AI-assisted, AI-first, AI-native: three levels of delegation to measure real AI adoption

In short. AI adoption is measured on the individual process, by looking at who produces the output and who checks it. At the AI-assisted level the work stays with the person, at the AI-first level the model produces and a person reviews every output, at the AI-native level the process runs without case-by-case review, inside written rules and controls. Each level has different tools, costs and risks, and for some decisions the right choice is to stop before the third.

In this year's board presentations the word AI-native shows up everywhere, in strategy slides and in announcements of new operating models, and it almost always describes an intention more than a way of working. The numbers show the same distance from another angle: according to the Artificial Intelligence Observatory of Politecnico di Milano, presented on 5 February 2026, 71% of large Italian companies have active AI projects, while only 9% of companies report structured governance.

When we ask a leadership team where they stand on AI, the answer nearly always starts from the tools, how many licences and how many pilots launched in the last six months, and it is an answer that describes a purchase and says little about the work. That is why our assessment method reads maturity at the level of the single process, looking at how the work is split between people and models: who is responsible for production, who for verification, where accountability sits when something goes wrong.

The idea has a precedent in the car industry. In 2014 SAE International published the J3016 standard on levels of driving automation, from zero to five, and its most useful insight went largely unnoticed in public debate: the automation level does not belong to the car, it belongs to a feature operating within a defined domain (the motorway in good weather, the car park, the queue on the ring road). The same vehicle can carry features at different levels, and asking "what level is this car" leads you off the road. AI inside a company works exactly the same way.

The three levels of delegation

Level 1, AI-assisted

The work belongs to the person, who uses the model as one tool among many: a quick translation, the summary of a call, the rewrite of an email that ran too long, the spreadsheet formula they couldn't remember. The process is the same as before, a human produces the artefact from start to finish, and the gain is measured in minutes saved by an individual.

It is the most widespread level, and it is often mistaken for adoption because usage figures are reassuring. The same Politecnico Observatory finds that 47% of Italian workers use AI tools regularly, but only 19% do so exclusively with tools provided by their organisation: a level 1 that is widespread and largely invisible to the company, what reports call shadow AI.

Level 2, AI-first

The model produces the first complete version of the artefact, whether a quarterly report, the reply to a complaint or a product sheet, and the person becomes its editor: they prepare the starting material, correct, ask for new versions and decide when the result can go out. Production has moved to the model, verification is still entirely human, and every output passes through a person before reaching its destination.

This is where the process really changes, because the job changes, and time shifts from writing to preparing context and reviewing. The bottleneck changes too, moving from production to the capacity to review well.

Level 3, AI-native

The process runs without case-by-case review. The human contribution moves upstream and alongside the flow: defining acceptance criteria, the boundaries within which the system may act and the conditions that force it to stop and ask, then watching how it behaves through metrics and samples.

This is how we run part of our internal software development, on Company Brain and on models running local inference: change requests enter the flow, agents turn them into a plan and into code, automated tests and project rules decide what can be merged, and people step in when a test fails or a case falls outside the expected boundaries.

	AI-assisted	AI-first	AI-native
Who produces the output	The person	The AI	The AI
Who reviews	The person, on their own work	The person, every output	The control system, through samples and exceptions
What people do	The work	Context, review, correction	Rules, metrics, exception handling
Unit of value	Individual time	Output per person	Process volume
Typical risk	Ungoverned use, data leaving the perimeter	Review turning into a rubber stamp	Systematic error that goes undetected

The level belongs to the process

The first mistake we see, and one we made ourselves, is using these levels as a company label. A company calling itself AI-native is in practice averaging across very different processes, and in this field an average hides more than it shows.

Within the same organisation, supplier invoice reconciliation can sit at level 3, marketing content production at level 2, the evaluation of an acquisition at level 1, and all three choices can be right. As in J3016, the level lives inside an operational domain: a high-volume process, with rules that can be written down and reversible errors, is a natural candidate for full delegation, while a rare, ambiguous process with consequences that are hard to undo needs judgement to stay with people.

A mature company, from this angle, is one that can state for every critical process what level it is at, what level it has decided to take it to and why, and that has the governance to keep that level over time. Some processes will stay at level 1 by choice, and when the choice is reasoned it is as much a part of strategy as a process taken to level 3.

How companies see themselves and where they are

If you look at the processes of most companies we meet, the gap between self-perception and reality follows a fairly consistent pattern: a very widespread level 1, a few pockets of level 2 in functions where a motivated team built its own workflow, and level 3 limited to a handful of cases, often born inside IT and little known to the rest of the organisation.

