The structured maturity models for AI adoption, capability, and governance — the AI equivalents of CMMI and P3M3. 30+ models mapped, compared, and made practical for practitioners from the delivery-maturity heritage.
No single dominant "AI CMMI" like P3M3 dominates delivery maturity. Instead the field is a sprawl of 30+ models across formal standards, analyst frameworks, consultancy models, vendor frameworks, and domain-specific instruments. The clearest CMMI/P3M3 heir is CMMI AIM — launched June 2026 as the first formally appraised AI maturity model. This wiki maps the field so a delivery-maturity practitioner can navigate it without re-learning it from scratch.
Where are we? Where do we need to be? What's the roadmap to close the gap? A maturity assessment converts the vague executive question "should we invest more in AI?" into a specific, evidence-based question: where are our capabilities relative to what our strategy demands?
Gartner's Q4 2024 survey (432 respondents, press release 2 Jul 2025) found high-maturity organisations keep AI systems in production for 3+ years at more than double the rate of low-maturity organisations — 45% vs 20%. Maturity is not a vanity score; it predicts whether AI investment survives past the pilot.
BCG's 2025 study of 1,250 executives found "future-built" organisations achieve 1.7x revenue growth, 1.6x EBIT margin, 3.6x three-year total shareholder return, 2.7x ROIC, and 3.5x patent output versus the 60% of organisations still classified as laggards.
Sadiq et al. (2021, PeerJ Computer Science) systematically reviewed 15 academic AI maturity models alone and found "maturity grid and continuous representation with five levels" is the currently trending structure — but concluded there is no consensus definition of what an AI maturity model even is.
Maturity assessment is the discipline that turns AI from an expensive experiment into repeatable value. The models converge on the same underlying structure far more than their branding suggests — the practitioner's job is not to find "the one true model" but to pick one, baseline honestly, and roadmap from evidence rather than enthusiasm.
This is the only tier of the AI maturity landscape that offers genuine third-party assurance rather than self-assessment. Until 2026 there was no equivalent of a formally appraised AI capability level. That changed with the launch of CMMI AIM — but ISO/IEC 42001 remains the only certifiable standard, and it is a conformity standard, not a levelled maturity model.
NOT a levelled maturity model — a certifiable CONFORMITY standard (you conform or you don't). Built on the Harmonized Structure with a PDCA cycle.
Govern – Map – Measure – Manage. Its Implementation Tiers function as a maturity ladder: Partial → Risk-Informed → Repeatable → Adaptive, customised via Profiles.
THE development for CMMI/P3M3 practitioners. Owned by the CMMI Institute (an ISACA subsidiary since 2016). Pilot completed early 2026 with IBM Consulting, Infosys, and Government Technical Services Corp; formal launch 23–24 June 2026.
The broader standards portfolio that feeds the data and governance dimensions of any AI maturity model.
IEEE 7000-2021 (ethics) and CertifAIEd (assurance) contribute to responsible-AI maturity but are not a comprehensive staged model in their own right.
Until 2026 the honest answer was no. As of mid-2026 the answer is: ISO 42001 offers certification of conformity, and CMMI AIM offers a true appraised maturity level — but they measure different things. Certification proves you conform to a management-system standard. Appraisal measures capability against defined process levels. A practitioner should not conflate the two when reporting to a board.
