AI Maturity Stages: Why Most Orgs Stall at Stage 1 (September 2026)
Only 26% of companies generate real AI value. Use the four company brain maturity stages to find where your org stands. September 2026.
Maintouch
There’s a real difference between AI activity and AI outcomes, and most organizations are living on the wrong side of it. If your teams each picked their own tools and your data lives in five different places, the four-stage framework below will show you exactly where you are and what it takes to get unstuck.
TLDR:
- Most organizations are stuck at Stage 1: AI working for individuals, not the organization, with no shared queryable corpus.
- BCG (October 2024) found only 26% of companies moved beyond proofs of concept to generate actual value.
- The blocker between Stage 1 and Stage 2 is almost never tech: it’s ungoverned data and unresolved consent architecture.
- Stage 3 is where conversation data joins your CRM, Jira, and docs so agents can answer “why did we make that call nine months ago.”
- Spinach AI centralizes conversation data company-wide with governance built in, routing it to agents via MCP on Business and Enterprise plans.
What an AI Maturity Model Actually Measures
An AI maturity model is a diagnostic framework for assessing how systematically an organization has embedded AI across its operations, from early tool experiments to enterprise-wide value creation. The MIT CISR Enterprise AI Maturity Model maps four distinct stages and the capabilities required to progress through each one, finding that companies with advanced AI capabilities consistently outperform their industry peers financially. The four stages in this post are adapted for conversation data governance; for MIT CISR’s original stage definitions, see the linked briefing.
What the model actually measures is not how many AI tools you’ve deployed. It measures whether AI is producing systematic, compounding value across the organization. Those are very different things, and the gap between them is where most companies quietly get stuck. The four stages below are adapted for conversation data governance; for MIT CISR’s original stage definitions, see the linked briefing.
Why Most Organizations Overestimate Their AI Maturity
Tool adoption and organizational maturity are not the same thing, and confusing the two is exactly why self-assessments skew high. Buying a notetaker, turning on Copilot, shipping a chatbot pilot: each one registers as progress. Few feel like they are standing still.
BCG’s October 2024 survey of 1,000 CxOs across 59 countries found that only 26% of companies had developed the capabilities needed to move beyond proofs of concept and generate measurable value. The other 74% had AI activity without AI outcomes.
The blocker is rarely access to models or tools. It is the absence of a governed data foundation those tools can actually use. Compounding AI value cannot be built on top of fragmented, unqueryable data, regardless of how many pilots are running.
Stage 1: Crawl. Automating Individual Tasks
Most organizations actually live here, regardless of what their AI strategy deck says.
The pattern is familiar: someone on the product team starts using an AI meeting notes tool. Sales picks a different one. Engineering turns on Copilot. Each person solves their own problem, and the organization accumulates a loose collection of individual productivity wins with no connection between them.
The output is per-user notes, per-user summaries, per-user action items. No shared record, no queryable corpus, no data an agent could act on. Five teams, five tools, five silos.
That is the defining characteristic of Stage 1: AI is working for individuals, not for the organization. Each win is real but isolated. None of it compounds.
Stage 2: Centralize. Treating Data as an Organizational Asset
The move to Stage 2 is a structural decision, not a tool purchase. Centralization means one governed system captures conversations across every team and channel, with access policies enforced at the org level instead of set by each user individually. The resulting corpus is something the organization owns and can query, not a folder of per-user exports.
In practice, that means replacing per-meeting sharing decisions with org-wide policy, so conversation data from a product review, a sales call, and a leadership all-hands lives in the same governed system instead of scattered across four tools nobody fully controls.
Very few organizations have genuinely completed this stage. Most have centralized some conversations for some teams. That partial state leaves the corpus fragmented enough that no agent can reliably use it.
What Actually Blocks the Move From Stage 1 to Stage 2
The bottleneck is almost never tech. Organizations that stall between Stage 1 and Stage 2 typically have the tools they need. What they are missing is the organizational and legal design work that makes centralization legitimate.
