AI vision and direction
One written answer to the question of what AI is for in this company, and what it is explicitly not for.
Counts from your first AI application The model · version 1.0
The AI capability model in one overview.
Everything an organization needs to run AI safely and measurably. Nine layers, eighty-six capabilities, five levels—and for each capability, whether it matters now or only at scale.
86capabilitieseach with a definition
9layersseven stacked, two crosswise
5levelsfrom ad hoc to industry-leading
Value flows downward1Business & StrategyWhich problems we solve, what it should deliver, who owns it52Channels & InterfacesWhere people and systems connect to the platform103Agent developmentFrom idea to a working, tested agent144AI Control PlaneEvery request, tool call, and euro passes through one monitored point145Models & InferenceThe engines, interchangeable behind the gateway86Knowledge & DataAI is only as good as the data it can access117Infrastructure & RuntimeThe foundation everything runs on7
The five levels
Each capability is at one of these levels. It’s not the average that matters, but the lowest-level capability underlying the application you want to run.
- 1Ad hoc — Someone does it, no one knows about it
It happens outside the agreed processes. If it works, that's because of the person, not the setup.
- 2Repeatable — It works, but manually
There’s a consistent way of doing things, written down or learned by example. Still manual, and dependent on who does it.
- 3Configured — recorded in a system
It's in one place, with an owner. Others can take over without needing an explanation.
- 4Governed — Measured and adjusted
It’s measured, bounded, and actively managed. Deviations surface automatically.
- 5Industry-leading — Improves itself
It adapts without anyone stepping in, and it's good enough to show others.
86 of 86
Layer 1 · 5 capabilities
Business & Strategy
Which problems we solve, what it should deliver, who owns it
Portfolio of applications
One list of all planned, ongoing and discontinued AI applications, with the reason for each.
Counts from your first AI applicationValuation and business case
For each application, define in advance what it should deliver, in hours, euros or errors.
Counts from your first AI applicationOwnership and decision-making
One person is assigned to each application to decide whether it stays on, is turned off or is changed.
Counts from your first AI applicationAdoption and change
The guidance that makes sure people actually adopt the new way of working.
Counts from your first AI applicationLayer 2 · 10 capabilities
Channels & Interfaces
Where people and systems connect to the platform
Chat for employees
One agreed place where employees can use AI for their own work.
Counts from your first AI applicationCustomer channel
AI that talks directly to customers, on the website or in a customer portal.
Needed once multiple teams are involvedWorkplace integration
AI that's right where the work already happens: Teams, Outlook, SharePoint.
Counts from your first AI applicationOffice applications
AI in Word, Excel and PowerPoint, with access to company documents.
Counts from your first AI applicationAI in custom software
AI features built into the applications the company has developed for itself.
Needed once multiple teams are involvedVoice and telephony
Spoken input and output: transcribed conversations, telephone handling.
Only at scale or when requirements are strictEmail and document workflows
Incoming mail and documents that are automatically read and routed.
Needed once multiple teams are involvedSystem interfaces
A consistent way for other systems to call AI functions.
Needed once multiple teams are involvedMobile use
The same access and the same limits on a phone as at a desk.
Only at scale or when requirements are strictLanguage and accessibility
Answers in the user's language and at their level, including when there are limitations.
Only at scale or when requirements are strictLayer 3 · 14 capabilities
Agent development
From idea to a working, tested agent
Task boundaries
In black and white: what the agent does and doesn't do, and when it hands over.
Counts from your first AI applicationPrompt management
Instruction texts in one place, with versions, instead of scattered across scenarios.
Counts from your first AI applicationDefine tools
Specify what actions the agent may perform and what data it may use.
Counts from your first AI applicationContext and working memory
Determine what context the agent receives for each task, and what it remembers between tasks.
Needed once multiple teams are involvedStep orchestration
The sequence in which an agent thinks, looks things up, acts and checks.
Needed once multiple teams are involvedCollaborative agents
Multiple agents handing work off to one another with a clear handover.
Only at scale or when requirements are strictHuman in the loop
The moments when a person must approve before the agent can continue.
Counts from your first AI applicationError handling and fallback
What happens when a step fails: retry, skip it or send it to a person.
Counts from your first AI applicationEvaluation set
A fixed set of examples with the correct answer, so quality can be measured.
Needed once multiple teams are involvedRegression test when switching
Run that same set again before a different model or new version goes live.
Needed once multiple teams are involvedTrial run
Let the agent run alongside the process first, without consequences, while a person keeps an eye on it.
