The AI Maturity Pyramid: Where Does Your Organisation Actually Stand?
Every organisation is “doing AI” now. The question is whether they are doing it deliberately.
In conversations with CTOs, operations directors, and business owners across the UK, one pattern emerges repeatedly: there is no shortage of AI activity, but there is a widespread shortage of AI strategy. Teams are using ChatGPT. Someone has signed up for a transcription tool. A developer is experimenting with a coding assistant. The CEO read an article about autonomous agents and wants to know why the company does not have one yet.
The activity is real. The progress is often illusory. Adoption without strategy is just tool collecting.
This is why we developed the AI Maturity Pyramid — a practical framework for assessing where your organisation currently sits in its AI journey, and more importantly, for understanding what it actually takes to move to the next level. It is not a theoretical model. It is built from what we see working and failing in real businesses, including our own.
The Five Levels of AI Maturity
The pyramid has five levels, from Level 0 (no structured AI use) to Level 4 (autonomous agents). Each level represents a genuine step change in how AI is integrated into your operations — not just what tools you are using, but how much autonomy you are granting to AI systems and how deeply they are embedded in your workflows.
As you move up the pyramid, three things increase in parallel: the autonomy granted to AI, the trust required in AI systems, and the depth of integration with your existing processes and data.
Level 0: Ad-hoc / No AI
At Level 0, there is no organisational AI adoption. Individual employees might use ChatGPT for personal tasks — rewriting an email, generating a summary, asking a question they would otherwise search for — but there is no shared approach, no policy, and no alignment between AI use and business objectives.
The defining characteristic is not the absence of AI tools. It is the absence of intent. People are experimenting in isolation. The organisation has no view of what is being used, how it is being used, or whether the outputs are reliable.
Most organisations passed through Level 0 in 2023 and 2024. Some are still there. The risk at this level is not that people are using AI — it is that they are using it without governance, sending confidential data to consumer tools, and making decisions based on outputs that nobody is verifying.
Signs you are at Level 0: No AI policy exists. Nobody knows which AI tools employees are using. The phrase “we should look into AI” appears in meeting notes.
Level 1: Conversational AI
Level 1 is where most organisations sit today. AI is being used, and the organisation knows about it. ChatGPT, Claude, Gemini, or Copilot are available — possibly through a corporate licence — and teams are using them for Q&A, content generation, brainstorming, research, and summarisation.
The critical distinction at Level 1 is that the human drives every interaction. You open a chat interface, type a prompt, receive a response, and decide what to do with it. The AI is a tool you pick up and put down. It has no persistent role in any workflow. It does not connect to your systems. It does not act on your behalf.
Level 1 delivers genuine value. Teams write faster. Research takes less time. First drafts happen in minutes rather than hours. But the value is bounded by the fact that every interaction requires a human to initiate it, evaluate the output, and manually transfer the result into whatever system or process it belongs to.
Signs you are at Level 1: Teams have access to one or more chat-based AI tools. Usage is encouraged but unstructured. AI outputs are copy-pasted into documents, emails, and systems manually.
Level 2: Specialised AI Tools
Level 2 is where AI stops being a chat interface and starts being embedded in specific workflows. Rather than a general-purpose assistant that can attempt anything, you are using purpose-built AI tools that operate within defined boundaries and connect directly to the systems where work happens.
The shift from Level 1 to Level 2 is significant. These tools are not general-purpose — they are designed for a specific job, trained or configured for a specific context, and integrated into a specific workflow. They operate with guardrails. They produce outputs that feed directly into downstream processes without manual copy-paste.
At McKenna Consultants, Level 2 is where we operate day-to-day for software development. We use Claude Code as an AI-assisted development tool — not as a chat window where we ask coding questions, but as an integrated development environment tool that reads our codebase, understands our patterns, writes and modifies code within our projects, and runs our test suites. It operates within the boundaries of our development workflow: it can read files, write code, execute builds, and run tests, but a developer reviews and approves every change.
