Framework · April 2026
Four levels of organisational AI maturity in healthcare
Healthcare Maturity model
Informal, functional, integrated, strategic. Each is mapped to the regulatory exposure it actually carries, from silent GDPR exposure to eligibility for EHDS secondary use.
The question it answers
Healthcare executives are being asked to adopt AI while the regulatory floor is still being poured under them. The European Commission's 2025 study on the deployment of AI in healthcare reports that most hospitals are not prepared for the AI Act, that leadership is named more often than technology as the blocking factor, and that in-house AI expertise is close to absent. The session had to be useful to people already using AI informally, without either alarming them into inaction or endorsing what they were doing.
How it was produced
- A diagnostic built on the European Commission's 2025 deployment study rather than on vendor material
- A four-level organisational maturity model (informal, functional, integrated, strategic) with each level mapped to the regulatory exposure it actually carries
- Four governance pillars: strategy, data, architecture, accountability, each reduced to a decision someone has to own
- Kotter's change sequence adapted to health AI, and six evaluation criteria for assessing a proposed AI solution
- A live self-assessment exercise: participants placed their own organisation on the model during the session
What it concluded
The model separates the level of the technology from the level of the governance around it, which is where the risk sits: level-3 tooling under level-1 leadership is unmanaged exposure, not progress. Each level names the specific regulatory consequence: silent GDPR exposure at level 1, no DPIA and no named supervisor at level 2, AI Act Article 26 at level 3, eligibility for EHDS secondary use at level 4. The question stops being "are we doing AI" and becomes "what are we exposed to, and who owns it".
The three sections above are drawn from Leading the change for AI in healthcare, the engagement this material came out of.
Hospital and clinic leadership, health authorities, medical faculties and health-technology companies.
Framework · Maturity model
Deciding something this touches?
Start with a two-week scoping review.