Industrial AI Adoption Maturity
Five levels, six dimensions and thirty observable criteria to establish where an organisation actually stands with industrial AI. It does not measure how much has been invested: it measures what is sustained by evidence.
Full matrix and assessment rules, published openly.
A Company's Level Is Its Weakest Dimension
Almost every maturity model averages its axes. This one does not. An organisation with impeccable governance, excellent data and no tested human override capability is not an advanced organisation: it is an organisation with a specific and very expensive problem that the average would hide.
Adds the axes and divides. A serious gap is diluted among five strengths.
Consequence: the certificate says 'advanced' while the real risk sits intact on the axis nobody looks at.
Proposed by whoever sells the solution, and usually measures how much you have bought.
Consequence: the level rises with the invoice, not with capability.
Takes the minimum of the six dimensions and verifies it with observable criteria on site.
Adds: a number that cannot be dressed up and that points exactly where to work.
IRIS-CORP 30000:2026 Model
The complete model, in the open. An organisation can self-assess cell by cell before deciding whether an external assessment is worthwhile — and use the result as a work plan even if it never certifies.
Model contents
- Scope and the minimum rule
- References
- Terms and definitions
- Annex A — The five maturity levels
- Annex B — 30-criterion observable matrix
- Annex C — Certified personnel thresholds
- Annex D — Assessment rules
- Assessment process
1 · 2 · 3 — Scope, References and Definitions
1 Scope
This document defines the IRIS-CORP 30000 maturity model: the six dimensions assessed, the five levels, the observable criteria of each cell and the rules by which an organisation's level is determined.
1.1 What is certified
The organisation is certified — or an identified production unit within it — at a maturity level for industrial AI adoption. No software is certified, which is done through IRIS 14001, and no person, which is done through IRIS-PRO.
1.2 Unit of certification
The scope may be the whole company, a plant or a group of plants, but it shall be a unit with real decision-making capacity over its own AI deployment. A department without budgetary or decision autonomy is not admissible as a scope.
1.3 The rule that governs the model
The organisation's level is the minimum of its six dimensions, not their average. A company with five dimensions at M4 and one at M2 is an M2 company. This rule is deliberate: in AI adoption, the weakest dimension is what determines what can happen, not the strongest.
1.4 Exclusions
The model does not assess the organisation's financial performance or the quality of its products. Nor does it evidence compliance with any legal obligation, including those arising from Regulation (EU) 2024/1689.
2 References
The following documents are referred to and are indispensable for the application of this model.
- ISO/IEC 33001 — Process assessment: concepts and terminology.
- ISO/IEC 42001 — Artificial intelligence management systems.
- IRIS 14001 — Industrial AI software conformity standard.
- IRIS-SEC 27001 — Information security in industrial AI.
- IRIS-PRO — Personnel certification scheme.
- IRIS-EDU 21001 — Certification of training providers.
- Regulation (EU) 2024/1689 — Artificial Intelligence Act.
3 Terms and definitions
3.1 maturity
Degree to which an organisation's AI adoption practices are defined, systematically applied and sustained by evidence, regardless of the volume invested.
3.2 dimension
Independent axis of assessment. The model defines six, and none is offset by another.
3.3 observable criterion
Statement verifiable through documentary evidence, interview or direct observation, determining whether a matrix cell is achieved.
3.4 critical function
Organisational function whose decision may be affected by an AI system at autonomy level N2 or N3 under IRIS-SEC 27001.
3.5 production unit
Plant or set of plants with real budgetary and operational decision capacity over its AI deployment.
3.6 effective level
Level resulting from applying rule 1.3: the minimum of the levels achieved across the six dimensions.
Annex A — The Five Maturity Levels
Each level corresponds to a certification programme of the IRIS-CORP family. None can be skipped: the assessment verifies the criteria of every level up to the one declared.
Leadership understands what industrial AI is and is not, and has consciously decided what it wants to do with it.
Shop floor personnel working alongside the systems can operate them, recognise their limits and override them.
