’s source review examines what evidence an organization needs to demonstrate AI maturity beyond tool adoption. GS Consulting analyzed 12 public AI maturity, governance, security, standards, regulatory, and enterprise adoption sources against 10 maturity domains. The highest scoring domains were Data Readiness & Traceability, Governance Model & Decision Rights, Measurement, ROI & Benefits Realization, Lifecycle Monitoring & Change Control, and Security & Privacy Risk Posture.

The takeaway is practical: an AI maturity assessment should not only ask whether people are using AI. It should determine whether AI is connected to governed workflows, trusted data, measurable outcomes, secure integrations, human accountability, workforce fluency, vendor controls, and lifecycle monitoring.

Data readiness scored highest because it appears repeatedly across maturity, regulatory, standards, and operational guidance. Data readiness should not be treated as a technical appendix. It is one of the central maturity gates. A mature assessment should identify systems of record, approved and prohibited data, sensitivity levels, prompt and output handling, retention, lineage, embeddings, logs, and AI generated derivative records.

Governance maturity scored nearly as high, but governance here means operating decisions, not just an AI policy. The assessment should ask who approves a use case, who owns data risk, who can stop a tool, who reviews vendor AI features, who monitors outputs, who approves model or workflow changes, and where that evidence is kept.

The source set included NIST AI RMF, the NIST Generative AI Profile, ISO/IEC 42001 public information, OECD AI Principles, the EU AI Act, OWASP LLM Top 10, GAO's AI Accountability Framework, OMB M-25-21, McKinsey's 2025 State of AI survey, Deloitte's 2026 State of AI in the Enterprise, and IBM's 2025 CEO Study. Each source and domain intersection was coded from 0 to 2 and converted into a weighted 0-100 Maturity Evidence Burden Score. The score, triage matrix, and evidence packet are GS Consulting derived planning tools, not official maturity scores, audit findings, certification outcomes, legal conclusions, or guarantees of AI performance.

Assessment Method: Eight Areas and Ten Research Domains

The research analyzes source emphasis across ten domains. This practical scorecard groups those topics into eight areas: measurement and ROI sit with use cases, while lifecycle monitoring and change control sit with governance. Security and infrastructure reviews should still inspect their relevant monitoring evidence.

Keep three decisions separate: evidence burden describes emphasis in the research sources; maturity describes demonstrated organizational practice; implementation priority reflects risk, business value and dependencies. The research score is not a company maturity rating and does not automatically weight this scorecard.

Sources and Related Reading

• McKinsey: The State of AI: Global Survey 2025
• Deloitte: The State of AI in the Enterprise - 2026 AI report
• NIST: AI Risk Management Framework
• NIST AI Resource Center: AI RMF Core
• ISO/IEC 42001: Artificial intelligence management systems
• OECD AI Principles
• EU AI Act
• OWASP Top 10 for Large Language Model Applications
• GAO: Artificial Intelligence Accountability Framework
• OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
• CISA: Guide to Secure Adoption of Agentic AI
• IBM Institute for Business Value: CEO Study on Generative AI
• Enterprise AI Strategy and Operating Models
• Enterprise AI Portfolio Management
• Enterprise AI Readiness Assessment
• What Is an Enterprise AI Strategy?
• Secure AI Automation Readiness Assessment

Frequently Asked Questions About Enterprise AI Maturity