AI inside a company is no longer remarkable. According to McKinsey, 88% of organizations surveyed were using AI in at least one business function in 2025. Yet only about one-third had begun scaling it, and just 39% reported a company-wide impact on the bottom line.
The gap is easy to explain. In most companies, using AI means drafting emails faster, compiling reports, or generating headline options - not improving the quality of decisions, the customer experience, or the economics of the business. AI is unquestionably delivering value, but it often remains a tool for individual productivity.
That is why AI maturity is no longer measured by licenses purchased or prompts written. What matters is which problem the technology solves, which data it uses, whether it is embedded in a process, and whether the company can prove the outcome has improved.
1. Is AI Solving a Problem - or Merely Showing Up in the Workflow?
Ask yourself:
-
Can you name the specific business problem AI is being used to solve?
-
Which metric changed after it was introduced?
-
What would get worse if AI were switched off tomorrow?
Saying "we use AI in marketing" reveals almost nothing about the value it creates. It could refer to automated customer segmentation that affects sales - or to generating ten versions of the same advertising copy.
The second use case saves time too, but it does not necessarily change the business outcome. That is why companies seeing the greatest returns from AI are more likely to connect it not only to cost reduction, but also to growth, product development, and a better customer experience. They are also nearly three times as likely to redesign workflows around the technology rather than simply add a new tool to the old way of working.
Mature adoption begins when a company can name not what AI does, but the problem it no longer has to solve in the old way.
2. Does AI Know Your Company - or Start From Scratch Every Time?
Ask yourself:
-
Which internal sources are the system's answers based on?
-
Can an employee see where the information came from?
-
Does AI reflect the company's current policies, products, and history of decisions?
A public model knows a great deal, but it does not know why a particular company discontinued a product, what it promised a major client, or which exceptions apply to its internal policies. If employees have to retell that context manually in every new chat, AI remains a personal assistant rather than part of the organization's knowledge infrastructure.
Nour Al Hassan, founder and CEO of Tarjama and Arabic.AI, offered a revealing example during the panel discussion "The AI Gold Rush: How Women Can Become the Next Generation of Billionaires" at WE Convention 2025, held in Dubai on November 1-2, 2025. Over the years, her translation business accumulated billions of words translated by people. This professionally curated body of Arabic-language content became a proprietary company asset and helped improve the quality of its language model despite a significantly smaller budget than those of its global competitors.
The same underlying model is available to thousands of companies. The competitive advantage lies in the context a business has built for itself and can connect to AI securely.
3. Is AI Embedded in the Process - or Living in a Separate Browser Tab?
Ask yourself:
-
Do employees have to copy data into a chat manually?
-
Do they then have to transfer the answer back into a CRM or another system?
-
Has the process itself changed, or have individual steps simply become faster?
A chatbot helps the person who remembers to use it and knows how to phrase the request. But when the same manual steps still surround the model, the company has gained a new tool - not a new process.
In Morgan Stanley's wealth management division, an AI assistant is embedded in financial advisors' working environment and connected to the firm's internal knowledge base. The system helps retrieve information from internal documents, while other tools turn meeting materials into notes and drafts of follow-up actions. Today, the assistant is used by more than 98% of the company's advisor teams.
The value of this approach is not simply that information can be summarized faster. AI shortens the path from a client conversation and internal knowledge to the advisor's next action. Integration is what makes the time savings repeatable across an entire function.
4. Are You Measuring Outcomes - or Just Minutes Saved?
Ask yourself:
-
Are you counting the time spent correcting AI-generated work?
-
Has the quality of the final output changed?
-
Is the AI metric connected to the customer, revenue, cost, or decision accuracy?
Speed is the easiest benefit to notice. If a document now takes twenty minutes instead of two hours, it is tempting to declare the experiment a success. But that figure says nothing about how much time was later spent reviewing, approving, and correcting errors.
That is why the acceptance rate of generated materials matters more than the number of texts produced; total resolution time matters more than the speed of the first response; and durable impact on quality or process cost matters more than the number of users.
Morgan Stanley, for example, built an evaluation system before rolling out its AI tools broadly. Experts tested responses against real-world scenarios and assessed the reliability of information retrieval and summarization. In a regulated financial industry, quality control - not speed alone - made it possible to scale the system across the organization.
Time savings become a business result only when they are not paid for through downstream rework and increased risk.
5. Who Is Accountable When AI Gets It Wrong?
Ask yourself:
-
At what point is a person required to review the output?
-
Can AI independently send, change, approve, or reject anything?
-
Who is accountable if an employee follows an incorrect recommendation?
When AI is drafting an internal document, the cost of an error is usually limited to an employee's time. The stakes change when the system responds to a customer, analyzes a contract, evaluates a candidate, or recommends a financial decision.
Human oversight does not mean manually rechecking every line. The level of control should reflect the consequences: sorting incoming emails and denying a customer a service require very different levels of supervision.
The U.S. National Institute of Standards and Technology framework treats AI risk management as an ongoing discipline that includes mapping the context, measuring risk, managing it, and responding as conditions change. Accountability should be established before an incident occurs - in the form of a process owner, review rules, and a clear procedure for handling errors.
McKinsey likewise identifies clearly defined situations in which an output requires human review as one of the practices used by companies generating the greatest value from AI.
6. Does AI Operate Within Company-Wide Guardrails - or Does Every Employee Set Their Own?
Ask yourself:
-
Is it clear which data must never be uploaded to public services?
-
Do the rules differ by tool and use case?
-
Does the company know which AI services employees are already using on their own?
The absence of formal guardrails does not mean AI is not being used. It simply means one employee uploads a contract to a public chatbot, another avoids using any work data at all, and a third applies a model in hiring without telling colleagues.
A blanket ban rarely solves the problem. What matters is the type of data, the tool, and the potential consequences of an error. Generating an advertising headline and analyzing medical or financial information cannot be governed by the same rules.
According to McKinsey, 51% of respondents at organizations using AI had already experienced at least one negative consequence, most often inaccurate outputs. NIST separately highlights risks involving privacy, intellectual property, unreliable answers, and excessive trust in the model.
Clear guardrails do not slow adoption. On the contrary, they allow cautious employees to use AI without fear - and prevent enthusiastic users from turning an experiment into an uncontrolled risk.
7. Does a Successful AI Practice Belong to the Company - or to One Enthusiast?
Ask yourself:
-
Where are proven use cases and review rules documented?
-
Can another employee reproduce the same result?
-
What happens if the person who created the solution leaves the company?
In many organizations, AI adoption begins with a handful of enthusiasts. They discover effective use cases, write prompts, and help colleagues. But when all that knowledge remains in personal chat histories, the company is still dependent on particular individuals.
When biotechnology company Moderna introduced ChatGPT Enterprise, it created training, regular office hours, and a network of internal AI champions. Its internal forum drew about 2,000 active participants each week, and employees developed 750 custom GPTs in the first two months. Individual solutions also began to be embedded in clinical, legal, and communications work.
The number of assistants does not, by itself, prove maturity. What matters is whether a successful solution can be tested, transferred, and maintained. A company should preserve not only the prompt, but also the problem it addresses, its data sources, limitations, quality criteria, and accountable owner.
If the technology lives in a separate tab and its impact is described only by the number of texts generated, it is still augmenting individual employees. When AI changes the process, draws on company knowledge, is subject to review, and produces a measurable result, it finally begins to work for the business itself.
