The Unified AI Adoption Framework

One integrated model for taking AI from ambition to measurable value — in the age of agentic AI.

Most organisations have stopped asking whether to adopt AI. They are stuck on how — how to move from a pile of promising pilots to safe, scaled, measurable value, and increasingly how to do that with AI agents that take actions rather than just answer questions. The data on that gap is stark: around 88% of organisations now use AI in at least one function, but only about a quarter have moved 40% or more of their pilots into production, and Gartner expects 40% of agentic AI projects to be cancelled by the end of 2027 on cost, unclear value and weak risk controls.

I kept seeing the same root causes behind stalled programmes — no value thesis, data that isn't AI-ready, governance bolted on too late, people never brought along, and no operational discipline once real users arrive. There are excellent frameworks for the individual pieces, but each only covers part of the problem. So I combined four of the most widely used ones into a single operating model that leaders and practitioners can share, and built a complete, ready-to-run toolkit around it.

I'm publishing the whole thing here, free to use and adapt.

The idea: four frameworks, one model

Each framework answers a different question, and none answers all of them. Put together, they cover the full picture.

Layer	Framework	The question it answers
Structure	AWS CAF-AI (six perspectives)	What capabilities must we build, and who owns them?
Guardrails	NIST AI RMF + ISO/IEC 42001	How do we stay safe, compliant and trusted as we scale?
Diagnosis	A five-level maturity model	Where are we today, and what's the next realistic step?
People	ADKAR	How do we get people to actually change how they work?
Outcome	Value realisation	Are we delivering measurable results against a baseline?

CAF-AI is published by AWS, but I use its six perspectives purely as a technology-neutral structure — nothing in the model depends on a particular cloud, model or vendor.

Three ideas it's built on

• Value first, technology second. Start from three to five business objectives, not from a model or a tool. Every capability, control and change activity should trace back to a measurable result.
• Governance is an accelerator when it's built in early. Risk-tiered, proportionate controls let low-risk use cases move fast and high-risk ones move safely. The most effective single step is a published risk-tiering scheme with a fast lane.
• Agents need reliability more than autonomy. Give an agent the least autonomy that delivers the outcome, and let it earn more through evaluation evidence — not ambition.

Two ideas in the diagnosis tend to change the conversation in the room. The first is the ceiling rule: an organisation can't sustainably operate AI above its weakest foundation, so the overall maturity level is the lowest of Governance, Data and Security — not the average. The second follows from it: a flattering headline score can hide a Level 1 dimension, so you always read the full profile, never just the number.

What's included

Everything below is in the toolkit. It's designed so you can run a maturity assessment, prioritise use cases, and build a 12-month roadmap with the same shared language throughout.

• The playbook (Unified_AI_Adoption_Framework.docx) — the full ~25-page guide: the integrated model and a crosswalk between the frameworks, a maturity assessment, chapters on strategy and value, people and ADKAR, governance (NIST AI RMF and ISO/IEC 42001), data foundations, platform and agentic AI, security, and observability, a phased 12-month roadmap, and practitioner appendices.
• The maturity self-assessment (AI_Maturity_Self_Assessment.xlsx) — a scoring workbook: 28 statements across seven dimensions, auto-calculated levels and priorities, a radar chart, and an action-plan sheet. Score evidence, not intent.
• Two worked examples (..._Worked_Example.xlsx, ..._Worked_Example_2.xlsx) — two fictional organisations with opposite failure patterns. Northwind Retail Group is "pilot purgatory": a strong strategy dragged to an overall Level 1 by weak data and security. Contoso Financial Services is a "compliance freeze": mature controls, but adoption stuck near 9% because one committee reviews everything. Together they show why the full profile matters more than the headline.
• The workshop deck (Unified_AI_Adoption_Workshop.pptx) — a 20-slide, half-day session with facilitator notes and two hands-on exercises built around the assessment.
• The participant handout (Unified_AI_Adoption_Participant_Handout.pdf) — a one-page summary with a commitments box for attendees to complete.

How to use it

1. Assess. Run the self-assessment with a cross-functional group — business, data, risk, security and change. Score against evidence.
2. Prioritise. Pick three to five lead use cases using the value / feasibility / risk scoring in the playbook.
3. Plan. Build a 90-day plan with named owners and a governance gate at the end, then reassess maturity every six months.

If you're running it as a workshop, the deck and handout are built to walk a room through exactly that sequence, using the two worked examples to calibrate scoring before people score themselves.

A note on sources

The framework synthesises public, vendor-neutral sources — the AWS Cloud Adoption Framework for AI, the NIST AI Risk Management Framework and its Generative AI Profile, ISO/IEC 42001, the EU AI Act, OWASP's LLM and agentic security guidance, and current analyst commentary. Statistics and regulatory timelines move quickly, so check the references in the playbook against the latest editions before you rely on them externally, and treat the regulatory summary as orientation rather than legal advice.

It's free to use and adapt with attribution. If you put it to work — or improve on it — I'd genuinely like to hear how it went.