AI maturity in a company: how to assess it in practice

AI maturity in a company: how to assess it in practice

A company's AI maturity is measured by what it actually does with AI, not by what it claims: how many processes depend on it, under which rules, with which measured results, and who is accountable. An SME can place itself on a five-level scale in an hour, provided it answers factual questions rather than opinion questions.

Most online tests produce a score out of 100 and a radar chart. That feels reassuring, but a score does not tell you what to do on Monday morning. This article offers a plainer grid, built for companies with 10 to 250 employees: five levels, five dimensions, twelve verifiable questions, and for each level the decision that follows. It is part of our guide to AI in business for SMEs, which covers the full approach.

What AI maturity really measures

AI maturity measures a company's ability to get a repeatable result from AI, not how well equipped it is or how enthusiastic its staff are. A company that bought licences for everyone but has no documented use case is less mature than a 15-person business whose customer service handles 40% of requests with a supervised assistant.

Three confusions come up again and again:

• Maturity versus adoption. Half your staff using a chat assistant says nothing about the maturity of the organisation. That is individual adoption, often invisible to management.
• Maturity versus budget. Spending more does not move you up a level. Moving from one level to the next almost always comes down to an organisational decision (an owner, a written rule, a metric), rarely to a purchase.
• Maturity versus technology. An SME can be highly mature without writing a single line of code, if it uses off-the-shelf tools well. France's national statistics office, Insee, notes that 80% of companies using AI rely on ready-to-use software.

The term itself is defined in our glossary under AI maturity. The key point: you assess observable practices, not intentions.

The five AI maturity levels of an SME

An SME almost always sits at one of these five levels, and the level can be read from a single test: what would happen if the AI tool disappeared tomorrow. If nobody would notice, you are at level 1 or 2. If a process would stop, you are at level 3 or above.

Two remarks. First, few SMEs need to reach level 5. A 20-person firm at level 3 on two well-chosen processes gets more value from AI than a scattered mid-sized company at level 4 across fifteen pilots. Second, levels are not uniform within a company: sales can be at level 3 while accounting stays at level 1. That is normal, and it is useful information.

The five dimensions to assess

A company's overall level is capped by its weakest dimension: an SME with excellent use cases but no data rules stays stuck at level 2. Public and private frameworks slice things differently, but the same five blocks always appear.

1. Use cases. How many recurring tasks rely on AI, and does management know about them?
2. Data. Are your documents and information accessible, organised and up to date? Do you know which ones must never be entered into an external tool? This is the point that most often blocks the move to level 4, which is why data structuring nearly always comes before ambitious projects.
3. Skills. Have the people using AI been trained, beyond a demo? Do they know how to check an answer?
4. Governance. Is there a written rule, an owner, a list of approved tools? Regulation (EU) 2024/1689, the AI Act, has required since February 2025 that companies deploying AI systems ensure a sufficient level of AI literacy among their staff (Article 4). Governance is no longer a nice-to-have.
5. Measurement. Do you track at least one metric per use case: time saved, volume handled, error rate? Without a KPI, there is no way to know whether a use case deserves to be extended or dropped.

The one-hour self-assessment: twelve factual questions

Answer yes or no, with evidence for every yes: a document, a name, a number. An answer like "we are starting to think about it" counts as a no. This is deliberately strict, and that is what makes the exercise useful.

Use cases

• Can you name, without looking, three specific tasks done with AI in the company last month?
• Would at least one process stop or slow down noticeably if the AI tool were switched off?

Data

• Is there a written list of information that must not be entered into an external tool (customer, employee, financial data)?
• Are the reference documents for your business (prices, procedures, templates) stored in one place and up to date?

Skills

• Have the people who use AI every week attended training of at least half a day?
• Can you produce a record of that training (certificate, attendance sheet, programme)?

Governance

• Is a named person responsible for AI in the company, with time allocated?
• Is there a list of approved tools, with business accounts rather than personal ones?
• Do you know which unapproved uses exist today?

Measurement

• Did you measure the time spent on at least one task before adding an AI tool?
• Have you tracked a quantified metric on at least one use case for more than three months?
• Have you ever stopped a use case because it was not paying off?

Reading the result. 0 to 2 yes: level 1. 3 to 5: level 2. 6 to 8: level 3. 9 to 10: level 4. 11 to 12: level 5. Then look at the distribution: three noes in the same dimension point to your bottleneck, whatever the total.

The last question often surprises people. Yet it is the best single indicator of maturity: a company that has never stopped anything is not really measuring, or has only launched low-stakes uses.

Why online questionnaire scores mislead

An opinion questionnaire measures the respondent's perception, not the state of the company, and the manager who fills it in almost always overrates their practices. Questions such as "is AI part of your strategy?" invite a flattering answer. Nobody ticks "not at all" on a topic they discuss at board meetings.

