AI maturity self-test

How ready is your organisation
for AI in information systems work?

A self-test of how your organisation uses AI across the life of its information systems. You get a level from 1 to 5, a score for each of six sections, your strengths and priorities, and the result as a PDF.

The seven sections

01Organization profile and role in the information systems lifecycle
02People and AI skills
03Context and organizational knowledge
04Practical AI use across the information systems lifecycle
05Trustworthiness and verifiability of AI outputs
06AI governance, data security and control
07AI adoption management and business benefits

Estimated time: about 10 minutes.

Start the self-test

Your name, organisation and work email are asked once, at the end, before the result.

Organization profile and role in the information systems lifecycle

01What is your organization's role in information systems maintenance and development?

Select all applicable answers if your organization performs multiple roles.

We manage our organization's information systems, with development and maintenance primarily provided by external suppliersWe manage and develop our organization's information systems with an internal IT teamWe develop and/or maintain information systems for other organizationsWe provide consulting on information systems analysis, architecture, development or governanceWe provide information systems cybersecurity, security testing or risk management servicesOther operating model

02What is your organization's primary industry?

Select one answer.

Information technology and software developmentGovernment and public sectorFinance, banking and insuranceManufacturing and industryRetail and e-commerceTransport and logisticsHealthcare and pharmaceuticalsEnergy and utilitiesTelecommunicationsProfessional services and consultingEducation and researchOther industry

03How many people in your organization are involved in information systems maintenance, development or governance?

Include managers, analysts, architects, developers, testers, security specialists and others regularly involved in these processes. Do not count your entire workforce.

1–5 people6–10 people11–25 people26–50 people51–100 people101–250 peopleMore than 250 people

04What currently creates the greatest difficulties in maintaining and developing your information systems?

Select up to three of the most significant challenges.

0 / 3

Finding the necessary information and documents is difficultImportant knowledge resides in the heads of individual specialistsOnboarding new employees or suppliers takes too longRequirements and scope change, and those changes are difficult to trackThere is insufficient visibility into work progress, deadlines and costsTechnical and architectural decisions are difficult to substantiate with evidenceDocumentation is incomplete, outdated or not maintainedReporting and information consolidation take too much timeMuch of the work is repeated, and development or testing quality is inadequateThere is excessive dependence on external suppliers and their expertiseEnsuring change traceability, security and compliance is difficultThere are currently no significant problems

People and AI skills

01How widely do your organization's employees use AI in their daily work?

Consider employees involved in information systems governance, analysis, development, testing and maintenance.

AI is practically not used, or we do not know whether employees use it.Individual employees use AI on their own initiative, without a common approach.AI is used regularly by one team or a particular professional group, such as developers.AI is used regularly by multiple teams and specialists in different roles.AI use is routine and deliberately organized across teams and workflows.

02How is successful experience with AI use captured and shared within your organization?

For example, an employee discovers an effective way to use AI to prepare requirements or analyze software code.

Successful practices are neither captured nor shared.Employees occasionally share experiences in informal conversations.Successful approaches are discussed and adopted within individual teams.Useful methods and examples are documented and accessible to other teams.Validated methods are incorporated into shared workflows, instructions or reusable AI solutions.

03How do employees determine whether AI-provided information or outputs are correct?

For example, when checking AI-generated requirements, code changes, tests or technical recommendations.

AI outputs are not systematically checked, or employees do not yet use AI.Employees mainly rely on whether an AI response seems plausible.Some specialists check AI outputs, but this depends on individual experience.Most AI users know how to verify outputs against documents, code or other reliable sources.AI output verification is a defined part of the workflow, with clear quality criteria and accountable owners.

04How does your organization develop employees' ability to use AI in their professional work?

Consider not only general AI training, but also skills for applying AI to specific information systems lifecycle tasks.

Developing AI skills receives no attention.Employees learn AI independently using publicly available materials.The organization occasionally offers AI training or experience-sharing sessions.Targeted AI training and practical examples are provided for different employee roles.AI skills are systematically developed and assessed through real work tasks and ongoing professional development.

Context and organizational knowledge

01What information about your information systems is accessible to AI tools?

