The five phases of AI maturity in a business: from personal ChatGPT to a shared workspace

AI maturity describes how a business chooses tools, handles information and checks the work people produce with them. A collection of paid subscriptions reveals little if nobody knows what staff upload or who approves the result before it reaches a customer.

Consider a fictional distributor with twenty employees. A sales rep writes emails in a personal ChatGPT account. Someone in administration tries another tool with an order spreadsheet, and the owner receives two subscription expense claims. The immediate decision is how to give those employees an agreed way to work, with someone responsible for the data and spending.

In the sectors covered by Eurostat’s survey, 20% of EU businesses with at least ten people employed used AI technologies in 2025. That measures adoption across the surveyed technologies. It does not place businesses on a maturity scale or measure employees’ use of personal accounts.

The five phases of AI adoption and maturity

The five phases are individual experimentation, scattered adoption, shared working practices, operational integration and a business redesigned around AI. To find the useful next step, follow a real task and identify who controls its information, cost and finished result.

This is a small-business adaptation of Cohere’s five-phase maturity model. Our third phase means organizing work around approved tools and procedures; Cohere’s third phase describes a more extensive internal production platform. Use these reference points to choose your next step.

Phase 1: individual experimentation

If this sounds familiar: one employee can get a useful draft from an AI tool, but nobody else knows how they do it.

At the distributor, the sales rep experiments with ways to explain a product using its public description. They keep the instructions in their chat history and check the draft against the original specification. The business has yet to decide whether colleagues should adopt the method.

Ask for a record of the task, an example without confidential information, and the mistakes the employee had to correct. You then have something more useful to evaluate than “it saves me loads of time.”

Phase 2: scattered adoption and shadow AI

If this sounds familiar: several tools are in use, some accounts belong to individuals, and the owner cannot connect the bills to particular jobs.

Shadow AI means using AI for work outside the company’s knowledge or rules. It includes free accounts, personal subscriptions and AI features inside other software. Paying for an account does not establish that its use is controlled.

In our example, administration starts uploading order files before anyone has checked which columns contain customer information. The priority is to identify that use and offer an approved route with limits the employee can understand while getting the job done.

Phase 3: a workspace with shared rules

If this sounds familiar: employees know which tools they may use, what information each can receive, and who owns the budget and review.

The distributor approves tools for specific tasks, names a budget owner and keeps reviewed instructions in company documentation. Each person has their own access. When someone joins or leaves, an owner checks permissions and makes sure the business can retain the work it needs.

A business workspace can support this arrangement when it offers the required controls. Check the actual access, billing and collaboration features before buying. Assess employee administration and shared prompt storage separately from the model catalog.

Phase 4: integration into operations

If this sounds familiar: AI receives information from business software and returns a result that another process uses.

For the distributor, one possible project would classify incoming requests and prepare draft orders for a person to approve. It would require a specific integration, tests for exceptions and someone to handle failures. Connecting the order system creates an ongoing maintenance responsibility.

Phase 5: a business designed around AI

If this sounds familiar: the service you deliver and the way you organize roles depend on AI capabilities the business has chosen to develop.

The distributor might consider selling a new service that produces personalized catalogs, with its own review process and pricing. Before offering it, the business would need evidence of demand, a cost for delivering a correct catalog, and a way to resolve problems. The owner would need to validate that new business before choosing tools.

Apply these signals to a task or department. A business can run a well-maintained logistics integration while sales staff still use personal accounts that nobody has reviewed.

A shadow AI checklist: who sends what, and where?

Finding shadow AI requires an inventory of tools, accounts, information and payments. Mark an item complete when you have evidence or a named owner, and turn unanswered items into follow-up actions.

• People and tools: you know who uses each service for work, the plan they use and whether the account is personal or company controlled. Include free tools and AI features in existing software.
• Tasks and information: you have recorded what people paste or attach, such as public specifications, emails, contracts, orders or customer files. Record information categories without copying confidential material into the inventory.
• Data destination: you have identified the provider receiving the information, its storage terms and potential international transfers.
• Training and retention: you have checked the terms and settings of the specific service and plan, including how long it keeps conversations.
• Who pays: every subscription or top-up has an owner, a purpose and an identifiable cost. You also account for the time staff spend checking answers.
• Access and departures: someone removes access and retains the work documents the company needs when an employee leaves.
• Reusable methods: useful instructions are available to the authorized team, with an author and a reviewed example.
• Policy and questions: employees know the permitted tools and information, who reviews a result and whom to tell if they send something by mistake.

“Free” and “paid” do not tell you the full privacy terms. For example, OpenAI lets users of personal ChatGPT Free, Plus and Pro workspaces turn off training on new conversations. That addresses one issue. The business still needs to check retention, access and whether the information is authorized for that use.

Moving from phase 2 to phase 3

The move to phase 3 means agreeing on a way of working that employees can follow: tools, permitted information, an owner and a review step. Start with a recurring task and check that a colleague can complete it using the same instructions.

