The Maturity Stack is the five-band progression ladder for legal AI capability. It addresses the recurring question every General Counsel asks at some point in an AI investment cycle: where do we actually stand. The Stack converts that question from a subjective conversation into a measurable institutional posture. It does so by defining each band against observable artefacts rather than aspiration, and by producing a composite score across four lenses that exposes where a function is balanced and where it is not.
The Stack was constructed against a practical observation. Legal AI programmes fail to progress not because they lack tools, but because they lack an accurate picture of where they stand. They benchmark against vendor narratives or against the most enthusiastic story their loudest stakeholder tells. The Stack replaces those benchmarks with a calibrated frame the function can hold itself to and that an external attester can verify.
The five bands
Band 1 Foundational. AI tools are deployed ad hoc; no governance; no formal programme; individual practitioners experiment without institutional oversight. The function may have an AI policy, but it is observed in the breach. Functions at Band 1 are exposed to every class of the Risk Taxonomy 2026 without a corresponding mitigation.
Band 2 Operational. A defined programme exists; use cases are approved at intake; basic policy is in place; no systematic measurement. The function has institutional intent but does not yet operate to a discipline. Pillar 1 is established; Pillars 2, 3, 4, 5, 6, 7, and 8 are nascent.
Band 3 Integrated. AI is embedded in defined workflows; measurement is in place; governance produces evidence. The function operates a current AI Inventory; the Evidence Register is in active maintenance; ROAI 4-Quadrant scoring is in place for the portfolio. Pillars 4 and 5 are operating; Pillars 2, 6, 7, 8 are progressing in step.
Band 4 Optimised. Measurement informs operating decisions; governance is mature; autonomy is bounded and documented. The function progresses use cases up the Agentic Tier ladder deliberately, with named gates. The Maturity Stack score is current and the remediation path to Band 5 is in active operation. All eight pillars are present at operating cadence.
Band 5 Defensible. The function can produce evidence on demand within twenty-four hours of any external request; governance is attested; the operating posture is institutionally credible to regulators, insurers, acquirers, and adversarial counsel. Band 5 is binary at the test point: the function either passes the twenty-four-hour Defensibility Posture Statement test or does not. Band 5 requires Executive Diagnostic attestation; self-assessment cannot reach Band 5.
The four lenses
Each band is scored against four lenses. Adoption measures depth and breadth of AI use across the function. Sophistication measures the operating maturity of the deployed use cases. Defensibility measures the Pillar 4 evidence posture. Autonomy measures progression on the Agentic Tier ladder under bounded governance. The four lenses produce a composite; the decomposition is what makes the composite actionable. A function can be high on adoption (Lens 1) and low on defensibility (Lens 3) — the composite band reflects the lower of the two because Defensibility binds the band ceiling.
How the Stack is used
Two instruments operate against the Stack. The Free Baseline Diagnostic is a self-assessment instrument that places the function on Bands 1 through 4 across the four lenses. It produces a calibrated composite, a per-lens decomposition, a per-pillar sub-score, and a prioritised remediation path. The Executive Diagnostic is the attestation instrument that certifies Band 5 Defensible. The architecture of separation — self-assessment up to Band 4 and attestation required for Band 5 — is the structural mechanism that makes the standard meaningful. A self-assessed claim of Defensibility defeats the standard's institutional purpose.
The Annual Legal AI OS Index aggregates anonymised maturity data across the institutional population that completes the diagnostic. Functions benchmark against the Index annually. Year-over-year tracking against the Index is the substitute for vendor-narrative comparison and the basis on which the function can demonstrate institutional progression to the board, the audit committee, and external stakeholders.
Where the Stack sits in the framework
The Maturity Stack is anchored at Pillar 7. It is the measurement and progression instrument that aggregates the output of every other pillar. The Agentic Tier ladder (Pillar 5) is the operating ladder on which the Stack's Autonomy lens reads. The Five Defensibility Elements (Pillar 4) are the operating discipline the Stack's Defensibility lens reads. The AI Lifecycle (Pillar 8) is the discipline that determines whether maturity claimed in a prior cycle persists. The four cross-cutting frameworks — Defensibility, ROAI, Risk Taxonomy 2026, and the Agentic Tier — together with the Maturity Stack form the Legal AI OS reference architecture.