Other examples at Level 2 include AI-powered virtual receptionists that handle inbound calls using natural language understanding and route enquiries based on intent, AI transcription services that attend meetings and produce structured notes and action items, and domain-specific copilots in tools like Excel, PowerPoint, or design software that understand the context of your work.
The common thread is specificity. Level 2 tools are not trying to do everything. They are doing one thing well, within clearly defined boundaries.
Signs you are at Level 2: AI tools are embedded in specific workflows, not just used for general chat. Tools connect to your systems or operate within your working environment. Outputs feed into processes without manual transfer.
Level 3: Human-in-the-Loop Automation
Level 3 is where the relationship between human and AI inverts. At Levels 1 and 2, the human initiates every interaction — you ask the AI to do something, it does it, you use the result. At Level 3, the AI initiates the work. It monitors, analyses, and acts, then pauses at defined decision points for human review and approval.
This is agentic AI with guardrails. The system handles workflows end-to-end but recognises that certain decisions — deploying a code change, sending a communication to a client, escalating an issue to a different team — require human judgement.
We built this at McKenna Consultants with our internal system called MASS — McKenna Agentic Systems Software. MASS monitors our Azure infrastructure continuously. When it detects an error or anomaly, it does not just raise an alert. It investigates. It finds the relevant error logs, locates the related source code in our repositories, analyses the root cause, and generates a suggested fix — which might be a code change, a configuration adjustment, or an infrastructure modification. It then sends the complete analysis and recommendation to our engineering team via Slack, where a developer reviews the suggestion and decides whether to implement it.
The key insight at Level 3 is that the AI is doing the investigative and analytical work that would otherwise consume a developer’s time — trawling through logs, correlating events, reading code, formulating a hypothesis — but the human retains authority over the decision. MASS does not deploy fixes. It proposes them. The human-in-the-loop is not a bottleneck; it is a deliberate architectural choice that builds trust while delivering genuine productivity gains.
Other Level 3 examples include AI systems that draft email replies for sales teams, presenting the proposed response for human review before sending; document processing workflows where AI extracts data, populates forms, and flags exceptions for human verification; and code review assistants that analyse pull requests, identify potential issues, and suggest improvements for the developer to accept or reject.
Signs you are at Level 3: AI systems run continuously without being prompted. Workflows include defined approval or review points. The AI does the analysis and preparation; humans make the final decisions. You have invested in integrations that connect AI to your operational systems.
Level 4: Autonomous Agents
Level 4 is where AI systems act independently. They monitor, decide, and execute without waiting for human approval. The human role shifts from reviewer to supervisor — setting objectives, defining boundaries, and intervening only when the system encounters something outside its operational envelope.
This is where MASS and similar systems are heading. Today, MASS proposes fixes for human review. The trajectory is towards auto-triaging certain categories of issues — known error patterns with established fixes — and applying them automatically, notifying the team after the fact rather than before. Self-healing infrastructure, where systems detect degradation and remediate it without human intervention, is a Level 4 capability that is becoming practical for well-defined operational scenarios.
Other Level 4 applications include autonomous email triage systems that categorise, prioritise, and route inbound communications — and respond to routine enquiries — without human involvement; market and competitor monitoring agents that track trends, identify opportunities, and update dashboards or trigger alerts based on significance thresholds; and automated quality assurance pipelines that test, validate, and deploy code changes that meet predefined criteria.
Level 4 is not science fiction in 2026 — specific, well-bounded autonomous agent deployments are already in production. But it demands the highest levels of trust, the most robust governance frameworks, and the most thorough testing regimes. Granting an AI system the authority to act without human approval is an organisational decision as much as a technical one.
Signs you are at Level 4: AI systems take actions without waiting for approval. You have defined operational boundaries and exception-handling procedures. Monitoring and audit trails provide full visibility into agent decisions. The organisation has explicitly decided which decisions AI can make autonomously.
The Foundation Layer: What Sits Beneath the Pyramid
The pyramid does not float. Every level above Level 0 depends on a foundation layer comprising four pillars. Neglecting these pillars is the single most common reason organisations stall in their AI maturity journey.