For example, requirements, documentation, work items, software code, architecture and change history.

AI has no access to organizational information beyond what an employee enters into the conversation.Employees can manually upload individual documents or files to an AI tool.AI can access selected information sources, such as documents or software code.AI can use multiple interconnected sources, such as requirements, documentation, work items and code.AI can access interconnected, up-to-date knowledge about systems, architecture, requirements, decisions and change history under appropriate controls.

02How easily can your organization establish why a particular information systems decision was made?

For example, why a particular architecture was chosen, a feature introduced or a business requirement changed.

Decision rationales are often not retained and are known only to individual specialists.Rationales are scattered across emails, messages and other sources, making them difficult to find.Some decisions are documented, but the information is not always current or easy to locate.Decisions and their rationales are documented and searchable in a unified or interconnected knowledge environment.Decisions can be traced from the original need and requirement through approval to implemented changes and their rationale.

03How easily can you determine which information systems requirements and changes have been approved?

For example, determining what the customer approved, what is in scope and what has actually been delivered.

Information is scattered, and finding it can take several days without confidence in its completeness.The required information must be compiled manually from contracts, correspondence and work items.Requirements and changes are recorded, but comparing them requires additional effort.Approved requirements, changes and work statuses are transparent and can be found relatively quickly.Original requirements, approved changes, work items and actually implemented functionality can be traced and compared.

04How do you ensure that AI uses current and accurate information about your information systems?

For example, preventing AI from relying on an outdated specification, a cancelled requirement or a previous system version.

Information currency is not controlled, or AI does not yet use organizational knowledge.Employees select the information they provide to AI and check its currency at their discretion.Some information has versions or update dates, but AI cannot always account for them.AI uses governed information sources where document versions, statuses and currency can be identified.AI uses governed, interconnected context, accounts for information status and version, and flags missing data or conflicting sources.

Practical AI use across the information systems lifecycle

01At which stages of the information systems lifecycle does your organization use AI in practice?

Consider analysis, design, development, testing, deployment and maintenance.

AI is not used in information systems maintenance or development.AI is used mainly to draft general texts, emails or summaries.AI is used regularly at one specific stage, such as programming or testing.AI is used at multiple stages, such as requirements analysis, design, development and testing.AI is deliberately integrated throughout the IS lifecycle, preserving information and output continuity between stages.

02How does AI help prepare requirements, specifications and work items?

For example, new feature requirements, change requests, user stories and acceptance criteria.

AI is not used to prepare requirements or work items.AI helps improve wording or formulate individual ideas.AI helps draft documents or work items using information provided by an employee.AI creates structured drafts using organizational requirements, documentation and previous work items.AI helps develop consistent requirements, specifications and acceptance criteria, linking them to the existing system and submitting outputs for human review and approval.

03How is AI used in software development, testing and defect resolution?

If your organization does not write code itself, consider how AI helps review or assess work delivered by external suppliers.

AI is not used in development, testing or defect analysis.AI occasionally helps explain errors or suggests generic technical solutions.AI regularly helps write or review code, prepare tests or analyze defects.AI is used for development, testing and defect analysis grounded in project code and requirements, with specialists verifying the outputs.AI supports an interconnected development, testing and defect-resolution workflow in which changes are traceable to requirements and verified before deployment.

04How does AI support decisions about information systems development and maintenance?

For example, assessing change impacts, architecture options, technical risks or resource needs.

AI is not used to prepare or evaluate decisions.AI provides generic recommendations not grounded in the specific system's information.AI helps summarize information supplied by an employee and formulate possible solutions.AI helps compare solution options using available system requirements, documentation and technical information.AI prepares substantiated solution options with sources, impact analysis, risks and next steps, explicitly identifying uncertainty while leaving decisions to the accountable specialist.

05How closely is AI integrated into your organization's daily workflows and tools?

For example, in work management, documentation, code repositories, testing or change management.

AI is not used or is not connected to organizational workflows.Employees use standalone AI chatbots, manually copying information between tools.AI is available in individual work tools, but outputs are still mostly transferred manually between processes.AI is integrated into multiple work tools and helps create or update information within existing workflows.AI is integrated into interconnected workflows and can prepare and transfer outputs between stages while respecting access rights, verification and approval procedures.

