AI maturity in companies: how to assess it and what to do next

Why assess your AI maturity?

AI use is growing fast. According to Insee (the French national statistics institute), 18% of French companies with 10 or more employees used at least one AI technology in 2025, 8 points more than in 2024, and 58% of companies with 250 or more employees. Eurostat measures an average of 19.95% across the European Union the same year.

Skills are lagging behind. Again according to Insee, 53% of companies using AI say their use is held back by a lack of expertise. At EU level, among companies that considered AI without adopting it, lack of expertise is the first barrier cited (70.89%), ahead of lack of clarity about legal consequences (52.52%), according to Eurostat.

A maturity assessment serves three purposes: avoiding buying tools nobody will know how to use, targeting training efforts, and having a starting point to measure progress. It also provides the inventory of uses the company needs to meet Article 4 of the AI Act.

Which dimensions to examine?

There is no single official AI maturity framework. Public tools do, however, converge on a few dimensions. The Autodiag IA offered free of charge by Bpifrance (the French public investment bank; 32 questions, about 15 minutes) assesses, for example, use opportunities, the maturity of the organisation and its teams, the digitalisation of processes and the usability of data. The NIST AI Risk Management Framework (AI RMF 1.0, 2023), intended for voluntary use, structures governance around four functions: govern, map, measure, manage.

Dimension	Questions to ask
Uses	Which AI tools are used, by whom, for which tasks, on which data?
Skills	Can users check an output, spot an error, protect confidential data?
Governance	Are there usage rules, a person in charge, an incident procedure?
Data	Is the necessary data available, of good quality and usable in compliance with the GDPR?
Culture	Do teams share their uses, including failures, or hide them?

The inventory of uses often holds surprises: employees use consumer tools individually, without the company knowing. These uses count for the AI Act, which applies to all professional use.

Which maturity levels to distinguish?

The following grid is a reading aid, not a standard. It helps position the organisation and choose the next step.

1. Unmanaged uses. Tools are used individually, with no rules or inventory.
2. Experimentation. A few teams test tools, without coordination or evaluation of results.
3. Controlled deployment. A few priority use cases are identified, with usage rules, a point person and targeted training actions.
4. Integration. AI is integrated into several processes, with formal governance, indicators and training paths differentiated by job.
5. Continuous improvement. Uses, tools and skills are regularly reassessed and adjusted based on observed results.

What to do at each level?

Levels 1 and 2: take inventory and set rules. List tools and uses, write simple usage rules (authorised tools, data not to be entered, human review of outputs) and start awareness actions suited to the uses observed. The AI Act sets no minimum training duration: measures are calibrated to the tools, the people and the risks, as explained in AI Act Article 4: mandatory AI training, what companies must do.

Level 3: differentiate and measure. Build paths by population and check what people can do after training. Priorities by profile are detailed in Which AI skills to train first by role and sector.

Levels 4 and 5: govern data and tools. Questions of data protection, traceability of AI-assisted decisions and continuous evaluation of tools become central. Some uses, such as screening job applications or assessing learning outcomes in education and vocational training institutions, fall under the high-risk systems of Annex III of the AI Act, whose obligations apply from 2 December 2027.