Data and Integration. Levels 2 through 4 require AI systems to connect to your operational data and systems. APIs, connectors, access permissions, and data quality all matter. An AI agent that cannot reliably access the data it needs is an AI agent that will produce unreliable results. This is where organisations that skipped their data strategy discover the cost — AI adoption forces the issue.
Governance and Trust. Every level of AI adoption introduces risk that needs managing. At Level 1, the risk is data leakage through consumer AI tools. At Level 3, the risk is an AI system taking action on behalf of your organisation. A governance framework — covering data handling policies, acceptable use guidelines, risk assessment, and audit requirements — is not optional. It is foundational.
Skills and Culture. AI maturity is a people problem as much as a technology problem. Teams need the capability to work effectively with AI tools, the literacy to evaluate AI outputs critically, and the willingness to adopt new workflows. Organisations that deploy sophisticated AI tools into teams that are not prepared to use them waste money and erode confidence.
Process and Workflow. AI tools need defined touchpoints within mapped processes. Which steps are candidates for AI assistance? Where are the review points? What are the feedback loops that allow continuous improvement? Organisations that bolt AI onto undefined processes amplify chaos rather than reducing it.
Strategy First: Every Level Must Map to Business Outcomes
The pyramid sits within a strategic frame for a reason. Moving from one level to the next is not inherently valuable. What matters is whether each step delivers a measurable business outcome — reduced cost, faster throughput, improved quality, better customer experience, or competitive advantage.
An organisation at Level 1 that is using conversational AI to cut proposal writing time by 40% is in a stronger position than an organisation at Level 3 that deployed an expensive agentic system with no clear ROI. Maturity is not a league table. It is a framework for asking the right questions: What problem are we solving? What level of AI capability does the solution require? Do we have the foundation in place to support it?
The most effective AI strategies we see start with business problems, not technology capabilities. They identify specific workflows where AI can deliver quantifiable improvement, assess the current maturity level, identify the gaps in the foundation layer, and plan a deliberate progression. They do not start with “we need to be using AI agents” — they start with “we need to reduce our mean time to resolution on infrastructure incidents” and work backwards to the appropriate level of AI capability.
Assessing Your Organisation: Practical Questions
To place your organisation on the pyramid, consider these questions:
Do you have an AI policy? If not, you are at Level 0 regardless of how many tools people are using. Without policy, there is no organisational adoption — only individual experimentation.
Are AI tools integrated into specific workflows, or just available as general-purpose chat? The distinction between Level 1 and Level 2 is integration. If people are using AI in a browser tab and copy-pasting results, that is Level 1. If AI tools operate within your working environment and connect to your systems, that is Level 2.
Does AI initiate work, or do humans initiate every interaction? The distinction between Level 2 and Level 3 is agency. At Level 2, you ask the AI to do something. At Level 3, the AI identifies that something needs doing and takes the preparatory steps before bringing a human into the loop.
Does AI take autonomous action within defined boundaries? The distinction between Level 3 and Level 4 is approval. At Level 3, humans approve before action is taken. At Level 4, the AI acts and humans supervise after the fact.
How strong is your foundation? Regardless of your current level, assess your data quality and integration capability, your governance framework, your team’s AI skills, and your process documentation. Weaknesses in the foundation will constrain your progression and undermine the value of tools at every level.
Where to Start
If this framework has helped you identify where your organisation sits — and where the gaps are — the next step is building a deliberate plan to progress. Not every organisation needs to reach Level 4. But every organisation benefits from understanding its current position, strengthening its foundation, and making intentional decisions about where AI can deliver genuine value.
We have written in more detail about multi-agent AI systems — directly relevant to organisations working on Levels 3 and 4.
At McKenna Consultants, we work with organisations across all five levels — from developing AI policies and identifying first use cases, through to designing and building agentic systems like MASS. Our AI consultancy practice is built on real implementation experience, not theoretical frameworks. If you want to discuss where your organisation sits on the pyramid and what a practical path forward looks like, get in touch.
