The 4 Levels of AI — Where Does Your Organisation Really Stand?

Version 2, October 2026. The first version measured how sophisticated your AI tools were (Chat, Automate, Build, Shared apps). Current research and Microsoft's own adoption guidance measure more than tool use. They look at whether the controls and the measurement are in place too. So this version changes three things:

• Levels are evidence-based and run from zero. Level 0 and "Not sure" are now options, and Level 3 is about delegating multi-step work to agents rather than just building apps. Each level asks for something you could show.
• A second axis: eight foundations. Visibility, rules, data access, human oversight, agent control, measurement, skills and ownership.
• An instant result. You get a profile, your weakest areas and your biggest gaps on screen as soon as you finish.

The evidence behind the foundations:

• McKinsey, The state of AI in 2026 (August 2026, 1,719 respondents): 37% attribute any EBIT impact to AI. The roughly 6% of "high performers" are twice as likely to have defined processes for measuring AI's impact, and nearly three-quarters of them have fundamentally redesigned workflows.
• MIT CISR Enterprise AI Maturity Model (survey of 721 companies): most enterprises studied were in the first two of four stages, and their financial performance was below their industry average. Firms in stages three and four performed well above it.
• Microsoft Work Trend Index 2026 (20,000 AI users in 10 countries): organisational factors (culture, managers and talent practices) accounted for 67% of reported AI impact, and individual effort for 32%. These are associations, not proof of cause and effect.
• Microsoft's agentic AI adoption maturity model assesses strategy, process and value, governance and security, technology and data, and culture together, not tool use alone.
• The NIST AI Risk Management Framework (Govern, Map, Measure, Manage), and POPIA section 71, which restricts decisions with legal or substantial effects on a person that rest solely on automated profiling. South Africa's Draft National AI Policy proposes risk-based oversight. Public comment closed on 10 June 2026, and it is not yet law.

Its limits. This is a self-assessment, not an audit, and it does not compare you with other companies. People rate themselves generously. A peer-reviewed study found that people using AI overestimated their own performance, and that those with more AI knowledge assessed themselves less accurately (Fernandes et al., 2026, Computers in Human Behavior). That is why every level asks for evidence and why "Not sure" counts as a gap. Treat a high score as a claim to check, not a conclusion.