Public data points the same way. The AI4Innovation Observatory of Politecnico di Milano, based on a survey of 85 organisations carried out between February and March 2026, classifies 25% of companies as AI Starters, with a sporadic approach driven by individual initiative, 49% as AI Experimenters, with pilots on specific cases that have not yet entered operational routine, and only 26% as AI Scalers, with multiple use cases, defined governance, clear ownership and monitoring metrics. Globally, McKinsey's State of AI 2025 report, based on 1,993 responses collected between June and July 2025, shows that 62% of organisations are at least experimenting with AI agents and 23% are scaling them somewhere in the enterprise, but in no single function does the share scaling agents exceed 10%.

Read through the lens of delegation levels, these numbers say something precise: experimentation with agents is broad, level 3 in production is rare and almost always confined to one or two functions. A few checks are enough to see where a process really stands, and we use them as a first filter in assessment sessions:

• if you remove the AI tool and the process works the same, only more slowly, that process is at level 1;
• if the AI produces the first version but no output leaves without a person having read and approved it, the process is at level 2;
• if most outputs leave without individual review and someone answers in writing for rules, metrics and exceptions, the process is at level 3;
• if outputs leave without review and nobody ever wrote the rules, the process is ungoverned automation, and should be treated as an open risk.

The last case is more common than people think, and it almost always grows out of a level 2 that emptied out without anyone deciding it.

The AI-first trap

In J3016, level 3 is considered the most delicate, because it asks the driver not to drive but to stay ready to take back control when the system requests it, and people who are not driving soon stop paying attention. The AI-first level has the same design flaw. At first the review is careful, the reviewer reads every line and corrects a lot, then volumes grow, the model makes fewer mistakes, corrections thin out, and after a few weeks the person who approved twenty documents a day is approving two hundred after reading the first paragraph.

The human factors literature calls this automation complacency, the tendency to trust automation in proportion to its perceived reliability, and the result inside a company is a process that is AI-first on paper and AI-native in practice without any of its safeguards, with no written rules and no metrics, and a human signature certifying a review that never happened. It is the worst combination, because formal accountability stays with the person while real control has disappeared.

Avoiding it means measuring the review, how many outputs get modified and how many corrections arrive after approval, because a review that no longer changes anything is a signal to read, and it means deciding explicitly when a process moves to level 3, building the rules and controls first instead of letting it slide there out of fatigue.

The tools of each level

As you move up a level, investment shifts from the model to the control layer around it, and whoever allocates the budget should know this before choosing a supplier.

The first level needs general-purpose assistants, a clear usage policy, company tools that keep data inside the perimeter and a literacy programme, which for European companies is also an obligation: Article 4 of the AI Act has required AI literacy measures for staff since 2 February 2025.

At the AI-first level the main work concerns context. It takes repositories of documents, examples and style rules the model can read, prompt and template libraries that are shared instead of kept on individual laptops, integrations that bring the model into the tools where work happens, and above all a written review standard that tells the reviewer what to check and what can be taken as given.

The AI-native stack changes nature. It takes agent orchestration with minimal permissions on the systems agents touch, rules written in verifiable form, sets of test cases to evaluate behaviour before and after every change, complete logs of what was done and why, monitoring thresholds that trigger escalation to a person, and the ability to stop the process and roll back. For data that must not leave the company, local inference comes into play as well, shifting part of the decision from the model provider to the infrastructure.

The business case by level

Each level has different economics, and mixing them up is the most common reason business cases fail to add up.

Level	Where value comes from	Main cost	When the case falls apart
AI-assisted	Time saved by individuals	Licences and training	Freed-up time is not reallocated and never reaches the P&L
AI-first	More output per person	Context preparation and review time	Reviewing and correcting costs almost as much as producing from scratch
AI-native	Volume handled at low marginal cost	Rule design, integration, monitoring	Low volumes, rules that can't be written, costly or irreversible errors

The benefit of AI-assisted work is real but scattered: twenty minutes saved by each person, every day, rarely turn into a line in the accounts, because they are absorbed into other activities without anyone reassigning them. McKinsey's 2025 report finds that 88% of organisations use AI regularly in at least one function, while nearly two thirds have not yet started scaling it across the enterprise.

With AI-first the sums are done process by process, and they are best done with an explicit inequality: delegation makes sense if the time to produce manually exceeds the sum of the time to prepare inputs, the review time, and the correction time multiplied by how often corrections are needed. Many pilots fail here, because they measure how fast the model produces a draft and forget how long it takes an expert to make it usable.