Independent technical judgement exists: the company can assess a solution without depending on the vendor selling it.
AI sits in the organisation's ordinary decision process, with governance, evidence and named owners.
Safety, quality and compliance are themselves AI-competent, and the organisation publishes its outcomes.
Annex B (normative) — Observable Criteria Matrix
Six dimensions by five levels: thirty criteria. Each cell is verified through documentary evidence, interview or direct observation. A cell not achieved truncates the dimension at the previous level.
| Dimension | M1 | M2 | M3 | M4 | M5 |
|---|---|---|---|---|---|
| G1 Governance and strategy | A written leadership position on the use of AI exists. | A named owner and an assigned budget exist. | Published criteria exist for deciding what is automated and what is not. | AI decisions go through the management committee with evidence. | The AI strategy is reviewed against published, auditable indicators. |
| G2 People's competence | Leadership has received baseline industrial AI training. | Affected shop floor personnel hold IRIS-PRO Associate certification. | An in-house team with IRIS-PRO Expert certification exists. | Every critical function has its IRIS-PRO role covered. | Safety, quality and compliance hold role certification. |
| G3 Data and systems | It is known which process data exist and where they are. | Critical data have an owner and known quality. | Traceability of automated decisions exists. | Data lineage is reconstructable end to end. | Decision data are retained as auditable evidence. |
| G4 Security and control | The risks of AI on the process are known. | A tested human override procedure exists. | Safe degradation is defined and tested. | An IAISMS conforming to IRIS-SEC 27001 is in place. | Continuity without AI is periodically tested in production. |
| G5 Impact on work | The workforce has been informed of the intended use of AI. | Worker representation takes part in deployments. | A reskilling plan with assigned hours exists. | The change in work content is measured before and after. | The employment outcome is published or supplied to the Observatory. |
| G6 Measured results | What each deployment is expected to deliver is declared. | The real result is measured against the expected one. | Deployments that do not deliver are withdrawn. | Results are consolidated at organisation level. | Results are independently verified. |
Assessment is cumulative: to reach M3 in a dimension, its M1 and M2 criteria shall also be met. No level is skipped.
Annex C (normative) — Certified Personnel Thresholds
Dimension G2 is not declared, it is counted. These are the minimum numbers of personnel holding valid IRIS-PRO certification required at each level.
| Level | IRIS-PRO certification | Who it covers | Threshold |
|---|---|---|---|
| M1 | — | Leadership trained | 20% of the management committee |
| M2 | Associate | Affected shop floor personnel | 60% of affected roles |
| M3 | Professional / Expert | In-house technical team | minimum 2 Expert and 4 Professional |
| M4 | By role | Critical functions | 100% of critical functions with their role covered |
| M5 | By role | Safety, quality and compliance | 100% of those three functions role-certified |
Turnover counts: if certified personnel leave and are not replaced, dimension G2 drops at the next surveillance audit and with it the effective level.
Annex D (normative) — Assessment Rules
The seven rules that make two different assessments give the same result for the same organisation.
| Ref | Rule |
|---|---|
| D.1 | Minimum ruleThe organisation's effective level is the lowest of the six dimensional levels. It is neither averaged nor offset. |
| D.2 | AccumulationReaching a level in a dimension requires meeting all criteria of the lower levels of that dimension. |
| D.3 | Evidence, not declarationA criterion is deemed achieved on verifiable evidence, never on the assessed party's assertion. |
| D.4 | On-site verificationFrom M2 onwards, at least one third of the criteria shall be verified through direct observation or interview at the workplace. |
| D.5 | Reissue on dropIf a dimension falls between audits, the certificate is reissued at the real effective level. It is not withdrawn: it is adjusted. |
| D.6 | Named scopeThe certificate names the assessed unit. A group is not certified because one of its plants is. |
| D.7 | Assessor independenceAnyone who has provided consultancy to the organisation in the previous 24 months may not assess it. |
Assessment Process
Four phases. Self-assessment is mandatory and belongs to the client: it ensures the visit is spent verifying, not discovering.
