Everyone Is Behind

There is a lot of money moving into enterprise AI and very little agreement on what good looks like. Most firms measure themselves by looking sideways at competitors. That tells you nothing useful. They are most likely no further along than you are.

Six months ago I developed my own maturity framework, and it is the basis of all the work I do with companies now. The McMillanAI Enterprise Maturity Framework scores a company across six dimensions: strategy and executive alignment, layered AI infrastructure, data and content readiness, governance and risk, adoption and organizational transformation, and use prioritization and portfolio management. Each is scored on four levels.

The point is not the score. It is that a firm can look at any dimension, see where they are, and then figure out what to do next. It is intended to be simple to understand and gives companies a framework from which to act.

Download the PDF

About This Assessment

This is a practitioner assessment, not a survey. It is informed by several hundred executive conversations, direct advisory work, board discussions, and implementation reviews across a range of industries during the first half of 2026. The companies I have seen were not selected as a statistically representative sample, and the ratings reflect recurring patterns I have observed against the framework rather than a formal scoring of a fixed set of firms. I am publishing this six months into the launch of my firm, and I plan to update it every six months, so each edition can show where the market has moved.

What I See

Start with the obvious. Most firms are stuck between Ad Hoc and Emerging, the bottom two levels of the four. A few reach Managed, Level 3, on an individual dimension.

Three findings sit underneath that.

The field is still open

Most companies are still early on the curve. The lead is there for any firm willing to do the work.

Strength is in what you can buy, weakness in what you must build

The most maturity shows up in capabilities a firm can purchase or inherit, like models, tools, and an existing audit function. The least shows up in the capabilities it has to build organizationally.

Leadership is the strongest predictor

The firms furthest along all share a deeply engaged CEO and a senior team that is genuinely aligned, creative, and disciplined.

The title, the committee, the policy, and the tool are in place. The discipline that makes them work is not. Each dimension below is marked with where I see most firms today, on the four-level scale above.

Strategy and Executive Alignment

Few firms have an AI strategy you could actually sit down and read. Most have named someone to lead, but roles blur across the C-suite, and the owner often lacks the authority to match the title. There is usually a steering or operating committee, though whether it changes any real decision is an open question. Boards are still feeling their way here as well, getting up to speed on what their own role should be.

Few leaders communicate a clear vision. Most have not moved real money to where it is needed, which is people and training. And almost none have honest ROI metrics or independent validation. Most firms have built the parts that signal alignment. What they have not built is the real thing: senior leaders who agree on the plan and act on it together.

Layered AI Infrastructure

Emerging, and lopsided. Most firms have deployed an AI tool to most of their people, and most are running more than one model, which is the most advanced part of the picture. The layers you have to build are the ones that are thin or missing.

The middle of the stack is the set of reusable enterprise capabilities that sit between the models and the interfaces: a governed data and semantic layer that makes firm knowledge retrievable, orchestration that lets AI act across systems and people, and evaluation and observability that tell you whether any of it is working. Only a few firms have built it. Very few have real governance and controls. Few have an enterprise orchestration layer, and fewer are even thinking about one.

Firms bought access to models and a mix of AI tools, and skipped the infrastructure that really matters. Without that middle, every use case rebuilds its own retrieval and controls, and nothing compounds. That is why the tools are everywhere and the value is not.

Data and Content Readiness

This is where most firms are weakest, and it is the ground everything else stands on. Few have a coordinated view of which data actually matters for AI. Some have appointed a Chief Data Officer and a cross-functional committee, but their effectiveness is suspect. Risk-based issue tracking is rudimentary. Few have named owners for specific data domains. Quality measurement is ad hoc.

Knowing what you have, who owns it, and whether it can be trusted is slow, unglamorous work, and it is work that very few have done. It is also the least visible failure. You usually do not find out until months later, when the system produces a confident answer that turns out to be wrong.

A handful of firms do have a real handle on their data. I believe that will prove to be one of the most durable advantages in AI. Model advantages commoditize quickly, because a competitor can buy the same model. A proprietary, well-governed data estate is far harder to copy.

Governance and Risk

Emerging, and split by industry. Most firms have some kind of AI usage policy. Whether it is understood and followed is a separate question. The heart of mature governance is not the number of restrictions. It is the ability to vary controls by risk, so that a high-stakes use case and a trivial one do not move through the same process. Few firms have a real risk classification, so today they often do exactly that.

Accountability is often muddled. The exception is audit, where AI frameworks are emerging fastest in firms that already have serious audit functions, such as those in financial services, healthcare, energy, and insurance. Guardrails and conduct controls are still very ad hoc.

Most governance today is a document. Real governance changes how a use case gets built, and that is still rare. The problem is not that firms are reckless. It is that they have not evolved their standard risk playbook for a different kind of problem.

Adoption and Organizational Transformation

Ad Hoc to Emerging, and still largely organic. This is where strategy either turns into real change or goes nowhere, and in most firms it runs on individual energy. Across most organizations, no one is sure who owns change management. Leadership modeling depends on the CEO: some are all over it, others do not engage at all, and the absence is felt throughout the organization.

Training is ad hoc and mostly ineffective because it is not built for the specific role. Many teams have AI champions, but the network is organic and uncoordinated. Cross-business sharing is not structural. Communication is thin.

The deepest gap is workflow. Very few have done that yet. Adoption is happening in pockets, wherever someone pushes it, and little of it is built into how the firm works.

Use Prioritization and Portfolio Management

Emerging, and the one dimension with real momentum. The disappointment of scattered tools that never produced a return is finally forcing firms to prioritize. But portfolio management is a full capability, not a single gate. It means identifying opportunities, estimating value and feasibility, allocating resources deliberately, measuring realized value against a baseline, scaling what works, and retiring what does not. Most firms do one or two of those, not all of them.

It also means a repeatable path that carries a use case from idea to design, build, evaluation, production, and monitoring, rather than every team improvising its own. That delivery capability is where scattered pilots either become dependable systems or stall. The momentum is real, because the cost of doing this badly finally got large enough to force the discipline. But few firms have built the whole capability.

What To Do Now

The pattern points straight at the work. Stop buying more AI tools and start building the operating capabilities underneath them. In practice that comes down to three things.

1. Align the senior team

The CEO and executive team have to be in the details, not just endorse the effort, with clear accountability and decision rights. It is the single strongest predictor of everything else.

2. Build the middle

Invest in the capabilities between the models and the interfaces: governed data, orchestration, evaluation, and enforced controls. This is where AI becomes repeatable instead of one-off.

3. Redesign the work

Move past access and usage to changing how the work is actually done, with role-specific training and workflows rebuilt around what AI can do.

Technology is obviously a key element here, but it alone is not what sets the best firms apart. What differentiates is a leadership team that decides this matters and chooses to be both creative and disciplined about it. That is the difference between Ad Hoc and Scaled, and it is available to any firm willing to lead.