This is the most-cited tier — the models practitioners are most likely to encounter in a board pack. All are self-assessment or facilitated instruments with no third-party assurance. Treat every cross-model percentage comparison as directional, not equivalent — level definitions are not consistent across providers.
| Model | Structure | Key evidence / stat | Practitioner note |
|---|---|---|---|
| Gartner AI Maturity Model7-question self-rated survey | 5 levels: Awareness, Active, Operational, Systemic, Transformational (1–5 rating scale) | High-maturity avg 4.2–4.5; low-maturity avg 1.6–2.2 | High-level, self-reported; dimensions less transparent than MITRE. Third-party "seven pillars" expansions circulating online are NOT official Gartner IP. |
| IDC MaturityScape AIClassic CMMI-derived staging | 5 stages: Ad Hoc, Opportunistic, Repeatable, Managed, Optimized | India study: roughly two-thirds of organisations sit in the first two stages | Dimensions: People, Process, Technology, Data — plus Strategy added in "AI-Fueled Organization 1.0" (Feb 2025) |
| ForresterAnalyst self-assessment tool | AI maturity / readiness assessment with segmentation research | Used for competitive benchmarking research | Less publicly documented level structure than Gartner or IDC — engagement-based |
| Accenture "Art of AI Maturity"2×2 index (Jun 2022) | 4 categories on foundational vs differentiation axes: Experimenters, Builders, Innovators, Achievers | Experimenters 63% (score 29) · Builders 12% (44) · Innovators 13% (50) · Achievers 12% (64) — 0–100 index, median 36 | Achievers: 50% higher revenue growth, 53% more likely to have responsible-AI deployment. 17 capabilities scored. The "27% by 2024" figure widely quoted was a footnoted ML PROJECTION, never re-measured. |
| BCG 2025"Widening AI Value Gap / Build for the Future" | 3 tiers: Future-built 5%, Scalers 35%, Laggards 60% (1,250 execs, 41 capabilities) | Agentic AI ≈17% of AI value in 2025, projected to 29% by 2028 | Separate AI Maturity Matrix exists for economies/public sector. AI Radar 2026 CEO segments: Followers 15%, Pragmatists 70%, Trailblazers 15%. |
| McKinsey State of AI 2025Authoritative adoption survey — NOT a levelled model | Fielded 25 Jun–29 Jul 2025, 1,993 participants, 105 nations | 88% use AI in ≥1 function (up from 78%) · 72% GenAI · ~1/3 scaling · 39% report ANY EBIT impact · high performers ~6% (109/1,933 = 5.5%) attribute >5% EBIT to AI | Workflow redesign is the single attribute most correlated with EBIT impact. CEO governance oversight is among the attributes most correlated with bottom-line results. |
| DeloitteStrategy / talent / data / technology / operations framework | Framework + quarterly State of GenAI surveys | Tracks adoption trend over time via recurring survey | Best used longitudinally rather than as a single-point score |
| IBM AI LadderData-centric progression | Collect → Organize → Analyze → Infuse | Separate 7-dimension framework scored Silver / Gold / Platinum | Strongest where the constraint is data readiness rather than governance or talent |
Accenture's oft-quoted "27% of organisations will be Achievers by 2024" was a machine-learning projection buried in a footnote — it was never re-measured, and by most other trackers (Cisco, BCG, McKinsey) the leading tier stayed in single digits through 2025–2026. Do not let a stale projection set board expectations.
This tier contains the most rigorously decomposed and most CMMI-explicit instruments in the entire field — free, published, and government-grade. It also carries the strongest treatment for Australian practitioners, whose regulatory context is public-sector-led rather than statute-led.
THE most complete free government-grade instrument in the field. 6 pillars, 20 dimensions, 5 CMMI-derived levels — explicitly "adapted from CMMI." Published assessment tool available.
GAO-21-519SP (2021) — 4 principles: Governance, Data, Performance, Monitoring, each with key practices, audit questions, and third-party assessor procedures.
Cross-referenced from Tab 02 — Partial → Risk-Informed → Repeatable → Adaptive Implementation Tiers, the closest thing NIST offers to a maturity ladder.
Testing framework and toolkit paired with the Model AI Governance Framework — technical testing rather than staged maturity.
CDDO/GDS heritage feeding into the DSIT AI assurance ecosystem, plus government self-assessment tools for departments.
Sadiq et al. 2021 (15 models) remains the reference systematic review.
