The AI Maturity Model: 5 Stages, 3 Axes, and the Gap Score That Predicts Which Ones Fail

Why most AI maturity models miss what matters

Gartner already publishes a widely used AI Maturity Model — five levels (Awareness, Active, Operational, Systemic, Transformational) scored across seven pillars. It’s solid, well-tested, and most public discussion of “AI maturity” borrows its shape, directly or not. What’s actually new here isn’t the idea of stages. It’s what happens when you stop collapsing an organization into one maturity number.

Single-score maturity models have two structural blind spots. First, they’re organization-wide averages that erase real variation — your data engineering team can be two stages ahead of your legal and compliance function, and a single blended number hides that entirely. Second, most of them are input-focused: they measure whether you’re doing the activities (do you have a use-case pipeline, a model registry, an AI council) rather than whether those activities are actually producing value safely.

Both blind spots point the same direction. What matters isn’t your position on one ladder. It’s the distance between your positions on several ladders at once. That’s the idea this framework is built around.

The real data: adoption is up, value is not

Two numbers anchor every stage of this model. Here’s where they come from, and — more importantly — where they stop agreeing with each other.

The 88% figure comes from McKinsey’s global AI survey: 88% of organizations now say they regularly use AI in at least one business function, up from 78% the year before. Gen AI specifically reached roughly 72% usage in the same 2025 survey, up from 33% back in 2023 — a two-year climb, not a one-year jump. By any normal measure of technology diffusion, that’s still an extraordinarily fast curve.

The 95% figure is the one that made headlines in the second half of 2025: MIT Media Lab’s Project NANDA studied more than 300 public AI deployments alongside interviews and surveys of business leaders and employees, and concluded that roughly 95% of enterprise generative AI pilots were not producing a measurable return on the P&L, against an estimated $30–40 billion in enterprise spending. Only about 5% of pilots were extracting real, attributable value.

That framing — technology isn’t the bottleneck, integration and governance are — shows up again once you compare sources that had no reason to coordinate with each other. It’s worth being precise about how far that agreement actually goes, though, rather than flattening several studies into one voice.

Gartner’s 2024 prediction that at least 30% of generative AI projects would be abandoned after proof of concept cited poor data quality, inadequate risk controls, escalating costs, and unclear business value. A year later, Gartner analyst Anushree Verma predicted that over 40% of agentic AI projects will be canceled by the end of 2027, for largely the same reasons plus a new one: “agent washing,” where existing chatbots and robotic-process-automation tools get relabeled as agents without the underlying autonomy to justify it.

Separately, RAND Corporation researchers James Ryseff, Brandon De Bruhl, and Sydne Newberry found that more than 80% of AI projects fail — roughly double the failure rate of comparable non-AI IT projects. It’s tempting to fold that number straight into the governance-gap thesis above, and I’d be overselling this framework if I let you do that without a flag: RAND’s own root cause was misaligned goals and poor communication between technical teams and business stakeholders — an organizational-clarity problem that can exist even in a company with a named AI governance owner and a clean system inventory. It’s a cousin of the governance gap, not a restatement of it. A team can score well on the Governance axis defined later in this piece and still fail for the reason RAND describes, because “who’s accountable for this system” and “does everyone agree on what this system is for” are different questions.

What the studies actually establish, honestly stated, is narrower than “one root cause”: the industry’s problem in 2026 is concentrated in the organizational layer — governance, goal alignment, integration, incentives — not in model capability. That’s still a real and useful finding. It just isn’t a single mechanism, and treating it as one would be the kind of overclaiming this piece is trying to avoid.

The three-axis AI maturity model

Here’s the actual proposal. Instead of one maturity score, track three, and pay closer attention to the spread between them than to any of them individually:

• Capability Maturity — how sophisticated your tooling, data infrastructure, and technical talent actually are, independent of whether anyone is using them well.
• Value-Realization Maturity — how much of that capability shows up as attributable, measurable business outcomes: cost saved, revenue moved, cycle time cut.
• Governance & Risk Maturity — how much of what you’ve built is actually accountable: owned by someone, auditable, monitored, and safe to point at a regulator or a board without flinching.

Score each axis 1 through 5. Most public commentary about AI maturity implicitly assumes these three move together — that a company sophisticated enough to deploy agentic workflows is also sophisticated enough to govern them. The 2026 data says that assumption is usually wrong, and it says so with unusual precision.