Online tools have their place. The data and AI maturity test offered on France Num, the French government's digital portal for small businesses, gives a free first benchmark in about fifteen minutes. It is useful to open the conversation internally. It is less useful for deciding, because it positions the company against an average without checking the answers.

Three biases to keep in mind before trusting a score:

• The single respondent. Managers often do not know what really happens on the ground, and staff do not know which decisions have been made. Have two or three people at different levels fill in the grid and compare the gaps. The gaps are the most interesting result.
• Confusing intention with practice. "We plan to train our teams" is not training.
• The average score. An average of 3 out of 5 can hide a 5 on use cases and a 1 on governance. That profile is the riskiest of all, and the average makes it invisible.

What Insee figures say about the real maturity of SMEs

According to Insee's survey on information and communication technologies in companies in 2025, 18% of French companies with 10 or more employees report using at least one AI technology, but only 15% of those with fewer than 50 employees. The rate rises to 31% for companies with 50 to 249 employees and 58% for those with 250 or more.

The survey goes beyond the usage rate, which is what makes it relevant to maturity. Among AI users, Insee identifies a group, more than 80% of which are companies with fewer than 50 employees, whose use is concentrated on a single technology, most often generative AI. In this group, 28% of companies report no specific purpose for their use of AI. That is the signature of level 2: using AI without knowing exactly what for.

The reported obstacles point the same way. Among companies that do not use AI, 71% say they see no use for it and 54% cite a lack of expertise. And among those already using it, 53% say they are held back by that same lack of expertise. In other words, taking the first step does not solve the skills question: it comes back at every level.

For an SME, the practical reading is simple. If you already use AI, you are in a minority among companies your size, but you are most likely at level 2. The job is not to adopt, it is to structure.

What to do at each level

Each level calls for one main action, and only one: trying to jump two levels at once is the most common reason AI projects are abandoned after six months.

• Level 1. Take stock of existing uses without looking for someone to blame, then write a one-page rule on which data stays inside the company. A collective awareness session gives everyone the same vocabulary.
• Level 2. Choose a single high-volume, low-risk use case, measure the time spent beforehand, and name an owner. Our method to calculate AI ROI for SMEs gives you the measurement framework.
• Level 3. Train the teams involved properly, on their own documents, and set up monthly tracking of metrics. This is also the right time to budget the next stage: our article on how much AI costs an SME in 2026 details the cost items.
• Level 4. The work is about data and integration. An outside view becomes useful for prioritising: see our article on AI audits for SMEs, method and pricing.
• Level 5. Reassess once a year, stop what no longer pays off, and keep an eye on regulation, in particular the obligations covered in our AI Act guide for SMEs.

One point of attention on change management: from level 3 onwards, AI changes job descriptions. Teams that were not involved in choosing the use cases are the ones that work around them.

Frequently asked questions

How long does it take to move from one level to the next? For an SME, allow three to six months between levels if someone owns the topic with dedicated time. Without a named owner, a company can stay at level 2 for years, even with paid tools.

Should you hire a consultancy to assess your AI maturity? Not for a first assessment. The twelve-question grid in this article is enough to place an SME. An outside expert becomes useful at level 3 or 4, when more expensive projects need prioritising and the internal view lacks distance.

Who should complete the self-assessment? Ideally two or three people: the manager, an operational lead and a regular user. Compare their answers. A two-level gap between management and the ground is common, and it usually points to undeclared uses.

Is AI maturity linked to the AI Act? Yes, on the skills and governance dimensions. Article 4 of Regulation (EU) 2024/1689 requires companies deploying AI systems to ensure AI literacy among their staff. A company at level 1 or 2 is rarely able to prove it.

Can a five-person micro-business aim for level 3? Yes, and it is actually easier than in a larger organisation: fewer processes, faster decisions. A single well-chosen use case, documented and measured, is enough to reach level 3.

How often should you reassess your maturity? Once a year is enough for an SME, or at every significant change: a new tool rolled out, a reorganisation, a new manager. Keep previous answers to track progress dimension by dimension.

How GrowthPerf supports SMEs at every level

GrowthPerf is a Qualiopi-certified training provider specialising in AI, no-code and automation for SMEs and nonprofits. We do not sell software. Our work focuses on the dimension that most often blocks progress, according to Insee and to what we see in the field: skills.

For companies at levels 1 and 2, the AI for Business awareness training lays down in one day the shared basics, the data rules and a first list of use cases. For those aiming at level 3, the Operational AI for SMEs programme works for two days on your own processes and documents, with a before and after measurement. Both formats are eligible for funding through your OPCO, the French sector-based training fund.

If you are unsure about your level or the right first step, a 30-minute call is usually enough to take stock using the grid in this article. Book your free 30-minute AI audit. And to place this assessment within a complete approach, from scoping to rollout, see our complete guide to AI in business for SMEs.