Australia is public-sector-assessment-led rather than statute-led — there is no standalone AI Act. For practitioners working in or with Australian government, this stack matters more than any global analyst model.
| Framework | Date | Detail |
|---|---|---|
| National Framework for the Assurance of AI in Government | 21 Jun 2024 | Issued by Australia's Data & Digital Ministers — the foundation assurance instrument for government AI use |
| Voluntary AI Safety Standard | Aug 2024 | 10 guardrails, aligned to ISO 42001 and NIST AI RMF |
| Guidance for AI Adoption ("AI6") | Updated Oct 2025 | Successor to the Voluntary AI Safety Standard — 6 essential practices |
| National AI Plan | Dec 2025 | Confirms reliance on existing laws plus an AI Safety Institute — no standalone Australian AI Act |
| NSW AI Assessment Framework (AIAF) | Redesigned 2025 | MANDATORY risk-based self-assessment, built with CSIRO Data61, takes <30 minutes; high/critical-risk findings escalate to the AI Review Committee |
| NSW Agentic AI Guide | Oct 2025 | Australia's first government guidance specifically for agentic AI systems |
| Australian Responsible AI Index | Ongoing | Produced by Fifth Quadrant — sector-benchmarking instrument |
| DTA Policy v2.0 | Effective 15 Jun 2026 | First mandatory requirement: internal AI use-case register with accountable owners; all 94 mandatory agencies must publish public AI transparency statements |
For Australian public-sector practitioners, the NSW AIAF plus the National Assurance Framework plus "AI6" together function as a de facto national maturity floor — even without a levelled model attached. A P3M3-literate assessor can map these directly onto the consensus dimensions in Tab 06 without waiting for a formal Australian AI maturity model to appear.
Below the enterprise-wide models sits a dense layer of domain-specific instruments — MLOps, data management, responsible AI, and the fast-emerging agentic AI category. Most are vendor-published and CMM-derived; several are the best-documented open instruments available for their specific domain.
Common axis across every MLOps model: automation and reproducibility of the model lifecycle. Maturity correlates directly with time-to-production and incident rate.
DAMA-DMBOK, EDM Council DCAM, and CDMC form the data-layer maturity foundation that every AI model implicitly depends on.
A cluster of vendor and academic instruments assessing RAI maturity specifically, distinct from broader AI capability maturity.
2024–2026 frameworks are still emerging in this domain, and frequently overlay "GenAIOps" practices onto existing MLOps structures rather than defining genuinely new staged levels.
The fastest-moving domain in the field — models are being published and revised faster than any other tier.
The best-documented open instrument alongside MITRE. Published by Microsoft Research / Aether in 2023.
5 levels: Latent, Emerging, Developing, Realizing, Leading — Microsoft's enterprise-wide model, distinct from the RAI-specific and MLOps-specific instruments above.
Structured across 4 areas (people, process, technology, data), 6 themes (Learn, Lead, Access, Scale, Automate, Secure), and 3 phases (Tactical, Strategic, Transformational).
Cloud Adoption Framework AI/ML perspective plus a dedicated ML maturity phase model: Initial, Repeatable, Reliable, Scalable.
Synthesising all 30+ models across every tier of this wiki, seven dimensions recur with remarkable consistency — regardless of whether the model calls itself a maturity model, a readiness index, or an adoption framework. These seven dimensions are the practical answer to "what should we actually assess?"
Vision, C-suite sponsorship, roadmap, and funding commitment behind AI adoption.
Quality, governance, architecture, and accessibility of the data AI systems depend on.
Platforms, MLOps tooling, compute capacity, and network readiness.
Skills, upskilling programs, defined roles, and organisational design for AI-era work.
Risk management, ethics, regulatory compliance, and oversight structures.
Experimentation appetite, change management capability, and genuine adoption behaviour.
Use case delivery, production deployment discipline, and ROI measurement.