That shape isn’t invented for effect. McKinsey’s 2026 AI Trust Maturity Survey — roughly 500 organizations, surveyed December 2025–January 2026, assessed on a five-dimension model covering strategy, risk management, data and technology, governance, and (new that year) agentic AI governance and controls — found the average responsible-AI maturity score rose to just 2.3 in 2026, up from 2.0 in 2025. But only about one-third of organizations reached a maturity level of three or higher in strategy, governance, and agentic AI controls specifically, while data and technology maturity ran well ahead of that. The report’s own conclusion: oversight structures are struggling to keep pace with increasingly autonomous systems. That’s the governance axis lagging the capability axis, measured directly, by the people who run one of the more detailed AI maturity surveys in the industry.

A related McKinsey playbook on deploying agentic AI adds a sharper, exact data point — not rounded up, not a combined figure: 80% of organizations say they have encountered risky behaviors from AI agents, including improper data exposure and access to systems without authorization, even as deployment keeps accelerating. The agents are acting. The oversight, for most organizations, is still being built underneath them.

The same 2026 survey found something sharper still: organizations with explicit, named ownership of responsible-AI practice averaged a maturity score of 2.6. Organizations without clear accountability averaged 1.8. Nearly a full point of maturity, associated with one structural decision — whether a specific person’s job description includes this — rather than budget, headcount, or model sophistication. That’s a correlation from a single survey wave, not a controlled experiment, so treat it as directionally useful rather than as proof that ownership alone causes the gain. It’s still the most actionable single data point in this whole piece, which is why it drives the 90-day plan two sections from now.

The Danger Zone: where capability outruns governance

Plot capability against governance instead of listing them, and four quadrants appear. Two are what you’d expect: low on both (genuinely early stage) and high on both (the roughly 5% of organizations MIT identifies as extracting real, attributable value, which overlaps closely with PwC’s top 20% — see the next section). The other two are the interesting ones.

The Danger Zone is where an organization has built enough capability to look mature in a board deck — live pilots, a few production use cases, maybe an early agentic workflow — without the ownership, monitoring, and accountability to make that capability safe to scale. It’s the single most predictive place to look if you want to know whether a company’s next 18 months will involve a Gartner-style cancellation. Nearly two-thirds of respondents in McKinsey’s survey cited security and risk concerns, not cost or talent, as the top barrier to scaling agentic AI further — which is the Danger Zone describing itself. EXL’s June 2026 study puts a second, independent number on the same problem: 70% of surveyed executives cite data infrastructure — privacy, security, and siloed data specifically — as the top barrier to scaling, out of 322 C-suite and senior decision-makers surveyed.

The top-left quadrant — Governance ahead of Capability — deserves its own sentence, because the matrix can otherwise read as only celebrating the top-right corner. This is the “Cautious & Compliant” org: a real AI policy, a named reviewer, maybe even a system inventory, sitting on top of very little actual deployment. It won’t show up in an incident report or a Gartner cancellation statistic, because there’s rarely enough live capability to fail loudly. Its failure mode is quieter and slower — it’s the organization PwC’s data describes losing ground to the 20% pulling ahead, one budget cycle at a time, without a single dramatic moment that forces a correction. Both quadrants are Gap Index problems. Only one of them is loud about it.

I’ll admit the part of this I’ve gotten wrong personally: on two separate engagements, I pushed harder for the next capability milestone than for closing the governance gap underneath it, because capability progress is visible and governance progress isn’t — nobody puts “wrote an incident-response runbook nobody’s needed yet” in a quarterly update. Both times, the eventual correction (a scramble to retrofit ownership and logging after a near-miss, not a catastrophic one) cost more calendar time than just building the governance layer alongside the capability would have. That’s not a controlled comparison, it’s one practitioner’s pattern across a small number of cases — but it matches what the aggregate data above says happens at scale, and it’s why the next two sections exist.

The Maturity Gap Score: score yourself in about ten minutes

This is a diagnostic heuristic, not a statistical model — there’s no dataset behind it claiming to predict your odds of failure to two decimal places, and you should be suspicious of anyone who tells you their version does. What it will do is force an honest conversation that most steering committees skip: are all three of these actually keeping pace with each other, or is one dragging the other two into risk?

2 and 4 are deliberately left mostly as your own interpolation — score a 2 if you’re mostly at the 1 description but with one real exception, a 4 if you’re mostly at the 5 description but missing one piece. Forcing that judgment call is more honest than a fifth fully-scripted sentence would be. Three concrete markers, one per axis, to calibrate against: a Capability 2 usually means one function has a real tool budget and the rest are still on personal ChatGPT logins; a Value Realization 4 usually means the number is tracked on a standing cadence but still lives in one team’s dashboard, not a board-level KPI; a Governance 2 usually means a policy document exists somewhere that almost nobody involved in a live project has actually read.

