Most organizations are further behind on AI than they think. Not because they aren't using it enough. Because using AI and governing it are two different things, and almost everyone measures the first.
AI governance maturity moves through four stages: Scattered Exploration, Aware but Unstructured, Strategic and Governed, and Integrated and Adaptive. Each one describes how much structure sits underneath the tools, regardless of how many you have. A company can be wall-to-wall with AI and still sit at stage one.
Maturity is about structure, not usage
Adoption is the easy part, and it already happened. In one 2025 survey, 78% of employees said they use AI tools their employer never gave them. The tools are in the building.
Governance is the part that lags. In a separate 2025 study, three-quarters of organizations had an AI usage policy, but far fewer had anyone who owned it or any way to check whether it was followed. That distance, between how much AI you use and how much structure stands behind it, is what these four stages actually measure.
Stage 1: Scattered Exploration
AI showed up on its own. People found tools they liked and started using them, quietly, to move faster. There's real energy here, and most of it is producing good work. What's missing is a shared playbook: no written policy, no agreed line on what data is safe to put in, no one whose job this is. Everyone improvises in parallel. It mostly works, which is exactly why nobody stops to ask what happens the day it doesn't.
The tell: ask ten people how they're supposed to use AI at work and you'll get ten answers, none of them pointing to anything written down.
Stage 2: Aware but Unstructured
Leadership has noticed. An executive read something, or a near-miss got someone's attention, so guidance goes out. An email, a line in an all-hands, a note in the team channel. It helps for about a week. Informal guidance evaporates the moment someone is on a deadline, because nothing holds it up: no owner, no classification people can apply in the moment, no way to tell who's actually following it. Awareness without structure is just worry with a better vocabulary.
The tell: you have opinions about AI risk, maybe even a document, but no one who can answer "who decided that?"
Stage 3: Strategic and Governed
This is where it gets real, and most organizations never reach it. There's a written policy people genuinely understand. There's a simple way to tell which data belongs in which tool. There's a named owner with the authority to make the call. AI is tied to real outcomes instead of scattered private shortcuts, and the core decisions have been made out loud, in a form the rest of the company can follow.
The tell: a new hire could read your policy on day one and know what's expected, and a manager hitting an edge case knows exactly who to ask.
Stage 4: Integrated and Adaptive
At the top, governance stops being a project and becomes a habit. AI is part of how teams work, with human judgment kept firmly at the centre. Training runs on a cadence instead of a one-time slide deck. The policy gets reviewed on a schedule because everyone accepts that the ground keeps moving. What defines stage four is adaptability: absorbing the next model, the next tool, the next risk without starting from scratch.
The tell: when something shifts in the AI world, you already know who looks at it, how it gets decided, and how the answer reaches your team.
Most companies are a stage behind where they think
The uncomfortable part is the gap between where companies place themselves and where they actually sit. Three-quarters report having a policy. Most of those can't name who owns it or show that anyone follows it. At the same time, the majority of employees are using tools no one approved. Put those together and you get a common, uncomfortable shape: a Stage 3 document sitting on top of Stage 1 behaviour. The policy says one thing. The building does another.
That gap is the dangerous place to be, because false confidence is the risk you stop watching for. A company that knows it's at Stage 1 is at least awake. A company that believes it's at Stage 3 on the strength of an unread PDF is moving fast with its eyes closed.
Which stage are you actually in?
You can probably guess. But guessing is the Stage 1 move, and guessing wrong is expensive.
The AI Readiness Assessment places you on the spectrum across the five things that set your stage: policy, data classification, ownership, training, and rollout. Five questions, about two minutes. You'll see where you stand, and the single move that takes you to the next stage.
Maturity was never about using more AI. It's about being able to say, with a straight face, that you've decided how.
Keep reading
Part of a series on AI governance, the structure underneath the tools.
- The Hard Part of AI Was Never the Technology. The worldview the whole ladder rests on.
- What's Safe to Paste Into ChatGPT?. The data-classification question, up close.