Counts from your first AI applicationRollout pipeline
A consistent path from draft to production, so nobody makes changes directly in the live system.
Needed once multiple teams are involvedVersion control and rollback
Every version saved, and one action to go back to the previous one.
Needed once multiple teams are involvedReusable building blocks
Components used across multiple agents, built once and shared.
Only at scale or when requirements are strictLayer 4 · 14 capabilities
AI Control Plane
Every request, tool call, and euro passes through one monitored point
One gateway
All AI traffic passes through a single point, so nothing happens out of sight.
Needed once multiple teams are involvedRouting to the right model
Automatically select the model that best fits each type of query in terms of price and quality.
Needed once multiple teams are involvedKeys and secrets
API keys centrally managed and replaceable, never stored in plain text in a scenario.
Counts from your first AI applicationQuotas and rate limits
Limits per user, team, or application, so one mistake doesn't consume everything.
Needed once multiple teams are involvedCost measurement per request
For every request, you know what it cost and who submitted it.
Counts from your first AI applicationCost allocation
Allocate costs to the department or customer that generated the work.
Only at scale or when requirements are strictReusing answers
Don’t pay twice for the same question: store the answer and serve it again.
Needed once multiple teams are involvedLimits on input
Check what goes in beforehand: sensitive data, prohibited requests, injection attempts.
Needed once multiple teams are involvedLimits on output
Check what comes out afterwards: fabrications, inappropriate content, leaked data.
Needed once multiple teams are involvedProtect sensitive data
Make personal data and trade secrets unrecognizable before they leave the premises.
Counts from your first AI applicationTool register
One overview of all integrations and MCP servers an agent is allowed to call.
Needed once multiple teams are involvedDocumentation of every request
Who asked what, which model answered, and what came back—all stored in a traceable way.
Counts from your first AI applicationMonitoring and alerting
Ongoing visibility into errors, wait times, and outliers, with an alert when something goes wrong.
Needed once multiple teams are involvedFallback in case of an outage
A backup route if the supplier goes down, so work doesn’t grind to a halt.
Needed once multiple teams are involvedLayer 5 · 8 capabilities
Models & Inference
The engines, interchangeable behind the gateway
Model selection and register
One list of approved models, with what they may and may not be used for.
Counts from your first AI applicationMultiple vendors
Not tied to one provider: switching is a configuration change, not a migration project.
Needed once multiple teams are involvedRun your own models
Models managed in-house or in your own region for work that can't leave the premises.
Only at scale or when requirements are strictAdjust your own work
Teach a model to adapt to your own professional terminology and examples.
Only at scale or when requirements are strictEmbedding and reorganization
The models that make text searchable and put the best passages at the top.
Needed once multiple teams are involvedSpeed and wait time
Know how long an answer takes, and whether that suits the work behind it.
Needed once multiple teams are involvedPrice versus quality
A deliberate choice for each task: the cheaper model where it can do the job, the more expensive one where it has to.
Counts from your first AI applicationModel lifecycle
Replace outdated models in time, with a test that proves they continue to work well.
Needed once multiple teams are involvedLayer 6 · 11 capabilities
Knowledge & Data
AI is only as good as the data it can access
Make sources accessible
Make the systems and folders containing your knowledge accessible to AI.
Counts from your first AI applicationPrepare documents
Make scanned documents readable by splitting them into chunks that make sense on their own.
Counts from your first AI applicationSearchable storage
An index that searches by meaning, not just exact words.
Needed once multiple teams are involvedRecovery strategy
The way the right documents are retrieved and provided in response to a question.
Needed once multiple teams are involvedSource and reference
For every answer, you can trace which document and version it came from.
Counts from your first AI applicationRights per document
Someone can't see anything through AI that they wouldn't be allowed to see without AI.
Counts from your first AI applicationCurrency
Agreed how often the knowledge is refreshed, and made it visible when it was last updated.
Counts from your first AI applicationTerms and definitions
One agreed meaning for customer, order, margin and hour — including for AI.
Counts from your first AI applicationData quality
Know how complete and reliable the source is before using AI on it.
Counts from your first AI applicationRetaining and deleting
It’s documented how long conversations and documents are kept, and how to truly delete something.
Needed once multiple teams are involvedFeedback to the source
When AI gets something wrong, it leads to a fix in the source system, not a workaround.
Only at scale or when requirements are strictLayer 7 · 7 capabilities
Infrastructure & Runtime
The foundation everything runs on
Computing capacity
Enough, and on time, without someone having to manually start a machine.