This framework is deliberately general-purpose — it works whether your highest-stakes AI use case is customer-facing personalization, internal operations, or something else entirely. If your use cases skew toward customer-facing and personalization specifically, our Personalization Maturity Assessment applies the same three-axis logic with rubric language scoped to that narrower domain. If they don’t, the worksheet above is the complete tool; you don’t need the narrower version.

How much gap is acceptable? It depends what you are

The formula above treats every gap the same way, and that’s a deliberate simplification, not an oversight — but it means the raw Gap Index needs one more layer of context before you act on it. A Gap Index of 2 is not equally risky for every kind of organization. What changes it is what happens if the lagging axis fails you, and how fast that failure would be discovered.

The general rule underneath the table: gap tolerance scales with blast radius and detection speed. A gap you’d discover yourself, next Tuesday, in an internal tool is a different animal from a gap a regulator or a customer discovers for you, months later, in a system that acts autonomously. Score your own three axes first. Then use this table to decide whether your Gap Index number means “watch it” or “fix it this quarter” — the number alone can’t tell you that.

If your Gap Index is 3 or higher: the first 90 days

Scoring yourself is the easy part. Most maturity content stops there and leaves you with a diagnosis and no treatment plan, so here’s the treatment plan — specifically for the pattern that shows up most often in the 2026 data: Capability well ahead of Governance. If your gap runs the other direction (heavy governance, thin capability), the sequence below still applies, just read “Governance” as “Capability” throughout.

Worth being upfront about: a named owner and a system inventory are general risk-management hygiene, not AI-specific insight — you’d want both for a cloud migration too. The AI-specific weight in this plan sits in three places: the assistive-vs-agentic classification, the human-approval gates on autonomous actions, and treating a purchased agent as inventory rather than someone else’s finished governance work (see build vs. buy above). Generic hygiene done well is still most of what closes a governance gap in practice — that’s not a flaw in the plan, it’s what the RAND and McKinsey data both say the gap actually consists of.

None of this closes a Gap Index of 3 down to 0 in ninety days — Governance maturity is slower to build than Capability maturity precisely because it depends on organizational habits, not tooling purchases. What it does is move you out of the Danger Zone quadrant into “Watch closely,” which is a fundamentally less risky place to keep building from.

90-day action checklist

A compressed, scannable version of the plan above — useful for a status update, a kickoff meeting, or pinning to the top of a project tracker.

• Name one accountable AI governance owner with real budget and veto authority — not a committee.
• Build a system inventory covering every AI tool and pilot in production, including unapproved shadow-IT usage.
• Classify every system as assistive (human decides) or agentic (acts with reduced review).
• Define which agentic actions require human approval before execution — financial transactions, data deletion, external communications, access-control changes.
• Write a one-page incident response plan for the first time an agent does something wrong.
• Run that plan as an actual drill with the people who’d handle a real incident — not just a document review.
• Put a real, defensible value-realization number on one production use case, even if it’s small.
• Re-check whether the named owner’s actual authority matched what the first quarter required.
• Re-score your three axes and Gap Index at the 90-day mark to confirm movement out of the Danger Zone.

The five stages, one at a time

Mapped onto the three-axis model, Gartner’s five levels aren’t just “more AI” at each step — each stage has a characteristic Capability/Value/Governance shape, and a characteristic way organizations get stuck.

The practical implication: don’t chase the next stage label. Chase Gap Index 0–1 at whatever stage you’re currently in, then move forward. An Operational-stage company with a Gap Index of 1 is in a stronger position than a Systemic-stage company with a Gap Index of 3, even though the second one sounds more advanced on a slide.

The cost of standing still

The governance-first argument above can read as a caution against moving fast. It isn’t — moving without governance is the risk, not moving itself, and the data on staying still is at least as stark as the data on moving recklessly.

PwC’s 2026 AI Performance Study, based on a survey of 1,217 senior executives across 25 sectors and released April 13, 2026, found that nearly three-quarters of AI’s economic value is being captured by one-fifth of organizations — those leaders generate 7.2 times more AI-driven financial performance than the average competitor, with profit margins 4 percentage points higher, built on an “AI Fitness Index” scored across roughly 60 management and investment practices. Crucially, PwC’s own finding is that the leaders aren’t winning by deploying more tools: they’re roughly 2.6 times more likely to say AI is helping them reinvent their business model, and 2–3 times more likely to use it to find growth opportunities that cross traditional industry boundaries, rather than bolting a model onto an unchanged process.

