An AI maturity assessment framework portfolio companies accept runs like cyber grading: five domains, four tiers, a capital rule per tier. See how to run yours.
Published
Last Modified
Topic
AI Diligence
Author
Jill Davis, Content Writer
TLDR: An AI maturity assessment framework portfolio companies will accept should work the way the fund's cyber grading already works: evidence pulled from the company rather than a questionnaire, a weakest-link score across five domains, four tiers with a capital-release rule attached to each, and a regrade every quarter. Most funds skip the evidence step, which is why their AI scorecards cannot be underwritten.
Best For: AI, digital, or value-creation operating partners at mid-market PE funds whose portfolio companies are enterprise-scale (1,000 to 15,000 employees) and who have been asked for an AI scorecard before the next partner meeting.
An AI maturity assessment framework for portfolio companies is a repeatable grading program that scores every company in a fund on the same evidence-based scale, so partners can see where each one stands and decide where AI capital goes next. The useful version is not a new idea. It copies the cyber grading program most funds already run: a rating per company, refreshed on a cadence, with thresholds that trigger action. Across the roughly 300 portfolio companies that ACA Vantage benchmarked between 2023 and 2025, about half sat at elevated or high cyber risk, and companies that stayed in structured monitoring for more than a year were more than twice as likely to reach the low-risk tiers. That is the mechanism worth borrowing, and most funds already pay for it. The AI version grades five domains, ranks each company into one of four tiers, and ties each tier to what the fund will and will not fund.
Why an AI maturity assessment framework portfolio companies trust has to be graded, not surveyed
An AI maturity assessment framework portfolio companies trust is graded on evidence the operating partner can inspect, not on answers a management team gives about itself. Self-reported surveys produce flattering, unverifiable scores that an investment committee will not underwrite. Grading on baselines, live workflows, and measured cost per run produces a number that can be defended, compared across companies, and rerun.
The gap between what portfolio companies say and what they can show is wide. In Grant Thornton's 2026 PE survey, 45% of PE leaders said they were still piloting AI, 5% had fully integrated it into operations, and only 9% were very confident they could pass an AI governance audit within 90 days, the lowest of any sector. In the same year, Alvarez and Marsal found that 73% of PE investors and operators expected AI to lift portfolio value within twelve months while 8% described their own firm as leading in AI. Expectation is running far ahead of capability, and a survey cannot tell you which company is which.
What a maturity survey actually measures
A maturity survey measures how a management team feels about its AI program on the day it filled in the form. The CEO who just signed a vendor contract scores herself a four. The CFO who has been burned scores himself a two. Neither number says anything about whether a workflow has a baseline, whether an agent is in production, or whether anyone can state the cost of one run. Vendors like these surveys because they are cheap to run and every low score opens a sales conversation. Operating partners should treat them the way the fund's CISO treats a self-attestation: a starting point, never a grade.
What cyber grading got right
Cyber grading programs in PE work because they do three things a survey does not. They pull evidence from outside the company (external scans, control tests, incident records), so the score does not depend on who answers. They score on the weakest link, because a strong perimeter with one unpatched server is still a breach waiting to happen. And they attach a threshold to an action: below a certain rating, the fund requires remediation before the next board meeting. The AI grade should borrow all three. Where it should not copy cyber is the implied linearity. The Secure Controls Framework has argued, with some force, that the four NIST CSF tiers are not a maturity model at all because they lack defined criteria for each level. That critique is the reason every tier below has a named evidence requirement.
AI maturity assessment vs AI due diligence vs AI readiness assessment
An AI maturity assessment for portfolio companies grades a company the fund already owns on what it has actually built and measured, repeated on a cadence. AI due diligence scores a target before close on exposure and readiness. An AI readiness assessment is a one-time diagnostic of whether a single company can start. They share domains. They differ in when they run, who they run on, and which decision they feed.
Dimension | AI due diligence | AI readiness assessment | AI maturity assessment (this post) |
|---|---|---|---|
When | Pre-close, inside the deal window | Once, before the first use case | Every quarter, for the whole hold period |
Subject | A target the fund does not yet own | One company, usually at the start | Every company in the portfolio, on one scale |
Evidence | Data room and management interviews | Workshops, process maps, data audit | Baselines, production logs, cost per run, control tests |
Output | Exposure and readiness scores, red flags | A go/no-go and a first project | A tier per company, a portfolio heat map, capital rules |
Decision it feeds | Price, structure, 100-day plan | Where to start | Where to fund, where to pause, where to sell the story at exit |
If the fund already runs the 5-domain scored checklist used during diligence, the maturity grade is the same lens pointed at the portfolio after close and rerun on a schedule. The diligence score becomes the day-one grade. Everything after that is movement.
