Exponential Partners · AI Maturity Assessment

Where are you on the AI maturity curve?

A short, honest diagnostic. Eighteen questions, five stages — scored the way it actually works, not the way a consultant's wheel pretends it does.

Answer for your organisation as a whole, not your own team or function. Pick the line that's closest to true today — not what you're aiming for. It takes about six minutes.

01
Shadow
AI is happening off the books — personal accounts, no policy, no visibility.
02
Sanctioned
A sanctioned tool and a real policy exist. The legal and IP bleed is stopped.
03
Piloting
Bounded pilots running, seniors trained, champions found. Learning what works.
04
Scaling
Built into real workflows. Tiered access, measured usage, repeatable delivery.
05
AI-native
Roles and structure reshaped around AI. A strategic-intelligence layer, not just productivity.

Your name

Work email

Organisation optional

1Leadership & sponsorshipFoundation · caps your stage

Without an owner who'll spend capital, every pilot dies in procurement.

Q1Is there a named executive who'll spend political capital and budget on this — not just endorse it in a town hall?

1No owner — AI isn't anyone's job2A sponsor in name, but no budget behind it3One exec backs it, with a first budget line4A funded sponsor with a mandate across functions5The exec team runs on AI; it's a board-level priority

Q2Does your leadership team share an honest view of where AI actually helps the business?

1“We should do something with AI” — no shared view2Lots of opinions, no agreement3Aligned on a few real use cases4A shared, evidence-based view of where it pays5AI shapes strategy, not just operations

Q3Has the board seen a staged plan — discovery → training → deployment — with cost treated as a real constraint?

1Nothing to the board yet2A one-off “AI strategy” slide3A staged plan presented once4Discovery→training→deployment, costed and tracked5Board reviews AI progress and spend as a standing item

2Policy & governanceFoundation · caps your stage

This caps how much risk you can responsibly take.

Q4Could you publish a one-page memo today saying who's allowed to use which AI tool, for what, with what data?

1No policy — a free-for-all2Verbal “be careful”, nothing written3A draft policy exists somewhere4A clear, published acceptable-use policy5Policy is live, enforced, and kept current

Q5Do you have an enterprise “NDA box” (zero-retention / no-training) — or are people on personal accounts?

1Everyone's on personal accounts2Some personal, some expensed — no guarantees3An enterprise plan for some teams4Enterprise, zero-retention agreement org-wide5Contractually bounded, with data controls verified

Q6Is there a risk-tiered sign-off for higher-risk uses (customer-facing, regulated, decision-making) before they go live?

1No review — things just get used2Ad-hoc, case by case3A basic risk checklist exists4Tiered sign-off by risk level5Risk gates operate with audit and monitoring

3Data & knowledgeFoundation · caps your stage

There is no useful AI without clean data underneath it. Data first, AI second.

Q7Can you point to one clean, governed, queryable dataset an AI system could actually use today?

1No — the data's a mess2Data exists but scattered and ungoverned3One or two datasets you could point to4Governed, queryable datasets in key areas5Well-governed data, AI-ready by design

Q8Is your institutional knowledge reachable by a machine — or locked in PDFs, email and people's heads?

1Locked in PDFs, email and people's heads2Some documented, none searchable by AI3Key knowledge being made accessible4Most knowledge reachable via search / retrieval5A living knowledge layer AI draws on

Q9Do you know where your most valuable proprietary data lives — and whether it's safe to put near an AI tool?

1No idea — and no controls2Rough idea, no controls3Mapped the crown jewels4Mapped, classified and access-controlled5Continuously governed with clear guardrails

4Technology, tooling & security

If there's no safe place to experiment, the work happens on personal phones — which is worse.

Q10Is there a secure, sanctioned environment where a team can experiment without six months of approvals?

1Nothing — work happens on personal phones2Case-by-case exceptions3A sandbox for one team4A sanctioned environment teams can self-serve5Secure-by-default platform across the org

Q11Have you accounted for the newer risks — prompt injection, data exfiltration — not just last decade's threats?

1Not on the radar2Aware, nothing in place3Some controls for the obvious cases4Guardrails designed around these risks5Actively tested and monitored

Q12Do you run tiered access (near-frontier as default, frontier models for high-leverage users) — or blanket / nothing?

1No access, or a free-for-all2One tool for everyone (or none)3A standard tool rolled out4Tiered access by role and need5Right model to the right task, managed by cost and value

5People, skills & literacy

Adoption is a literacy problem before it's a tools problem.

Q13Could 20 people in your organisation clearly explain to the board what an LLM is — and where it breaks?

1Almost no one could2A handful of enthusiasts3A growing core group4Broad literacy across teams5Fluency is a baseline expectation

Q14Did your most senior people get trained first — or did training start (and stall) somewhere in the middle?

1No training at all2Started in the middle, then stalled3Some training, not senior-led4Seniors trained first, cascading down5Continuous upskilling at every level

Q15Have you found your existing champions — the heavy users — and are you learning from them?

1Don't know who's using AI2Aware of a few, not engaged3Champions identified4Champions supported and sharing5A network that actively drives adoption

6Adoption, workflows & value

The difference between AI you bought and AI that changed how the work gets done.

Q16Is AI woven into how real work gets done day-to-day — or a novelty people open occasionally?

1Rarely opened2Occasional, individual use3Regular use in a few teams4Embedded in core workflows5The default way work gets done

Q17Have departments mapped their workflows to find where AI fits — both tactically and strategically?

1No mapping done2Informal, one-off ideas3Some teams have mapped workflows4Systematic mapping, tactical and strategic5Continuously redesigning how work is done

Q18Do you track adoption, usage and cost — so you know what's working and what it's costing you?

1No visibility2Anecdotal only3Basic usage numbers4Adoption and cost tracked by team5Value measured against cost, steering decisions

0 of 18 answered

Answer all 18 to see your result — we'll take you to anything you've missed.