EXL’s June 2026 study, based on 322 C-suite and senior decision-makers, adds a sharper self-perception gap to the same picture: 76% of companies believe they’re ahead of competitors on AI, but only about 10% actually qualify as “AI Leaders” — defined as company-wide integration with measurable ROI. Those actual Leaders report roughly 27% revenue growth, 26% cost reduction, and 22% margin improvement in the areas where AI is deployed, and 44% of them report having completely redesigned enterprise-wide operating models around AI, rather than adding it incrementally.

The mechanism behind “the gap widens” is worth naming plainly, because it’s not mysterious: every production deployment generates training data, governance patterns, and institutional experience that the next deployment builds on. An organization stuck at Awareness or Active isn’t just behind on tooling — it’s behind on the organizational learning that makes the next stage cheaper to reach. That’s a real cost of inaction, separate from and in tension with the real cost of moving recklessly described earlier in this piece. Both risks are real. The Gap Index is the tool for holding both in view at once, instead of treating “move fast” and “move safe” as a single dial.

Build vs. buy vs. partner

This decision sits downstream of the Capability axis, and it’s swinging harder toward “buy” than 2023–2024 build-heavy conventional wisdom assumed. Menlo Ventures’ December 2025 State of Generative AI in the Enterprise report — nearly 500 U.S. enterprise decision-makers, now in its third year — found 76% of AI use cases are now purchased rather than built in-house, up from 53% a year earlier. That’s worth a source-bias flag, since Menlo is a venture firm with financial exposure to AI vendors and a buy-favorable finding is unsurprising from them specifically. But the direction shows up independently too: Gartner separately projects task-specific agents in roughly 40% of enterprise applications by the end of 2026, up from under 5% in 2025, mostly via packaged platforms rather than custom builds. The same Menlo report puts a number on how new agentic buying still is: only about 16% of enterprise deployments and 27% of startup deployments qualify as true agents that plan, act, and adapt, rather than pre-scripted automation relabeled as “agentic.”

The line that holds up isn’t “buy has won” — it’s that build/buy increasingly tracks differentiation, not company size. Commodity, high-volume tasks get bought, because renting a maintained agent beats patching your own. Genuinely differentiating capability, and anything needing end-to-end control of the audit trail, still gets built.

Mapped onto the three axes directly: buying moves you up the Capability axis fast — often the fastest lever available — without touching Governance at all, which is exactly why “buy” can quietly widen a Capability-over-Governance gap rather than close it. A purchased agent still needs a named internal owner, a place on your system inventory, and an approval gate for whatever actions it’s allowed to take; none of that arrives in the vendor contract by default. What buying does relocate is a narrower piece of the burden — model-behavior risk shifts to the vendor’s terms and data-handling posture — but the accountability for whether that vendor’s system is being used safely inside your organization stays with you. Treat a purchased agent as a new line on the Week 1 system inventory, not as governance work someone else already did.

What this looks like in practice

No named case study here — dressing up a composite as “Company X, a Fortune 500 retailer” is exactly the manufactured-authority move this piece has argued against throughout. What follows is a pattern seen repeatedly across mid-size, multi-function organizations, not a transcription of one client.

The recurring shape: a company reaches Operational maturity through one visible function — often engineering or support, where technical fluency and repetitive volume make an early win easy to point to. That win gets held up as proof the org is “doing AI well.” Meanwhile two or three other functions run their own ungoverned pilots on the same consumer tools, invisible to whoever would be the governance owner if one existed. Averaged, the Capability score looks respectable. The actual risk sits in the functions nobody’s counting — which is exactly what the Week 1 step above is built to surface, not a bigger budget.

Regional and regulatory differences

Governance urgency isn’t uniform across markets, and 2026 has been an active year for the regulation that shapes it. The EU AI Act’s high-risk obligations (Annex III) were due August 2, 2026 — until the Digital Omnibus on AI (Regulation (EU) 2026/1744) entered force July 27, 2026, days before that deadline, and pushed standalone high-risk compliance to December 2, 2027 (August 2028 for AI embedded in already-regulated products like medical devices). Two things did not move: Article 50’s disclosure duties (labeling deepfakes, disclosing AI interactions) took effect on schedule with no grace period, and the prohibited-practices regime has been enforceable since February 2025, with fines up to €35 million or 7% of global turnover. One narrower Article 50 sub-obligation — machine-readable watermarking — got its own shorter reprieve to December 2, 2026, worth flagging because an earlier proposal’s February 2027 date still circulates in some pre-enactment coverage.