The real blockers:
- Meeting recording security and compliance considerations, specifically consent mechanics and recording notification design that haven’t been reviewed by legal or HR.
That last point carries real consequences. A toggle that makes opting out frictionless will empty the corpus, but heavy friction signals coercion. The version that works asks for a reason without blocking the action, so the organization gets a signal without a gate. The consent architecture question compounds this: whose consent governs a recorded meeting, the host, the organizer, or every attendee? Each choice breaks something, and most organizations have never formally decided.
Stage 3: Company Brain. Joining Conversation Data to the Rest of the Business
Stage 3 is where centralized conversation data stops being an archive and starts being an input. The governed corpus from Stage 2 connects to the organization’s other conversation data system of record (CRM, project tools, documents, chat) so any of it can be queried together.
The value shift is qualitative, not incremental. An agent can only answer that question when the meeting record is joined to the Jira ticket it affected, the Slack thread that preceded it, and the strategy doc that framed the decision. Any one of those in isolation is a fragment. Together, they are institutional memory that is actually queryable.
At Stage 3, conversation data and business data inform each other. The person who used to hold all of this in their head, the one everyone books time with to ask why things happened, gets replaced by something that supports cross-functional team collaboration without a single point of failure.
Stage 4: Continuous Optimization. Mining Conversations for Ongoing Insight
Stage 4 is aspirational. Saying so plainly is what makes the earlier stages credible.
The concept is straightforward: the conversation corpus gets mined continuously, patterns surface automatically, and the organization tunes decisions against what it finds. Customer objections cluster. Recurring blockers appear across teams before they become crises. Leadership alignment gaps show up in how the same topic gets discussed in different forums. The business learns from its own conversations as a dataset, and not merely as a record.
Almost nobody is there. The organizations closest to it have completed Stages 1 through 3 without shortcuts, meaning they have a governed, queryable corpus joined to their other systems of record. That is the prerequisite. Without it, Stage 4 is a strategy slide, not an operating model.
The reason to name it anyway is directional: if your organization is deciding whether to govern conversation data seriously today, it helps to know what that investment eventually makes possible. Stage 4 is where the company brain stops being infrastructure and starts being a decision system, which is how to make AI work for us at an organizational level.
How to Assess Your Organization’s Current Stage
Four questions will place you more accurately than any survey.
Diagnostic question | Stage 1 signal | Stage 2+ signal |
|---|---|---|
Can you query a conversation from six months ago that you were not part of? | No: conversations belong to whoever hosted them | Yes. A governed corpus is queryable org-wide |
Do all teams use the same meeting management software? | No. Each team picks its own tool | Yes. One platform deployed company-wide |
Are sharing defaults set by IT policy or per-meeting by individual users? | Per-meeting. Each user decides individually | IT policy. Org-wide defaults enforced centrally |
Can AI assistants access conversation data directly? | No. Someone pastes a transcript manually | Yes. Direct, permission-enforced access via MCP or API |
If every answer lands in the Stage 2+ column, you are at Stage 2 or beyond. If even one breaks that pattern, you are in Stage 1, regardless of how many AI tools the organization is running.
The Role of Governance in Crossing Maturity Stages
Governance separates a usable corpus from a liability. The rules most organizations already have were designed with a human on the other end.
That assumption breaks when AI agents are involved. A person exercising access control uses discretion. An agent given broad access finds everything reachable, including the side conversation nobody remembered to exclude.
Two states need separate definitions: excluding a conversation from the organizational brain entirely, and excluding it from sharing. A coaching conversation might be kept out of the queryable corpus altogether. An executive all-hands might be internal-only but fully searchable. Collapsing those into one toggle is where most governance designs fail.
Classification rules are the practical fix. Tagging conversations as personal or HR-related automatically keeps sensitive material out of the queryable corpus without manual review per recording. Retention must also be configurable per data type: transcript, summary, and video frequently need different rules (see data retention for enterprise AI tools), especially for compliance-bound industries or EU employees.
A corpus employees don’t trust won’t get used, which makes governance the actual prerequisite for moving between maturity stages.
