Everyone in the Room Is Prepared. The Firm Is Not.

Somewhere in the next twelve months, a project manager at one of your public clients is going to ask what your firm's AI policy is.

It will not sound like a big moment. It will come near the end of a scoping call, after the schedule and before the fee, in the same tone as a question about your QA process.

And when you answer, chances are it will be your answer. What you personally do when you use these tools. What you think your best people do. Or maybe a memo somebody circulated in March.

Watch the room when that happens. The question was addressed to the firm. The answer came from an individual. Everyone hears the difference, including you.

Everyone in the room is prepared. The firm is not.

Your client is not improvising the question. State transportation agencies have a published roadmap from their own association, and its last step points them to a federal maturity model to score themselves against. If your public clients are cities or transit agencies, this is where things are heading, not where they are today.

You can download the same model and take the same test. What it tells you is not how advanced your firm is. It is which of your answers is a firm fact and which is one person's habit, which is the gap between individual speed and firm capability.

What is your client actually going to ask about AI?

In January 2026 the American Association of State Highway and Transportation Officials published a whitepaper on AI in state DOT operations. The useful half is the roadmap at the back, not the survey at the front.

AASHTO's roadmap runs five steps. The fourth tells agencies to establish AI specifications, standards, governance and oversight. The fifth tells them to complete a capability maturity self-assessment, and points them at the USDOT Intelligent Transportation Systems Joint Program Office's AI-Enabled ITS Capability Maturity Model, published May 2024 and free to anyone.

The model was written for the agency to score itself. Scoring yourself against it means picking up your client's own instrument, which is the point of the exercise rather than a problem with it.

One caution. The Joint Program Office says an updated model, with an online tool and new dimensions, will be available in fall 2026. We found no release as of October 20, 2026. What follows about the model describes the May 2024 edition.

It has seven dimensions. The report uses two slightly different sets of names for them; the ones below are from its main text.

Dimension	What it measures
Culture, Staffing, and Organization	Who knows what, who sponsors it, how the org is shaped
Collaboration	Peer networks, partnerships, data-sharing agreements
Business Processes	The business case, policy, budget, and procurement
Cybersecurity	Threat awareness through to recoverability
AI Data and Infrastructure	Governance, sources, quality, storage, and the pipelines that feed models
AI Models and Applications	Building, evaluating, and deploying the models
AI Integration and Operations	Requirements, integration, testing, operational feedback

To a firm leader, the shape matters more than any single row. By our reading, two dimensions are about building AI systems. One is mostly about the agency's partners. The other four are institutional.

Those four are the ones a design firm can fail. They ask what your organization holds, not what your tools can do.

AASHTO's roadmap sorts the seven differently: Culture, Collaboration and Business Processes as institutional, Cybersecurity on its own, and the three AI dimensions as technical. Our four leave out Collaboration, which is mostly about partners, and take in Cybersecurity and data, because what a firm does with its own data and systems is a question about the firm.

One of those four reaches you directly. Inside Business Processes sits a sub-dimension called Procurement and Project Management, and its description raises whether the agency has the expertise to write AI requirements into an RFP. That is your client checking its own half of a document firms like yours may answer.

Why can your firm not answer the question today?

Because nothing in the firm was ever asked to hold the answer.

Governance on the owner's side is uneven and AASHTO says so. Its finding is that AI governance across regions is "still fragmented", with "strong engineering compliance in place, but limited standardized oversight and planning mechanisms." About 20 states have developed an AI strategic plan or policy.

That unevenness is the window, not the excuse. Two questions AASHTO put to state DOTs in writing read as a forecast. One asked what level of human oversight is in place for AI applications in technical guidance or design, and whether engineers are stamping plans that involve AI. The other asked whether the state had uploaded any specifications, standards or manuals, internal or external, to AI.

We found no published answers to either question, and that is not the point. Those are the questions the owner is already asking itself in writing, and they forecast what it will ask your firm.

Both are organizational questions. Neither can be answered by naming a tool, or your most accomplished engineer. A seal is an individual act; whether your firm can stand behind a thousand of them is not.

Individual capability is real and it compounds, but it does not aggregate into a firm-level answer. Oversight is the same: knowing what a system did while nobody was watching is a record question before it is a policy question.

What does scoring yourself tell you?

Take the test and the gap you find will almost never be technical.

You will discover the answer exists, and it exists in one person's head, in an email thread, or in a folder whose location is itself tribal knowledge, not in an auditable, reliable system.

When a firm tells us it is AI-forward, that usually means tools are deployed. It rarely means the knowledge in them is connected, which is what a client's question reaches for.

The last two years of internal AI policy debate have not moved this, because the debate was about permission and the question your client is preparing is about evidence.

Permission you can grant in a meeting. Evidence has to have been accumulating.

It is also why the firms furthest ahead are rarely those with the most licenses. They are the ones whose organizational intelligence is reachable, which is a workflow problem before it is a software problem.

The point is not the score. It is a short, specific list of answers your firm cannot produce without interrupting a particular person: the interrupt list. How long is yours? That is the work.

Three things worth doing before the question arrives

Download the USDOT capability maturity model, the one AASHTO's roadmap points agencies at, and check first whether the updated version is out. It is free, and the four rows that matter are an afternoon's work even though the May 2024 report runs sixty-seven pages.

Score the four dimensions we call institutional first, and leave the other three for later. I would not spend time on the two technical ones at all: they are mostly about building and running AI systems, which most design firms do not do. The institutional rows describe what it means to be a firm in your client's eyes.

Then ask your three largest public clients where they are on their own AI governance, before they ask you about yours. If one of them is running this self-assessment, ask for a copy of their scoring. Arriving at that conversation having already taken the test is a different posture from arriving with a memo from March.

The uncomfortable part is that none of this is a technology decision. Most of us have handed this kind of thing to the technology people, and that is not the desk where it gets resolved.

The question behind the question

The policy that governs your next project is being drafted right now, and not by you.

That is not a threat. It is a schedule. Somebody at an agency is working through a five-step roadmap you can read this afternoon.

The real question is not whether your firm has an AI policy. Plenty of firms do, and it is a document.

The question is whether your firm can produce evidence for it, from a record, without calling anyone. If the honest answer is no, you already know what the first project is.

---

Where to go next: pulling down a sixty-seven-page federal model and scoring yourself against it can feel like a lot, and it does not have to. We can start with a thirty-minute conversation about the answers your firm cannot produce today, and if a Source of Truth engagement fits, we will say so.