Cisco's 6-pillar AI Readiness Index (Strategy, Infrastructure, Data, Governance, Talent, Culture) is the cleanest operationalisation of these seven dimensions into a fielded, repeatable instrument — it simply folds Operations & Value into Strategy.
MITRE's 6 pillars / 20 dimensions remains the most rigorously decomposed public instrument covering these seven consensus dimensions — if you need to defend a dimension set to a skeptical board or auditor, MITRE's published tool is the strongest free reference.
This is the flagship tab for a P3M3/CMMI-literate practitioner. Every major AI maturity model traces its staged structure back to the same CMMI ancestry that P3M3 shares — MITRE says so explicitly. That means the assessment method, the level semantics, and the "not everyone needs Level 5" principle all transfer directly.
| Level | P3M3 | IDC MaturityScape | MITRE AI MM | CMMI AIM |
|---|---|---|---|---|
| Level 1 | Awareness | Ad Hoc | Initial | Initial |
| Level 2 | Repeatable | Opportunistic | Adopted | Managed |
| Level 3 | Defined | Repeatable | Defined | Defined |
| Level 4 | Managed | Managed | Managed | Quantitatively Managed |
| Level 5 | Optimized | Optimized | Optimized | Optimizing |
MITRE explicitly states its 5-level structure is "adapted from CMMI" — the closest documented lineage to P3M3 of any model in this wiki, given P3M3 and CMMI share common ancestry via the Capability Maturity Model tradition.
| P3M3 perspective | Maps to AI dimension |
|---|---|
| Management Control | Operations & value governance |
| Benefits Management | Value / ROI dimension |
| Financial Management | Strategy / funding |
| Risk Management | Governance / responsible AI |
| Stakeholder Engagement | Culture / change |
| Organisational Governance | AI governance |
| Resource Management | Talent + infrastructure |
P3M3's attribute-based, evidence-driven, facilitated assessment methodology — culminating in a development plan — is directly transferable to AI maturity assessment.
P3M3 has AXELOS/PeopleCert-accredited assessors underpinning consistency across engagements.
The core P3M3 principle applies unchanged: set differentiated target levels per dimension tied to actual business need.
A practitioner who has run P3M3 assessments already has the hardest skill: facilitated, evidence-based maturity assessment against a staged model. The AI maturity landscape does not require learning a new discipline — it requires mapping a familiar discipline onto a new, less standardised vocabulary. Use this table as the Rosetta Stone.
Running an AI maturity assessment follows the same five-stage cycle as any mature P3M3-style assessment programme — the difference is in how the assessment types stack, and how the results are integrated with risk and governance frameworks rather than treated as a standalone score.
| Type | Cost / effort | Objectivity | Examples |
|---|---|---|---|
| Self-assessment questionnaire | Cheapest — minutes to hours | Least objective | Cisco and Gartner online tools; NSW AIAF (<30 minutes) |
| Facilitated / workshop | Days to weeks | Moderate — evidence-based, facilitator-led | MITRE, Microsoft RAI MM, P3M3-style facilitated assessments |
| Certified / audited | 6–18 month programme | High — accredited third-party auditor | ISO 42001 (annual surveillance, 3-year recertification) |
| Appraised | Formal appraisal engagement | Highest — independent SCAMPI-tradition appraisal | CMMI AIM (new as of Jun 2026) |
NIST AI RMF (risk structure) + ISO 42001 (certifiable AIMS) + a maturity model (benchmark and roadmap) are complementary, not competing.
Annually, or on material context change — new use case, new data source, or new regulation.
Maturity scores form a defensible baseline for investment cases.
Workflow redesign drives EBIT impact more than any other single attribute measured by McKinsey.