The organisation positions itself cell by cell in the matrix and gathers the evidence supporting each criterion.
The assessment team reviews the evidence and marks which criteria remain to be verified on site.
Direct observation and workplace interviews. From M2, one third of the criteria are verified this way.
Certificate with the effective level and the per-dimension detail, with annual review and reissue if the level changes.
Model conditions
- The certificate publishes the profile, not just the number. It is issued with the level of each of the six dimensions, so the bottleneck is visible.
- Independence: anyone who has provided consultancy to the organisation in the previous 24 months may not assess it.
- No skipping: M4 cannot be sought without verifying the criteria of M1 to M3.
- Cross-recognition: a valid IRIS-SEC 27001 certificate satisfies the M4 criterion of dimension G4.
- Reusable self-assessment: the matrix is public, and an organisation can use it as a work plan without ever being assessed.
Nature of the Model and Terms of Use
Transparency about what IRIS-CORP 30000 is and is not
What it is
IRIS-CORP 30000 is a maturity model owned by European Initiative Industry 4.0, openly published, whose application is verified through an independent third-party assessment.
What it is not
It is not an ISO, IEC, CEN or UNE standard, is not accredited by ENAC and implies no endorsement by ISO or IEC. It does not evidence compliance with any legal obligation, including those arising from Regulation (EU) 2024/1689.
Nor does it assess the organisation's financial performance or product quality: only the maturity of its AI adoption practices.
Terms of use
The model is published openly for reading, citation and internal use as a self-assessment tool. Use of the mark and of the designation 'IRIS-CORP level Mn' is reserved to units named on a valid certificate.
Want to Know Which Level Your Organisation Is At?
Start with the self-assessment: thirty criteria, honestly marked, give you the effective level and the exact bottleneck to work on.
Frequently Asked Questions about IRIS-CORP 30000
Why is the level the minimum of the dimensions and not the average?
Because in AI adoption the weakest dimension determines what can go wrong, not the strongest. A company with excellent data, impeccable governance and no tested human override capability is not a mature company: it is a company with a specific and very expensive problem. Averaging would hide it. The minimum rule puts it on the front page.
How does it differ from IRIS-PRO?
IRIS-PRO certifies people, one by one, and the certification travels with them. IRIS-CORP certifies the organisation. They are linked: each IRIS-CORP level requires a threshold of IRIS-PRO certified personnel, set out in Annex C. You can have certified staff without holding IRIS-CORP, but not IRIS-CORP without certified staff.
Can a single plant within a group be certified?
Yes, and it is the most common case. The scope shall be a unit with real budgetary and operational decision capacity over its AI deployment. What is not admissible is a department without autonomy. And the certificate names the plant: a group cannot declare itself certified because one of its factories is.
Do we have to buy IRIS 14001 certified software to move up a level?
No. The model assesses the organisation's maturity, not the provenance of its tools. Certified software makes evidence easier in dimensions G3 and G4, but M4 can be reached with in-house or uncertified tools if the organisation demonstrates the observable criteria by its own means.
How long does it take to move up a level?
It depends on which dimension is holding you back. Governance and data (G1, G3) usually move in 6–12 months; competence (G2) is limited by IRIS-PRO certification cycles; and G5 and G6 require measuring before and after, so they have an irreducible minimum of one deployment cycle. Skipping a level is not allowed: the assessment verifies the criteria of every level up to the one declared.
What happens if we drop a level between audits?
The level is reviewed at each annual surveillance. If a dimension falls — for example through turnover of the certified team — the certificate is reissued at the real effective level. It is not withdrawn: it is adjusted. That is the difference between a maturity model and a pass mark.
Is it accredited?
No. IRIS-CORP 30000 is a model owned by European Initiative Industry 4.0, openly published, without ENAC accreditation or endorsement from ISO or IEC. It does not evidence compliance with any legal obligation, including those of Regulation (EU) 2024/1689.