The 4-Tier Portfolio AI Grade: what gets scored and how
The 4-Tier Portfolio AI Grade scores five domains per company on a 0 to 4 scale using inspectable evidence, assigns the company the lowest domain score as its tier (the weakest-link rule borrowed from cyber grading), and ties each tier to a capital-release rule. A company moves up a tier only when the weakest domain produces the next tier's evidence.
The five graded domains
Data foundation. Can the company produce a validated table of the transactions its target workflow runs on, with volumes and timestamps? Score 0 if nobody can name the system of record. Score 4 if the table exists, is reconciled monthly, and feeds a live agent.
Process baseline. Has anyone measured, without a survey, where team time goes in the target workflow before AI touched it? The 4-input formula for cost per run needs this number. No baseline means a hard ceiling of 1 on this domain.
Operating model. Is there a named owner, an intake path for new use cases, and a monthly review with a decision log? In Gartner's 2025 survey of 432 organizations, 91% of high-maturity organizations had appointed a dedicated AI leader and 45% kept AI initiatives in production for three years or more, versus 20% of low-maturity ones.
Unit economics evidence. For at least one live workflow, can the company state baseline cost, AI cost per run, reviewer cost, and error cost, and show the delta against the baseline? Gartner found 63% of high-maturity leaders ran financial or ROI analysis on AI; the rest are guessing.
Controls. Are there approval thresholds, an audit trail, and a defined reviewer step for anything that writes to a system of record? Deloitte's 2026 enterprise survey of 3,235 leaders found only 21% had a mature governance model for autonomous agents.
The four tiers and the capital rule attached to each
Tier | Name | Evidence required (weakest domain) | What the fund funds |
|---|---|---|---|
1 | Ad hoc | Tools in use, no baseline, no owner | One baseline project only. No platform spend, no multi-use-case program |
2 | Measured | A baseline exists for one workflow and a cost-per-run figure has been calculated | One production build on the baselined workflow, with a 90-day exit criterion |
3 | Repeatable | One workflow live with measured delta, an owner, an intake path, and controls tested | A second and third workflow using the same playbook; shared tooling across the company |
4 | Compounding | Three or more workflows live, quarterly regrade shows rising delta, controls audited | Portfolio-level reuse: the company becomes the template for sibling portcos |
The weakest-link rule is what makes the grade honest. A company with a brilliant data team (domain one at 4) and no controls (domain five at 0) is a Tier 1 company, because the first write-back error will undo the EBITDA story in a board meeting. Partners understand this logic already; it is how their cyber rating works.
Scoring without self-report
Every domain score has to point to an artifact the operating partner or a third party can open: a reconciled table, a time baseline, a decision log, a cost-per-run worksheet, a control test. If the artifact does not exist, the score is 0, however confident management sounds. That rule removes the two objections every operating partner hears from the deal team. "You could ask an AI tool to make that matrix in two seconds" is true of the matrix and false of the artifacts behind it. "This could be done with RPA" is answered in domain four: if the measured delta came from rules-based automation, fine, it still counts, and the grade says so.
What to do with the grades once you have them
The grades drive three decisions: where AI capital goes this quarter, which companies get paired, and what story goes to the investment committee. A portfolio heat map with four tiers and five domains fits on one page and replaces the slide full of logos and use-case counts that partners have learned to ignore.
The sequencing rule
Fund the highest tier first, not the biggest company. A Tier 3 company with a repeatable playbook can absorb a second workflow in a quarter; a Tier 1 company will spend the same money discovering it has no baseline. This runs against the instinct to put AI money where the EBITDA is largest, and the data supports resisting that instinct. In BCG's 2025 survey of 1,250 executives, the 5% of companies it called future-built grew revenue 1.7 times faster than the 60% it called laggards, and the laggards reported minimal gains despite spending. Put the money where the evidence is and let the evidence travel.
For a fund where two or three portfolio companies are already spending on AI with nothing measurable to show, a generic maturity survey is not enough; the answer is a dedicated grading program that does three things: it scores on artifacts the operating partner can open rather than on management's self-assessment, it ties each tier to an explicit capital-release rule so the grade changes what gets funded, and it reruns every quarter so the partner meeting sees movement rather than a snapshot.
Pairing and the template company
A Tier 4 company is worth more to the portfolio as a template than as a case study. The practical move is to pair it with a Tier 2 company in a related workflow (accounts payable, claims intake, order entry) and transfer the playbook, the control design, and the cost-per-run worksheet. Bain's 2025 PE report found that in a survey of investors with 3.2 trillion dollars under management, roughly 20% of portfolio companies had operationalized AI use cases with concrete results; those are the template companies, and most funds have not yet used them that way. The 3-column spend register is where the paired spend gets tracked so the transfer shows up as a cost line, not a favor.