Trustworthiness and verifiability of AI outputs

01When receiving an AI answer, can you verify which information sources it is based on?

For example, opening a specific requirement, document, work item or source code fragment.

AI does not identify the sources used, and there is no way to verify where the information came from.AI sometimes names possible sources, but it is unclear whether they were actually used.AI may identify documents or files used, but verifying specific claims requires additional searching.AI answers include references to specific sources that users can open and verify.Material AI claims can be traced to specific verifiable sources, their versions and the relevant information.

02How is the quality of AI-generated work products checked before they are used?

For example, requirements specifications, architecture proposals, source code, test cases or reports.

No procedure has been established for checking the quality of AI outputs.Outputs are checked only when someone questions their accuracy.Outputs are usually reviewed by the responsible employee, but there are no consistent verification criteria.AI outputs are checked against defined quality criteria and compared with relevant requirements or other sources.Verification is embedded in the workflow, combining appropriate automated controls, specialist review and necessary approvals.

03What happens when AI provides an incorrect, incomplete or unsupported answer?

For example, AI cites a nonexistent requirement, misinterprets a document or proposes an unsuitable technical solution.

There is no defined approach to detecting AI errors, and errors may go unnoticed.Errors are corrected only when an employee happens to notice them.Employees report significant errors, but these are not systematically analyzed.AI errors are recorded, their root causes analyzed and improvements made to reduce recurrence.Systematic error management is in place: AI output quality is monitored, incidents are analyzed, improvements are tested and unsafe use is restricted when necessary.

04How does AI respond when it lacks sufficient information to provide a substantiated answer?

For example, the current specification is unavailable, a decision rationale is missing or documents conflict.

AI responds even when information is insufficient and does not disclose this limitation.AI sometimes warns of uncertainty but may present unsupported assumptions as facts.AI usually flags missing information, but users must determine what else is needed.AI identifies specific information gaps or contradictions and helps formulate the required clarifications.The AI workflow includes uncertainty management: it flags insufficient evidence, requests clarification or further verification and does not present unsupported conclusions as established facts.

05How are AI-generated outputs reviewed and approved before being used in important decisions or deliveries?

For example, before approving an architecture decision, deploying changes to production or delivering outputs to a customer.

It has not been defined which AI outputs must be reviewed or approved.Employees decide for themselves whether review is needed and who is responsible.Material outputs are usually reviewed by a responsible specialist, but this is not always documented.It is defined which AI outputs require review, who performs it and how approval is recorded.Review and approval requirements are proportionate to work-related risk, integrated into the relevant workflows and ensure traceability of accountable people and decisions.

AI governance, data security and control

01Does your organization know and control where data goes when employees use AI?

For example, system documentation, source code, customer information, personal data and other restricted materials.

We do not know which AI tools employees use or where entered information goes.Employees also use public or personal AI accounts, and data transfers are not centrally controlled.The organization has approved AI tools, but data processing terms have not been fully assessed for all of them.AI tools have assessed data processing terms, permitted data categories and appropriate controls.The organization governs AI data flows throughout their lifecycle, including processing location, storage, access, transfers to service providers and deletion.

02How clearly are the rules for using AI at work defined in your organization?

For example, which AI tools are allowed, what information may be entered and which outputs must be checked.

The organization has no rules for AI use.There are only informal recommendations to be careful when using AI.Written AI usage rules exist, but they are not consistently implemented or reviewed.Approved AI usage rules are known to employees, with permitted tools and accountable people defined.AI usage rules are integrated into workflows, compliance is monitored and the rules are regularly updated to reflect risks and technological change.

03How is access to organizational information by AI controlled?

For example, whether AI assisting a project analyst can access only information that analyst is authorized to view.

AI access to organizational information is not controlled, or the access procedure is unknown.Access is determined mainly by which files employees upload to the AI tool.AI access is restricted in certain systems or data sources, but controls are inconsistent.AI access is managed according to user roles and permissions, respecting organizational data protection requirements.AI access is consistently checked for every request and action, respecting user permissions, data classification and the principle of least privilege.