How Spinach AI Fits the Four-Stage Maturity Journey
Spinach AI is an enterprise conversation intelligence platform, the system of record for conversation data. Where individual AI notetakers solve one person’s problem, Spinach is deployed company-wide to capture, centralize, manage, and power the organization with every conversation it has. That four-verb model maps directly onto the maturity stages above.
- Stage 1 → Capture. Most organizations arrive here with a different notetaker on every team. Spinach replaces that sprawl with one company-wide deployment, record-by-default, with a bot that is always visible and never covert, eliminating shadow IT and the five-silo problem in a single rollout.
- Stage 2 → Centralize. Spinach builds the governed corpus Stage 2 requires. Collections automatically group and share meetings by participant, title, or series based on org-level rules, and never on per-user decisions. Sharing defaults are enforced by IT policy, PII is redacted at the transcript level, and retention is configurable per data type (transcript, summary, video) so the corpus is queryable and compliant from day one.
- Stage 3 → Company Brain. Spinach’s MCP server, included on Business and Enterprise plans, gives Claude and ChatGPT direct, permission-enforced access to the organizational conversation corpus alongside your CRM, Jira, and docs. The meeting record that was previously a fragment joins the ticket it affected and the strategy doc that framed the decision, turning a governed archive into institutional memory you can query directly.
- Stage 4 → Continuous Optimization. Stage 4 requires a governed, queryable corpus already joined to your other systems of record. This is the prerequisite Stages 2 and 3 build. Spinach’s compliance agents monitor the corpus against a customer-supplied rule set and classify and flag regulatory and policy risk for review. Custom agents and saved prompts can surface recurring patterns, such as objections, blockers, and alignment gaps, across the full corpus as the organizational dataset grows.
Spinach AI is SOC 2 Type II and GDPR compliant; HIPAA compliance and a BAA are available on Enterprise engagements. Spinach powers thousands of organizations including public enterprises.
Final Thoughts on Moving Through the Stages of AI Maturity
The direct read on this model is that Stage 1 is where most organizations actually live, and the path forward is less about AI investment and more about data ownership. A governed, queryable corpus is the prerequisite for everything that follows, and building one is organizational work before it is technical work. If you want to see what moving from scattered per-user tools to a centralized conversation record looks like, Spinach AI’s setup guide is a practical starting point.
An AI maturity model is a diagnostic framework that measures whether AI is producing systematic, compounding value across an organization — not just how many tools have been deployed. The MIT CISR Enterprise AI Maturity Model maps four stages, from automating individual tasks through continuous optimization, with each stage requiring specific organizational capabilities, not just new software purchases. Organizations use it to identify where they are actually operating versus where their strategy decks say they should be.
Four questions place you accurately: Can you query a conversation from six months ago that you were not part of? Do all teams use the same tool? Are sharing defaults set by IT policy rather than per-meeting by individual users? Can your AI assistants access conversation data directly without someone pasting a transcript manually? If any answer breaks that pattern, your organization is in Stage 1 regardless of how many AI tools are running.
The bottleneck is almost never technology. The real blockers are consent mechanics that legal and HR have never reviewed, per-participant sharing defaults that keep every conversation siloed, no classification layer to separate confidential conversations from the organizational record, and opt-out friction calibrated incorrectly in either direction. BCG’s October 2024 survey of 1,000 CxOs across 59 countries found that only 26% of companies had developed the capabilities needed to generate tangible AI value — the other 74% had activity without outcomes, which maps precisely to this governance gap.
Individual notetakers like Otter and Fathom solve one person’s problem: they produce per-user notes, per-user summaries, per-user action items with no shared record and no queryable corpus. Deployed across a company, they generate shadow IT, uncontrolled sharing, and five silos instead of one governed data asset. Spinach is deployed company-wide as a single organizational platform with policy-enforced sharing defaults, configurable retention per data type, and an MCP server on Business and Enterprise plans so Claude and ChatGPT can query conversation data directly alongside your other systems of record.