Write a policy that answers everyday questions

A short document can give employees a starting point. Explain what information each tool may receive, which uses need approval and who signs off on work before it reaches a customer.

The distributor might initially allow drafting from approved public product descriptions and require a review before introducing customer information. It would make a separate decision about contracts or personal data. Our business AI governance guide covers the inventory, policy and review process in more detail.

Bring the spending together and check what you are buying

Give one person responsibility for reviewing subscriptions, top-ups and renewals. Test a proposed replacement with the people who do the work before deciding which tools to keep. Retain necessary work files before closing accounts.

For a shared workspace, ask who can invite and remove users, who can see invoices and how consumption limits work. Compare the cost of completed tasks, including review. Usage pricing and subscriptions per person need different calculations; neither is inherently the cheaper option.

Keep prompts with examples and review criteria

An internal prompt library can start in the company documentation you already use. For each task, keep the instructions, permitted input, an approved result and the mistakes a reviewer should look for.

For the distributor’s product descriptions, the sales lead could require the text to preserve dimensions, materials and delivery terms. A colleague tries the instructions on another product and records what goes wrong. That small exercise helps establish whether the method is reusable.

Copy this entry as a template for your own documentation, then adapt it to an approved task. The sample product is fictional.

1Task: Draft a product description from an approved specification.
2Permitted sample input (fictional): Shelving unit. Steel. 80 × 30 × 120 cm. Delivery: 5 working days.
3Instruction: Use only the supplied facts. Do not invent load capacity, warranty or missing details.
4Expected output: Up to 60 words, followed by a list of details not provided.
5Review checks: Match every fact to the input; remove unsupported claims.
6Review owner: [Role approving the draft, e.g. sales lead].

Check data handling before widening access

The CNIL, France’s data protection authority, recommends examining the business’s and provider’s roles, processing arrangements and data transfers. The appropriate contract depends on the processing and each party’s responsibilities.

Ask about retention, reuse, deletion and the providers involved. EU-first routing describes a service policy; work that requires processing exclusively in the EU needs that condition checked for the selected offer and model. Review the provider alongside your decision about which information employees can use.

In the enterprise: the production wall and phases 4–5

Enterprise integration requires reliable permissions, quality and continuity when an AI result affects another system. A workspace supports part of the daily drafting work; an integration also needs operating owners, tests and a recovery process.

Deloitte’s report published in 2026, using fieldwork from August–September 2025, found that 25% of respondents had moved at least 40% of their AI pilots into production. That is a share of respondents; it cannot establish what percentage of all pilots failed.

Cohere calls the transition from trials to an operational platform the “production wall.” For a particular integration, make three checks:

1. Information and permissions: test that each user receives only the information they need, including cases with missing data or a changed document.
2. Quality and accountability: define an acceptable result, the errors that require intervention and who stops the process when it goes wrong.
3. Model changes and continuity: retain test examples for comparing versions and establish which work can continue when the service is unavailable.

Part two of Cohere’s model addresses integration and business redesign. Each such project needs its own business case in a small company. A focused integration may make sense early, including in a twenty-person business.

To choose the first tasks, see our guide to generative AI for business.

Where ilisai fits

ilisai fits the research, writing, analysis and content creation that a business wants to organize. Each person uses an individual account with its own balance and can choose among the enabled models in the catalog.

You can research the web with source links, analyze CSV or XLSX files, display charts in chat and generate downloadable DOCX, PDF, PPTX or XLSX documents. Image and video generation are also available; video requires funding from a paid plan or wallet top-up. The Free plan has a limited allowance; check current allowances and terms on the pricing page.

ilisai takes an EU-first approach to routing. Review its privacy policy and service terms against your company’s requirements. Approving uses, maintaining shared instructions and checking results remain team responsibilities. Connecting a private document collection, automating changes in a CRM or analyzing a live data feed requires a dedicated solution and integration.

Frequently asked questions

These answers help you choose a next step and clarify what company-controlled AI use involves.

How do I know my business’s AI maturity level?

Follow one task through its account, input information, cost and final approval. If you cannot identify those points, start with the inventory. If they are documented and a colleague can repeat the work, that task has a foundation for phase 3.

Is an employee using free ChatGPT always shadow AI?

It is shadow AI when they use it for work outside the business’s knowledge or rules. A free tool approved for a defined task can be controlled; an unknown paid subscription can still be shadow AI.

Is paying for employees’ individual subscriptions enough?

Reimbursement settles who pays. You also need to decide which accounts the business controls, what information is permitted and how work documents are retained. Check those conditions in the specific plan before moving employees to another offer.

Does a business account guarantee GDPR compliance?

The company must assess its use and data processing even when it buys a business plan. The provider’s terms, the purpose, the information sent and each party’s responsibilities need to fit the intended work.

When should we move to phases 4 and 5?

When a business need justifies connecting systems or changing the service you sell, and you can fund its operation and review. First define an acceptable result and what happens if the process fails. Company size and subscription counts cannot make that decision for you.