Moving to AI-native changes the cost structure: alongside the variable cost of inference come a fixed design cost, made of rules, integrations, test cases and monitoring, and the expected cost of undetected errors, which depends on how often they happen and how much they cost when they do. Value grows with volume, so level 3 makes sense on frequent, well-defined processes where an error can be corrected cheaply. In June 2025 Gartner predicted that over 40% of agentic AI projects will be cancelled by the end of 2027 because of rising costs, unclear business value or inadequate risk controls, which are exactly the three terms of this equation left unanswered at the start of the project.

What not to delegate

Level 3 is a choice to be made process by process, and for some decisions the right choice is to stay lower. Two cases show this well, identifying and acquiring a company on one side and handling litigation on the other. In both, AI is useful, in screening targets, analysing financial statements, reviewing case documents, drafting a first version of a brief, but the decision stays human for reasons that go beyond the technical quality of the model.

The criteria we use to set the maximum level for a process are few and verifiable:

Criterion	Pushes towards level 1	Pushes towards level 3
Reversibility of error	Error hard or impossible to undo	Error correctable at low cost
Volume and repetition	Rare decisions, each one different	Many similar decisions every day
Can success be written down	A good result depends on judgement and context	A good result can be described with rules and tests
Accountability	Fiduciary or personal responsibility of the decision-maker	Responsibility for the design of the process
Regulatory classification	High-risk areas with mandatory human oversight	Limited or minimal risk areas

An acquisition is the limit case on almost every criterion, because it is a rare and irreversible decision, taken on signals that cannot be codified and under the fiduciary responsibility of the board. Litigation is more nuanced, because within it document review can sit at level 2 while litigation strategy stays at level 1, which shows how useful it is to break processes down before classifying them.

The regulatory frame

The AI Act bears directly on this classification. Article 14 requires high-risk systems to be designed for effective human oversight, and among the capabilities the people in charge must have it explicitly lists awareness of the tendency to over-rely on the system's output, the same automation bias that hollows out level 2. Article 26 requires deployers to assign oversight to people with adequate competence, training and authority.

For processes falling within the areas of Annex III, such as recruitment, creditworthiness assessment or pricing in life and health insurance, level 3 without oversight is not an available option. The obligations for these systems have been moved to 2 December 2027 by the Digital Omnibus regulation (Regulation (EU) 2026/1744), but the map of delegation levels has to be built first, because that is where you see where oversight is needed and who exercises it. ISO/IEC 42001 provides the management system frame in which to document these choices and keep them current.

How to move

The path we propose to our clients starts from an inventory and ends with a decision map, through steps a leadership team can start without waiting for a large transformation programme:

1. list the processes where AI is already present, starting from the AI system inventory, including unauthorised individual use, which almost always outnumbers what is declared;
2. assign each process its actual level, using the checks described above, and its target level, decided with the criteria in the table and approved by whoever is accountable for it;
3. for moves from level 1 to level 2, build the context and the review standard, and measure review time and correction rate from day one;
4. for moves from level 2 to level 3, write the rules in verifiable form, prepare the test cases, switch on logs and escalation thresholds, appoint a named owner for the system and keep sample-based review in place for a period before removing it;
5. review the map at regular intervals, bearing in mind that a process can also move down a level, when volumes fall or errors turn out to be more expensive than expected.

In our work this map feeds into the AI Assessment, while the AI Rating measures whether the organisation has the conditions to sustain the levels it has set itself: without monitoring capability, which the model assesses in the Delivery dimension, and without risk controls, assessed in the Risk dimension, level 3 remains a stated intention.

A vocabulary for delegation

J3016 did not put self-driving cars on the road, and level 5 has largely remained a promise. It did something more useful in the short term: it gave engineers and regulators a shared vocabulary to say precisely who is driving and under what conditions.

Companies need the same vocabulary, applied to their own processes: a map that gives every relevant activity a delegation level, an owner and the criteria for changing it. With a map like that, the board discusses choices and accepted risks, and the regulator finds written down what would otherwise have to be reconstructed after the fact. The advantage will go to the companies that have decided carefully where to stop, and put it in writing.

Where to start

The gap between projects launched and structured governance is measured in 71% started, 9% arrived, while the method for building the economics of a single use case is in the value case for an AI project.

When a process moves up to the AI-native level, the rule on what to leave to the model and what to the rules is in probabilistic and deterministic, and the way AI connects to company data is in why you need an AI Company OS.

To map the delegation levels of your processes you can book an assessment session.