Yes, but only if the conversation data is centralized in a governed, AI-ready corpus connected via a standard like MCP. Without that infrastructure, every AI query requiring meeting context depends on a person manually locating and pasting the relevant transcript — which is why most organizations stall between Stage 2 and Stage 3. Spinach’s MCP server, included on Business and Enterprise plans, gives Claude and ChatGPT direct, permission-enforced access to the organizational conversation corpus, turning a governed archive into institutional memory you can query directly.
AI activity means your teams are running pilots, deploying tools, and logging individual productivity wins — AI outcomes mean those efforts produce compounding, queryable value across the organization. BCG’s October 2024 survey of 1,000 CxOs found 74% of companies had the first without the second, almost always because the underlying data was fragmented and ungoverned rather than centralized.
Let teams pick their own tools and you end up at Stage 1 indefinitely: five silos, no shared record, and nothing an agent can query reliably. A centralized, governed corpus is the structural prerequisite for every maturity stage above Stage 1, so the decision to consolidate is an organizational one that has to precede any AI investment in agents or workflows.
Consent architecture determines whether a queryable corpus can exist at all — if the question of whose consent governs a recorded meeting (host, organizer, or every attendee) is never formally resolved by legal and HR, centralization remains legally exposed and the corpus stays fragmented. Most organizations stall between Stage 1 and Stage 2 not because of missing technology but because this design question has never been answered.
Stage 3 is where your centralized conversation corpus stops being an archive and becomes a live input: meeting data joins your CRM, Jira tickets, documents, and chat so agents can answer questions like ‘why did we deprioritize that feature nine months ago’ by querying all of those sources together. Any one of those data sources in isolation is a fragment — joined, they form institutional memory that is actually queryable rather than dependent on whoever was in the room.
These are two distinct states that most governance designs collapse into a single toggle — which is where they fail. A coaching conversation might be kept out of the queryable corpus entirely, while an executive all-hands might be internal-only but fully searchable; conflating those two controls means either sensitive material leaks into agent queries or useful institutional knowledge disappears from the record.
An AI maturity model measures whether AI is producing systematic, compounding value across the organization — not whether software has been deployed or processes digitized. The MIT CISR Enterprise AI Maturity Model specifically tracks the organizational capabilities required at each stage, finding that companies with advanced AI capabilities consistently outperform industry peers financially, which is a different bar than go-live counts or tool adoption rates.
Record-by-default means every conversation across the organization is captured under a consistent, org-enforced policy rather than depending on individual employees to opt in per meeting. It matters because an AI maturity corpus built on opt-in behavior will always be incomplete — the conversations that never got recorded are exactly the ones agents can’t query, which is why governance and consent architecture have to be resolved before a reliable corpus can exist.
Frame the gap in terms of queryability: ask whether any AI assistant in the organization can answer a question about a conversation that happened six months ago without someone manually digging up a transcript. If the answer is no, that is Stage 1 regardless of how many tools are running — and the BCG finding that 74% of companies have AI activity without AI outcomes gives the business case a credible external anchor.
The version that works asks for a reason without blocking the action — enough friction that opt-outs are deliberate rather than reflexive, but not so much that employees feel coerced. Too little friction empties the corpus as people opt out habitually; too much signals coercion and creates legal and HR exposure, which is why this calibration decision should involve both legal and HR before any org-wide rollout.
Transcript, summary, and video frequently carry different regulatory obligations — an EU employee’s transcript may need aggressive deletion on a schedule that would be disruptive if applied to summaries or video, and HIPAA engagements often require retention windows that conflict with what a flat policy would impose. Configuring retention separately per data type lets compliance, legal, and IT satisfy each requirement without forcing a one-size-fits-all rule that either over-retains or destroys data the organization needs.
What to do next
Next, here are some things you can do now that you've read this article:
- You should check out our library of meeting agenda templates for every type of meeting.
- Check out Spinach to see how it can help you run a high performing org.
- If you found this article helpful, please share it with others on Linkedin or X (Twitter)