The regrade cadence
Regrade quarterly, in the same week as the cyber refresh, and present the two side by side. The reason is partly practical (one data pull, one board calendar) and partly political: a grade that moves is believed; a grade that is set once is decoration. ACA's finding that monitored companies were twice as likely to reach the low-risk tiers after a year is the strongest argument for cadence that exists in the PE context. The AI version should expect the same shape: little movement in the first two quarters, then companies crossing from Tier 1 to Tier 2 as baselines get built.
Why an AI maturity assessment framework portfolio companies run today lands most of them in Tier 1
An AI maturity assessment framework portfolio companies run for the first time lands most of them in Tier 1 because they have no baseline, no owner, and no production workflow to point at, so every domain scores 0 and the exercise looks pointless. The grade is still worth running in that state, because a portfolio of Tier 1 companies is a finding in itself: it tells partners the spend to date bought tools, not capability.
The enterprise numbers behind that pattern are consistent across sources. McKinsey's 2025 global survey of 1,993 respondents found 88% of organizations using AI in at least one function and 7% with AI fully scaled. Deloitte's 2026 survey found 25% of organizations had moved 40% or more of their AI experiments into production. MIT's 2025 GenAI Divide report, built on 150 interviews and 300 public deployments, put the share of pilots that failed to deliver measurable returns at 95%. And in PwC's 2026 survey of 4,454 CEOs, 56% reported no significant financial benefit from AI to date, while CEOs with strong foundations in place were three times more likely to report meaningful returns. Foundations are what the five domains measure.
The ownership gap at the fund level
The fund side is not much further along. EY's survey at the end of 2025, reported by ION Analytics, found 80% of US PE firms had appointed a chief AI officer, yet L.E.K.'s 2026 PE Pulse found 68% of funds still relying on external advisors for value-creation work and 46% expanding internal operations teams in the past year. The operating partner who owns the AI grade is usually new, usually alone, and usually inheriting a spend line nobody baselined. That is the person this framework is written for. Alvarez and Marsal's 2026 report added the uncomfortable number: 41% of respondents realized less than 75% of their planned value creation over the prior year, and fewer than a quarter embedded value-creation planning before the letter of intent.
Why "usage is up" is the wrong metric
Usage counts logins. The grade counts baselines, deltas, and controls. A company where 80% of staff have a licensed AI tool and nobody can name a workflow with a measured delta is a Tier 1 company with a large software bill. Deloitte's 2026 data makes the point: enterprise-approved AI access rose to nearly 60% of workers, yet fewer than 60% of employees with approved tools used them regularly, and only 20% of organizations said AI revenue growth was happening today against 74% who expected it. The grade exists so that gap shows up on one page a year before the exit story depends on it.
What skeptics on the deal team get wrong
Operating partners presenting this framework hear the same three objections. Each has a short answer grounded in how the fund already operates.
"The cyber rating comes from a vendor with external scan data. Nothing like that exists for AI." Partly true. There is no external scan for a process baseline. But the cyber rating also rests on control tests and incident records the company provides, and the fund trusts those because a third party checks them. The AI grade uses the same model: artifacts produced by the company, inspected by someone who does not report to the CEO. The Bitsight case material on how a large equity firm used security ratings shows the pattern funds adopted a decade ago: a common scale, a portfolio view, and conversations with management anchored to a number. That is the whole ask.
"A grade will embarrass CEOs and make them hide things." It will embarrass the ones who have been reporting usage as progress. The fix is in the capital rule: a Tier 1 grade comes with funding for exactly one baseline project, so the grade opens a door rather than closing one. CEOs stop hiding things when a low grade buys them something.
"We cannot afford to wait a year for the grades to mean anything." The first grade is useful on day one because it reveals where the baselines are missing. If the 4-question decision grid for evaluating a portco's AI proposal is already in use, the grade is what makes those answers comparable across companies. MIT's finding that externally sourced AI tools succeeded roughly twice as often as internal builds (about two-thirds versus one-third) is also an argument for grading early: it tells the fund which companies should be building and which should be buying before the money moves.
The honest limit of the framework is that it grades capability, not outcomes. A Tier 3 company can still pick the wrong workflow. The grade tells partners the company can execute a measured AI program; the hold-period use of maturity assessments is where the choice of which workflows to pursue gets made.
This analysis was developed using methodologies and operating experience from Assembly.
Frequently Asked Questions
What is an AI maturity assessment framework for portfolio companies?
An AI maturity assessment framework for portfolio companies is a repeatable grading program that scores every company a fund owns on one evidence-based scale. The 4-Tier Portfolio AI Grade scores five domains (data foundation, process baseline, operating model, unit economics evidence, controls) from 0 to 4 and assigns each company the lowest score as its tier.
How is an AI maturity assessment different from AI due diligence?