The practical read: European organizations got runway on the heaviest compliance wave, not a reprieve from transparency obligations or the underlying logic — an auditable system inventory built now is still cheaper than one reconstructed under 2027 deadline pressure. The U.S. picture is more fragmented — sector- and state-level rules accumulating faster than federal legislation — which is its own governance argument: an org spanning U.S. states plus the EU is already juggling multiple, non-synchronized compliance clocks, one more reason the named-owner-plus-inventory step matters regardless of which deadline is closest.

When not to chase the next stage

Everything above assumes progress is the goal. Sometimes it shouldn’t be — at least not yet, and not in the direction “more capability” implies.

• When you can’t name the use case’s owner or its metric. Moving from Active to Operational without both is just moving the same unaccountable pilot to a bigger budget line.
• When your Gap Index is already 3+ and you’re about to add capability anyway. Widening an existing gap compounds risk faster than it compounds value — close the gap first, or at minimum don’t grow it further while you’re closing it.
• When the “next stage” is really a vendor’s roadmap, not yours. Agentic pilots sold as a maturity milestone are still a business decision that needs its own value case, not a badge to collect.
• When the org hasn’t decided what it’s optimizing for. PwC’s leader/laggard split above tracks growth-oriented use versus efficiency-oriented use — chasing “the next stage” without deciding which of those you’re actually pursuing just produces faster movement in an undecided direction.

Myth vs. fact

Glossary

AI Maturity Model

A staged framework (commonly five levels, following Gartner’s structure) describing how deeply AI is embedded in an organization’s tools, workflows, and culture.

Gap Index

This framework’s own diagnostic: the highest score minus the lowest score across the Capability, Value Realization, and Governance axes. A larger spread signals a lopsided, higher-risk maturity profile.

Agentic AI

AI systems that take multi-step actions — calling APIs, moving data, executing workflows — with reduced human review, as distinct from assistive tools that draft or recommend and leave the decision to a person.

Danger Zone

This framework’s term for the quadrant where Capability Maturity is high but Governance Maturity is low — the profile most associated with abandoned pilots and cancelled agentic projects in 2026 survey data.

Agent washing

Gartner’s term for relabeling existing chatbots or robotic process automation as “AI agents” without the underlying autonomous decision-making that the term implies.

Value Realization

The degree to which deployed AI capability shows up as an attributable, measurable business outcome — cost saved, revenue moved, cycle time cut — rather than unmeasured activity.

System inventory

A maintained list of every AI tool and pilot in active use across an organization, including unofficial or unapproved (“shadow IT”) deployments — the foundational artifact for any governance program.

FAQ

Limitations of this framework

Worth stating plainly rather than burying: the 1–5 rubric above is a self-assessment heuristic, not a validated psychometric instrument — there’s no independent study showing that a self-reported 4 on the Capability axis predicts a specific outcome. It’s built to structure an honest internal conversation, not to produce a number you’d defend in an academic paper.

Most of the survey data cited throughout — McKinsey, PwC, Gartner’s underlying research, EXL, Menlo Ventures — skews toward large, well-resourced organizations with the budget to participate in enterprise surveys in the first place. A 20-person company’s actual Gap Index dynamics are plausibly different in ways this data doesn’t capture directly.

And the correlation between named ownership and higher governance scores, cited twice in this piece because it’s genuinely the most actionable data point available, is still a correlation from one survey wave. Organizations disciplined enough to name a clear owner may simply be the same organizations disciplined enough to score well generally — the causal arrow could run either way, or both ways at once.

When I checked the numbers behind this piece against primary and near-primary sources — PwC’s own press release rather than secondary coverage of it, EXL’s press release and its Q2 2026 investor materials, and Menlo Ventures’ original report language rather than a paraphrase of it — all of the headline figures held up as stated. What I could not verify directly in this pass was the underlying respondent-level methodology behind each survey’s sampling (how PwC’s 1,217 executives or EXL’s 322 respondents were recruited, and how representative that recruitment is of the broader market). That’s a real limitation of citing survey research generally, not specific to these particular studies, and it’s why this piece treats every percentage as directional evidence rather than a precise population estimate.