The Five Levels of Company AI Adoption
In March I spent a month asking companies how they actually use AI agents. Roughly 70% didn't use agents at all, 20% had tried once and stopped, 5% were stuck in a prototype, and 5% ran agents in real workflows. The most common answer to "do you use AI at work" was "we record our meetings."
By August, Claude Code and Codex were everywhere — on personal laptops — while company processes had barely changed. I started placing companies on a five-level scale and published it on the blog of Heron, which I'm building.
This is the October version. In August I read the climb mostly as infrastructure: connect the tools, add a gateway, write rules. Two more months of conversations changed that. People are the hard part at every level, and the few companies near the top showed me that what waits there is a process problem more than a security one. Most companies I see still sit at levels 1–2.
Level 0 — Chat
You're here if AI means ChatGPT, Gemini or Claude as a chat: you ask, it answers, and it is connected to nothing.
The model never touches your data, so every answer starts from zero and leaves as a copy-paste. Sometimes this is decided for you: at one company I talked to, security doesn't allow connecting Claude to Google, Slack or Jira at all. Otherwise the move up happens person by person: someone installs Claude Code or Codex, connects GitHub, and stops copy-pasting.
Level 1 — Personal agents
You're here if some people run Claude Code or Codex with a couple of integrations, and each person connected their own.
The value is real and scattered: the same tools get connected N times, and when the person with the neat setup goes on vacation, the setup goes with them.
This is where most companies stall, and rarely because of the tool. A few people go very far; most try it a couple of times, see no effect and drop it. The leaders I talk to name the blocker in their own words: "mostly a people thing," "enablement and education."
What pushes you up: an agent answers confidently and wrong, because the context that would have fixed it lives in someone's head. You start writing context down.
Level 2 — Context
You're here if most tools are connected and the team has understood that for AI, context matters most. A company brain appears — a repo with the company's knowledge — and personal brains next to it.
The first trap is AI slop. If agents write into the brain unchecked, in a few months it sounds confident and is subtly wrong, and every agent that reads it repeats the errors. Split it into raw, where agents work with incoming information, and verified, which a person has checked. Strategy, customer research, decisions and the numbers you steer by get signed off by a person.
The second trap is age. A data lead at a large company told me their process descriptions go stale within a month.
What pushes you up is arithmetic. Connecting a tool takes two clicks now, but N people do those clicks for M tools, and the keys end up in setups nobody can list. One day someone asks who can reach what, and nobody can answer.
Level 3 — One door
You're here if agent traffic passes through a gateway: one door between agents and company tools. Connectors live in one place, a person connects once, and access follows each person's own permissions.
In August I wrote about the door mostly as a control point. In conversations people got excited about it for adoption: a line employee gets a safe tool with everything connected, so "set it up yourself" stops filtering them out. That is also why the door can come early: a company at level 1 that sets one up speeds up levels 2 and 3 at once. I now see it as table stakes, something every company running agents will have.
One check before you claim this level. A company once placed itself at level 3, then described separate instances where agents had access to everything, open only to leadership. That is level 1 with all the keys in one room. You're at level 3 when keys live in one place, access is per person, and you can safely hand a restricted slice to a line employee.
Below roughly twenty people, skip the door for now; setting everyone up by hand takes a week. And a door doesn't give you a record by itself, since tool calls don't carry the request the agent was working on. How to build a first one from free open-source parts: No Gateway Yet? How to Give Your AI Agents One Door.
What pushes you up: agents multiply, and someone asks "what did the agent do yesterday?" and then "whose agent is this?"
Level 4 — Owners and rules
You're here if you know which agents run, each has someone who answers for it, and rules check what they do.
I used to call this level just rules. The companies that got here say the first problem is keeping track of the agents. Who answers for each one? Who takes over when its builder leaves? Which agents break when a process changes? At one company where everyone uses AI daily, the person leading the change told me the hardest part is governance. What holds up: every agent gets one named owner and a backup, because what survives is what one person answers for. Strong AI teams build this themselves.
Then rules. Rules in a system prompt are wishes — the teams that run them say the agent doesn't always follow. A rule becomes real when it is code that runs before the action, and the agent can't talk its way past it.
The unlock is chains. The agent reads your customer database, then fetches a web page, then writes to an external document. Each step alone is allowed, so per-action rules stay silent, but the page can carry a prompt injection, and the sequence is your customer data walking out. A rule over the chain catches it. Run it in shadow mode first, marking sessions and blocking nothing, then enforce. Skip shadow mode and the team learns to hate the rules.
An LLM judge on top brings noise: in Uber's published production numbers for its ADR system, analysts marked about half of the routed alerts as false positives.
Where this level gets stuck: owners and rules go stale. People leave, the business changes, and the rule set describes the company of six months ago.
Past level 4: the process
This is the part I didn't see in August. Even near the top, agents mostly speed up individual tasks, while approvals, queues and spot checks stay sized for what a person can review. At that same company with daily AI use across the board, only R&D has been rebuilt around AI so far.
So the bottleneck moves to whoever approves. An IT lead with a few dozen agents in production told me pricing exceptions, contract terms and vendor decisions still need a person, because someone has to be accountable. For the high-volume decisions they define the rule once, run it automatically, and show the person only the exceptions. When exceptions reach 20–30%, the rule needs updating.
My current bet, which I'm testing and can't call a fact yet: this is the next level. A process rebuilt so a person approves a rule once, signs off a batch and sees only the exceptions, judged on money. One leader put it plainly: the result is cost savings or revenue, and nothing else counts.
Who does this work
The question I get most: who actually does all this? The door and the rules are an engineering project with a clear end. Adoption is harder.
A hire alone doesn't carry it. What decides is whether someone at the top can change how work gets done; without that, AI platform work gets little time when the quarter is planned.
What works is a pair: a leader who pushes — at up to a few hundred people, usually the CEO or another C-level — and a champion in each team who hands colleagues a working setup. The rest pick it up once they see that person's results. What sticks is automation that takes work off someone's plate. If AI means more reports to read and more things to check, it feels like another assignment.
Where this leaves you
Most companies I see sit at levels 1–2, and what holds them there is people, not tools. Every level up is the same move at a larger scale: something that lived in one person's head or on one person's laptop becomes shared — first the context, then the access, then the ownership of each agent, and finally the process itself.
So find your level and look one step up. At levels 1–2, that step is a leader who pushes and a champion in each team. At levels 3–4, it is a named owner for every agent. Past that, it is one question: which process in your company still waits on one person's approval — and what would it look like if that person approved the rule instead of every case?
An earlier version was published on the Heron blog as The Five Levels of Company AI Adoption.