Needed once multiple teams are involvedNetwork and interfaces
Connections to suppliers and internal systems, secured and controlled.
Needed once multiple teams are involvedStorage
Where documents, indexes and logs are stored, with the right protection in place.
Counts from your first AI applicationProtected output
Code and tool calls run in an environment the rest can’t access.
Needed once multiple teams are involvedAvailability and recovery
Agreed how long something can be down, and tested the recovery process.
Needed once multiple teams are involvedRegion and data location
Know which country the data is stored and processed in, and be able to prove it.
Counts from your first AI applicationDeployment and management
The environment is described as code, so rebuilding it doesn’t become a guessing game.
Only at scale or when requirements are strictRail · 10 capabilities
Governance & FinOps
Value, risk, costs and compliance, across every layer
AI register
One overview of all AI applications in use, including those provided by suppliers.
Counts from your first AI applicationDetermine risk class
Determine which category of the AI Act each application falls into.
Counts from your first AI applicationPolicies and rules of use
On one A4 page, what employees can and can’t do with AI, in plain language.
Counts from your first AI applicationHuman oversight
It’s documented where a person needs to review and who that person is.
Counts from your first AI applicationTransparency
People know when they're interacting with AI and what happens to it.
Counts from your first AI applicationAudit trail
A verifiable record of what happened, for your accountant, auditor or regulator.
Needed once multiple teams are involvedSuppliers and contracts
Data processing agreements, terms and training use documented for each provider.
Counts from your first AI applicationBudget and caps
A monthly fee per application with a firm limit and advance notification.
Counts from your first AI applicationMeasure returns
Measure what each application delivers, and stop what isn't working.
Needed once multiple teams are involvedIncidents and escalation
A consistent process for when AI gets something wrong: report it, stop it, fix it, document it.
Needed once multiple teams are involvedRail · 7 capabilities
Identity & Security
Who can act, on whose behalf, and within what limits
Registration and identity
One account with two-step verification, including for AI applications.
Counts from your first AI applicationRoles and permissions
What someone is allowed to do depends on their role and changes when their role does.
Counts from your first AI applicationActing on someone's behalf
The agent works with the user’s permissions, not an administrator’s.
Needed once multiple teams are involvedMachine identities
Agents and scenarios have their own traceable accounts with limited permissions.
Needed once multiple teams are involvedSecrets management
Passwords and keys in a vault, with expiry dates and replacements.
Counts from your first AI applicationAttacks on AI
Protection against prompt injection, misuse of tools and data leakage.
Needed once multiple teams are involvedSecurity monitoring
Monitor unusual usage and periodically test whether it holds up.
Only at scale or when requirements are strictWhere do you stand across these nine layers?
One question per layer. Choose what comes closest — not what you would like. Your result goes to your portal, where you can fill it in further for each capability. Your answers stay on your own device.
1
Does everyone know what AI is for in your organization?Business & Strategy
2
Where are people using AI?Channels & Interfaces
3
How does an AI application get developed at your company?Agent development
4
Who can see what AI traffic is happening?AI Control Plane
5
How do you choose which model does what?Models & Inference
6
What does AI know about your own documents?Knowledge & Data
7
Do you know where your data is stored and runs?Infrastructure & Runtime
8
What arrangements are in place for risks and costs?Governance & FinOps
9
How is access managed?Identity & Security
0 of 9 answered
Capabilities are lasting. Tools are replaceable.
Models and frameworks last for months. Switching should be a configuration change, not a migration project. That's why this model doesn't mention a single brand — only what you need to be able to do.
Take the scan — nine questions → Schedule a Fresh PerspectiveThe model says what needs to be there. Getting people on board is about AI adoption in SMEs.
About this model. Based on the Enterprise AI Capability Model (pre-3.0) by Martin Molenkamp; its nine-layer structure has been adopted, while the definitions and SME adaptation are by Bedrijfsgeheugen. The nine layers and five levels are a common way to organize AI maturity; what we add is the adaptation for companies with 3 to 250 employees — each capability is marked as applying from your first AI application, only being needed once multiple teams are involved, or only applying at scale and under strict requirements. Of the 86 capabilities, 39 apply from day one.
What is your next step?
Free self-assessmentTwelve click questions, three minutes, immediate score and your biggest risk.
Fresh LookBusiness case, benchmark and priority. Settled once we build after this.
What it costsFixed price per package, no price per user, no hourly billing.
From the fieldWhat changed at companies that started with this.
Also good to know: frequently asked questions · security and data · terms and conditions · partners · research and figures · templates · what's changing · where you start