AI maturity model for small businesses
Five stages from scattered personal use to AI running as a managed part of the business, with the signs of each stage and what moves you to the next.
The short answer
Businesses are further down the AI maturity curve than they think, because the AI use that exists is personal, invisible and ungoverned: staff using consumer tools on work tasks, with no policy, no register and no measurement. That is stage one, and recognising it is the most useful thing a maturity model does, because businesses at stage one routinely buy stage-four capabilities and then conclude that AI does not work for them. The five stages are scattered use, controlled use, first automations, integrated operations, and managed capability. What moves a business up is not better technology at any point. Each step is a governance and data step: a written policy, a register of uses, a named owner, a measure against a baseline, a review rhythm, connected data. Stage one to two is an afternoon of work. Two to three is a project. Three to four is the data and systems work. Four to five is a habit. Knowing where you are tells you what to buy and, more usefully, what not to.
The five stages
| Stage | What it looks like | Signs | What moves you up |
|---|---|---|---|
| 1. Scattered | Individuals use consumer tools on work tasks; management does not know what or where | No policy; no register; no measurement; data in unknown tools | Write the data policy and the approved-tools list; build the register |
| 2. Controlled | Approved tools under business terms; staff know the rules; uses are listed | A register exists; nothing sensitive in consumer tools; still no automation | Pick one high-volume process; measure a baseline; automate it with an owner |
| 3. First automations | One or more processes automated end to end, owned and measured | Hours saved demonstrably; logs and switches exist; data being cleaned | Connect the systems; define sources of truth; extend to related processes |
| 4. Integrated | AI and automation embedded in several operational flows, sharing data | Systems connected; reporting automated; exceptions handled by people; costs tracked | Establish the review rhythm; evaluation sets; risk register; ownership across the business |
| 5. Managed capability | AI is a normal, governed part of operations, improved continuously | Quarterly reviews; measures per use; evaluation before changes; retired uses removed; board reporting | Maintain; the work is now keeping it honest |
Moving up deliberately
- Find out what is actually happening: ask people, without blame, what tools they use for work.
- Write the policy and the approved list; provide business-terms accounts so the rules are followable.
- Build the register of uses, owners and data touched.
- Choose one process, measure a baseline for two weeks, automate it with an owner, a log and a switch.
- Connect systems and define sources of truth as you extend to related processes.
- Introduce the review rhythm: quarterly, per use, against measures, with retirement of what does not earn its place.
- Add evaluation sets so changes can be judged, and a risk register for the uses that touch people or money.
- Report to the board or owner on one page each quarter.
What each stage is worth
Stage two removes a real data risk and costs almost nothing. Stage three returns hours and builds trust. Stage four changes how the business runs, with connected systems and automated reporting. Stage five is where the compounding happens, because uses are measured, improved and retired deliberately rather than accumulating. Few small businesses need to reach stage five across the whole organisation; reaching it for the two or three processes that matter most is a realistic and valuable ambition.
What this means for you
Place your business honestly on the five stages: scattered, controlled, first automations, integrated, managed. Most start at stage one without knowing it. Move up by governance and data steps rather than by buying capability, and never buy above your stage. The afternoon that takes you from scattered to controlled is the highest-return AI work available to a small business this month.
Frequently asked questions
How do we know which stage we are at?
Ask three questions. Do you have a written list of where AI is used in the business, including what staff do on their own? Is there a policy about what data may go where, and is it enforced? Has any AI use been measured against a baseline? Three noes is stage one. Yes to the first two is stage two. A measured automation in production is stage three.
Do we need to pass through every stage?
You cannot skip the governance steps, but you can move through them quickly. Writing a data policy and a register takes an afternoon. Moving from stage one to stage two is genuinely fast. The slower steps are three to four, which requires data and systems work, and four to five, which requires the habit of measurement and review across the business.
What is the risk of buying above your stage?
It is the most common way money is wasted on AI. A business at stage one, with no policy, no register, scattered data and no owner, buys an integrated AI platform or an autonomous agent. It fails on data, nobody owns it, staff do not trust it, and the conclusion is that AI does not work here. The capability was not wrong; the foundation for it did not exist.