From One Workflow to Org-Wide: What AI Maturity Actually Looks Like Two Years In

• 01 / The maturity myth

The maturity myth

Corporate technology programmes have long had a fondness for maturity models: neat ladders promising a clean ascent from “initial” to “optimised”. They are useful right up to the point where they become decorative.

AI maturity is not a score awarded for having a steering committee, a model inventory or a colourful dashboard. Nor is it the number of pilots completed, prompts written, employees trained or vendors contracted. It is a lived organisational condition.

You can see it in ordinary work. A frontline employee knows which AI tool they are allowed to use, what information they may put into it, when an answer must be checked and how to report a failure. A manager can explain who owns an automated decision and what happens when the system is wrong.

Most importantly, the organisation has made choices. It has decided where AI should not be used, where human judgement remains non-negotiable and where automation is genuinely worth the operational and governance cost.

A thousand employees using a chatbot independently may create a lot of activity. They do not necessarily create a more capable organisation. The real test is not, “Can people use AI?” It is, “Can the organisation reliably produce better work with it?”

“Use AI everywhere” is not a strategy; it is an abdication of strategy.

• 02 / The shift from tool to workflow

The shift from tool to workflow

A workflow is simply how work gets done: who starts it, what information they need, what decisions they make, what they hand off, which systems they use, where it stalls and how anyone knows the result is good.

Take a communications team producing a briefing for senior leaders. The immature use case is familiar: an individual uses a general-purpose assistant to turn notes into a draft. It may save 20 minutes. It may also create a polished generic document with invented details, unclear sources and the same old approval bottleneck at the end.

The more mature workflow begins with an approved source pack. AI classifies feedback, retrieves prior material and assembles a first draft. A named editor remains accountable; claims link to sources; uncertain material is flagged; and the reviewer sees a concise decision log.

The difference is not a better prompt. It is a redesigned system of work. Faster production is valuable only if it creates better service, lower risk, higher quality or more capacity for important work. Workflow redesign is not a nice-to-have change-management addition. It is the work.

• 03 / What maturity looks like

Five observable shifts

Stop picturing an upward staircase. Look for five shifts. They do not happen neatly or in the same order, but without them a company is probably scaling access rather than scaling capability.

If results collapse when the star performer is on holiday, you do not have organisational maturity. You have a gifted user.

• 04 / Governance & literacy

Disciplined permission, situated judgement

Working guardrails answer the questions people have on Tuesday afternoon: which tools are approved, what data must never enter a public system, when a person must review an output, which decisions AI may inform but not make, and who can pause an automated workflow.

The arrival of agents makes this more urgent. The risk moves from bad content to bad action. Mature governance defines permissions, spending limits, tool access, approval points, logging, monitoring, exception handling and liability.

Real literacy is contextual. A recruiter faces different risks from a finance analyst; a communications professional must assess sources, factual reliability, copyright and reputational harm. The best learning uses real tasks, seductive bad outputs, source checking and practised escalation.

• 05 / The awkward middle

The awkward middle

The hardest stage is not the first pilot. It is the awkward middle: after excitement, before institutional confidence. Different teams have bought different tools. Security has issued a restrictive memo that people work around. Employees are worried about jobs while leaders want returns but cannot agree how to measure them.

This phase is normal. The problem is pretending it is not happening. Leaders must say plainly what is changing and what is not. Change communication is not the email announcing that a tool is available. It is the continuing work of making change intelligible.

• 06 / A two-year test

A two-year test

Two years in, an organisation should know its priority workflows. Give every scaled use case a named business owner, rather than relying solely on a central AI team. Back it with an intelligible risk model and credible evidence: baseline measures, observed outcomes, user feedback and an honest account of where the intervention did not work.

It should also be changing skills and roles deliberately. AI maturity is not achieved when people become faster at performing the old job. It arrives when the organisation decides which parts should be automated, augmented, safeguarded or made more human.

• 07 / The work starts after deployment

The work starts after deployment

Organisations are not software interfaces. They are collections of habits, incentives, informal knowledge, power structures, legacy systems, professional standards and people trying to get through the day. AI enters all of that. It does not float above it.

The companies that pull ahead will do the less glamorous work: map the workflow, remove pointless steps, improve data and knowledge practices, clarify decisions, equip people to exercise judgement, measure consequences and build safeguards before something goes wrong.

The first two years were about discovering what the tools could do. The next two should be about deciding what work is worth changing – and building organisations capable of changing it well.

In other words, they will treat AI as organisational change.