The headline number for 2026 is not adoption — it's stagnation and, in one leading index, outright regression. As expectations rise with the agentic AI wave, several trackers show organisations moving backwards on relative maturity even as investment increases.
| Study | Methodology | Key finding |
|---|---|---|
| Cisco AI Readiness Index 2025 | Double-blind, 8,000+ senior leaders, 30 markets / 26 industries, released 14 Oct 2025 | Pacesetters ~13% three years running. Only 15% have AI-ready networks; 19% fully centralised data. Pacesetters are 4x more likely to move pilots into production. |
| BCG 2025 | 1,250 executives, 41 capabilities | 5/35/60 split. Future-built organisations: 1.7x revenue growth, 3.6x TSR, 1.6x EBIT margin. |
| Accenture 2022 | "Art of AI Maturity" index | 12% Achievers, 13% Innovators, 12% Builders, 63% Experimenters. |
| McKinsey State of AI 2025 | 1,993 participants, 105 nations | 88% AI use, 72% GenAI, ~1/3 scaling, ~6% high performers, 39% report any EBIT impact. |
| IDC MaturityScape | Regional deep-dives (e.g. India study) | Majority of organisations sit in the first two of five stages. |
| ServiceNow / Oxford Economics Enterprise AI Maturity Index 2025 | 4,500 organisations | Average score FELL 20% year-on-year (44 → 35); <1% scored above 50/100; top score fell from 71 to 58; Pacesetters 18.2%. Illustrates that as expectations rise with agentic AI, organisations can move backwards on relative maturity even while investing more. |
| IAPP / Pacific AI 2025 | Governance-focused survey | 75% have AI usage policies but only 36% have a formal governance framework; only 28% (2024) had formally defined oversight roles. AI governance roles grew 17% in 2025 (Stanford HAI / McKinsey). |
| Gartner | Q4 2024 survey, 432 respondents | 45% of high-maturity organisations keep AI operational 3+ years, vs 20% of low-maturity organisations. |
The ServiceNow/Oxford Economics decline is the single most important 2026 data point for a practitioner presenting to a board: it demonstrates that "maturity" is being measured against a rising bar (agentic capability), not a fixed one. A flat or declining score does not necessarily mean an organisation regressed — it may mean the goalposts moved faster than the organisation did. Report both the absolute score and the trend in what is being measured.
With 30+ models in the field, the practical question is not "which is best" but "which fits your context, and how do you sequence adoption." This tab closes the wiki with a decision framework, a 4-stage adoption roadmap, and an honest accounting of where the whole field still falls short in 2026.
The two most natural starting points for a delivery-maturity practitioner.
Pursue third-party assurance rather than self-assessment.
Anchor on the Australian stack rather than importing a global model wholesale.
Three underlying structural families recur across the 30+ models.
Level 3 in Gartner does not mean the same thing as Level 3 in MITRE, IDC, or CMMI AIM. Never treat cross-model scores as equivalent.
Self-reported instruments are gameable and systematically optimistic. Treat cross-model percentage comparisons as directional only, not precise.
Many academic models carry weak empirical validation — cite Sadiq et al. 2021's own conclusion as the caveat.
Agentic AI capability is outpacing model updates — the ServiceNow/Oxford Economics declining scores are a direct symptom of moving goalposts.
Outside ISO 42001, there is essentially no accredited-assessor ecosystem comparable to what P3M3 practitioners take for granted via AXELOS/PeopleCert.
Many vendor "maturity models" are marketing instruments in disguise — distinguish these clearly from MITRE, GAO, NIST, and ISO before citing them to a board.
Launched June 2026, CMMI AIM is not yet battle-tested. Verify its status and case history before making a board-level commitment based on it.
Accenture's "27% Achievers by 2024" figure was a projection, never re-measured — a cautionary example of how a single footnoted estimate becomes repeated as fact.
Pick a model, baseline honestly, and roadmap from evidence — but never present a maturity score to a board without naming which model produced it and what its known limitations are. The practitioner who says "we scored Level 3 on MITRE, and here is what that specifically means and does not mean" will always out-credibility the one who says only "we are Level 3."