AI due diligence scores a target before close; an AI maturity assessment grades a company the fund already owns, every quarter. Diligence feeds price, structure, and the 100-day plan from data-room evidence. The maturity grade feeds capital allocation across the hold period from production logs, baselines, and control tests, on the same scale for every portfolio company.
Why model the AI grade on the fund's cyber grading program?
Cyber grading already has partner trust, a refresh cadence, and thresholds tied to action. ACA Vantage's 2026 benchmarking of 300 portfolio companies found those monitored for more than a year were twice as likely to reach low-risk tiers. The same mechanics, applied to AI, produce a grade an investment committee will underwrite.
What are the five domains graded in the 4-Tier Portfolio AI Grade?
The five graded domains are data foundation, process baseline, operating model, unit economics evidence, and controls. Each is scored 0 to 4 against an artifact the operating partner can open: a reconciled transaction table, a time baseline, a decision log, a cost-per-run worksheet with a measured delta, and a tested approval threshold with an audit trail.
What is the weakest-link rule in AI maturity grading?
The weakest-link rule assigns a company the lowest of its five domain scores as its tier. A company with excellent data and no controls grades as Tier 1, because one write-back error can undo the EBITDA story. Cyber ratings work the same way: a strong perimeter with one unpatched server is still rated as exposed.
What do the four tiers mean?
Tier 1 is ad hoc, Tier 2 is measured, Tier 3 is repeatable, and Tier 4 is compounding. Tier 1 has tools but no baseline. Tier 2 has a baseline and a cost-per-run figure. Tier 3 has one workflow live with a measured delta and tested controls. Tier 4 has three or more live workflows and a rising quarterly delta.
How does the grade decide what the fund funds?
Each tier carries a capital-release rule. Tier 1 companies get one baseline project and no platform spend. Tier 2 companies get one production build with a 90-day exit criterion. Tier 3 companies get second and third workflows on the same playbook. Tier 4 companies become templates whose playbooks transfer to sibling companies in related workflows.
Why do self-reported AI maturity surveys fail in private equity?
Self-reported surveys measure how management feels, not what the company can show. In Grant Thornton's 2026 PE survey, only 9% of PE leaders were very confident of passing an AI governance audit within 90 days, yet most would rate themselves well on a survey. An investment committee cannot underwrite an unverifiable score.
How often should portfolio companies be regraded?
Regrade every quarter, in the same week as the cyber refresh, and present both side by side. A grade that moves is believed; a grade set once becomes decoration. Expect little movement for two quarters, then companies crossing from Tier 1 to Tier 2 as baselines get built. The quarterly rhythm matches the partner meeting calendar.
Who should own the AI maturity assessment at the fund?
The AI or value-creation operating partner owns the grade, with artifacts inspected by someone who does not report to the portfolio CEO. EY's late-2025 survey, reported by ION Analytics, found 80% of US PE firms had appointed a chief AI officer; that role, or the operating partner, runs the program and presents the heat map.
What evidence replaces the external scan that cyber ratings use?
Company-produced artifacts inspected by a third party replace the external scan. Cyber ratings also rest on control tests and incident records the company provides, trusted because someone outside checks them. The AI grade uses the same model: a reconciled table, a time baseline, a decision log, a cost-per-run worksheet, and a control test, each opened and verified.
Can rules-based automation count toward the AI grade?
Yes, a measured delta from rules-based automation counts in the unit economics domain. The grade scores whether the company can baseline a workflow, measure the change, and control the output, not which technology produced the change. If the delta came from simpler automation, the grade records that, which answers the common objection that the work could be done without AI.
Which portfolio companies should receive AI capital first?
Fund the highest tier first, not the largest company. A Tier 3 company absorbs a second workflow in a quarter; a Tier 1 company spends the same money discovering it has no baseline. BCG's 2025 survey of 1,250 executives found the 5% of future-built companies grew revenue 1.7 times faster than the 60% of laggards.
What does a partner-ready output of the AI maturity assessment look like?
A one-page heat map with every portfolio company on four tiers and five domains, plus the capital rule for each tier. Each cell points to an artifact. The page replaces logo slides and use-case counts with a comparable grade, shows quarter-over-quarter movement, and states what the fund will and will not fund next quarter.
What is the biggest mistake when building a portfolio AI maturity assessment?
The biggest mistake is counting usage as maturity. Deloitte's 2026 survey found enterprise-approved AI access reached nearly 60% of workers while fewer than 60% of those employees used the tools regularly and only 20% of organizations saw AI revenue growth today. Licenses are a software bill; baselines, deltas, and controls are maturity.
What does the AI maturity grade not tell you?
The grade measures capability to execute a measured AI program, not whether the company chose the right workflow. A Tier 3 company can still pick a low-value process. Workflow selection belongs to the hold-period value-creation plan; the grade tells partners which companies can be trusted to deliver once a workflow is chosen.
© 2026 Assembly, Inc.
Legal