04Can your organization trace how AI was used to complete a particular work item?

For example, how AI helped prepare requirements, analyze documents, change code or develop a technical proposal.

AI actions are not logged, and it is impossible to establish what was done.Some information remains in separate AI conversations or employees' personal accounts.AI conversations or outputs are saved, but linking them to specific work items is difficult.AI usage history is linked to work items, making it possible to identify the user, actions and outputs.Risk-appropriate audit information is retained for material AI actions, including sources, tools, actions, outputs and approvals.

05How does the organization manage risks when AI can perform actions in information systems or work tools?

For example, creating work items, editing documentation, preparing code changes or calling system APIs.

Permissions for AI-executed actions and associated risks are not assessed.AI can perform some actions, but restrictions and controls largely depend on the user.AI actions are restricted in certain tools, and significant changes usually require human review.AI actions have defined permissions, risk levels and approval requirements before material changes are made.AI actions are governed by least-privilege permissions, technical security controls, risk-appropriate approvals, monitoring and the ability to stop or reverse actions where technically feasible.

AI adoption management and business benefits

01Who in your organization is responsible for AI adoption and the development of its use?

Consider responsibility for AI adoption in information systems maintenance, development and governance.

No one has been designated as responsible for AI adoption in the organization.AI use is mainly promoted by individual interested employees on their own initiative.A team or department manager oversees AI adoption alongside their regular responsibilities.An AI adoption owner has been appointed with clear responsibilities and authority to coordinate organizational activities.AI adoption forms part of the organization's management plan, with defined accountability, decision-making procedures, resources and measurable objectives.

02Does your organization measure the benefits delivered by AI use?

For example, time saved, lower costs, faster requirements preparation, fewer errors or better knowledge access.

The benefits of AI use are neither assessed nor measured.Employees believe AI helps them work faster, but there are no specific measurements.There are individual examples or estimates of time saved or improved outcomes from AI.AI benefits are regularly measured in selected workflows, comparing results with previous practices.AI benefits are systematically measured and assessed in terms of cost, quality and productivity, and the findings inform future investment decisions.

03How does your organization select the workflows in which to introduce AI?

For example, requirements analysis, documentation maintenance, development, testing or systems governance reporting.

There is no defined approach to assessing opportunities for AI use.AI use cases are chosen based on employee interest or available tools.Individual processes where AI could help are identified, but there is no consistent prioritization approach.AI adoption opportunities are assessed by expected benefit, implementation complexity and risk.AI adoption priorities are set using comparable criteria for business value, cost, risk and implementation readiness, and are reviewed regularly.

04What is your organization's AI development plan for the next 12 months?

Assess whether the organization has specific AI adoption goals, priorities, accountable owners and required resources.

No AI adoption or development plan has been prepared.The organization monitors AI developments, but no specific adoption activities are planned.AI tools or individual pilots are planned, but there is no comprehensive implementation plan.Specific AI use cases, implementation timelines, owners and required resources have been defined.An approved phased AI development plan includes priorities, budget, expected outcomes and regular reviews of progress and benefits.

05How does your organization turn successful AI experiments into permanent working solutions?

For example, after a successful AI pilot in requirements analysis or testing, how is it introduced into routine work?

AI experiments are not conducted, or their results are not used in subsequent work.Individual employees continue using successful AI solutions on their own initiative.Some AI solutions are adopted by teams, but their maintenance and development are not systematically organized.Successful AI solutions are assessed, documented and introduced into defined workflows with assigned owners.A defined process takes AI solutions from pilot to routine use, covering quality, security, cost, user training and long-term maintenance.

Your result is ready

Tell us who is asking, and the result is yours.

Full name *

Organisation *

Work email *

How we use these details

DCS Flow uses your name, organisation and work email to prepare and offer you a consultation about your result. Your answers and the result are sent to the DCS Flow team as one email and are not stored by this website.

The email is delivered through Google Workspace. You can ask us to delete it at any time by writing to the address on this site. If you tick the marketing box, we may also contact you about DCS Flow; you can withdraw that at any time.

DCS Flow may contact me about its products and services.

How ready is your organisationfor AI in information systems work?