Everyone in the Room Is Prepared. The Firm Is Not.

Somewhere in the next twelve months, a project manager at one of your public clients is going to ask what your firm's AI policy is.

It will not sound like a big moment. It will come near the end of a scoping call, after the schedule and before the fee, in the same tone as a question about your QA process.

And when you answer, chances are it will be your answer. What you personally do when you use these tools. What you think your best people do. Or maybe a memo somebody circulated in March.

Watch the room when that happens. The question was addressed to the firm. The answer came from an individual. Everyone hears the difference, including you.

Everyone in the room is prepared. The firm is not.

Your client is not improvising the question. State transportation agencies work from a published roadmap, and its last step sends them to a federal maturity model they score themselves against. If your public clients are cities or transit agencies, this is where things are heading, not where they are today.

You can download the same model and take the same test. What it tells you is not how advanced your firm is. It is which of your answers is a firm fact and which is one person's habit, which is the gap between individual speed and firm capability.

What is your client actually going to ask about AI?

In January 2026 the American Association of State Highway and Transportation Officials published a whitepaper on AI in state DOT operations. The useful half is the roadmap at the back, not the survey at the front.

AASHTO's roadmap runs five steps. The fourth tells agencies to establish AI specifications, standards, governance and oversight. The fifth tells them to complete a capability maturity self-assessment, and points them at the USDOT Intelligent Transportation Systems Joint Program Office's AI-Enabled ITS Capability Maturity Model, published May 2024 and free to anyone.

The model was written for the agency, not for you. Scoring yourself against it means picking up your client's own instrument, which is the point of the exercise rather than a problem with it.

It has seven dimensions. The report uses two slightly different sets of names for them; the ones below are from its main text.

Dimension	What it measures
Culture, Staffing, and Organization	Who knows what, who sponsors it, how the org is shaped
Collaboration	Peer networks, partnerships, data-sharing agreements
Business Processes	The business case, policy, budget, and procurement
Cybersecurity	Threat awareness through to recoverability
AI Data and Infrastructure	Governance, sources, quality, storage of the data itself
AI Models and Applications	Building, evaluating, and deploying the models
AI Integration and Operations	Requirements, integration, testing, operational feedback

To a firm leader, the shape matters more than any single row. Two dimensions are about building AI systems. One covers the agency's partnerships. The other four are institutional.

Those four are the ones a design firm can fail. They ask what your organization holds, not what your tools can do.

One of them reaches you directly. Inside Business Processes sits a sub-dimension called Procurement and Project Management, and it asks whether the agency can write AI requirements into an RFP. That is your client grading its own half of a document you will answer.

Why can your firm not answer the question today?

Because nothing in the firm was ever asked to hold the answer.

Governance on the owner's side is uneven and AASHTO says so. Its finding is that AI governance across regions is "still fragmented", with "strong engineering compliance in place, but limited standardized oversight and planning mechanisms." About 20 states have an AI strategic plan or policy at all.

That unevenness is the window, not the excuse. Two questions AASHTO put to state DOTs in writing read as a forecast. One asked what level of human oversight is in place for AI applications in technical guidance or design, and whether engineers are stamping plans that involve AI. The other asked whether the state had put its own specifications, standards and manuals into an AI system.

Neither answer was published, and that is not the point. Those are the questions the owner is already asking itself in writing, and they forecast what it will ask your firm.

Both are organizational questions. Neither can be answered by naming a tool, or your most accomplished engineer. A seal is an individual act; whether your firm can stand behind a thousand of them is not.

Individual capability is real and it compounds, but it does not aggregate into a firm-level answer. Oversight is the same: knowing what a system did while nobody was watching is a record question before it is a policy question.

What does scoring yourself tell you?

Take the test and the gap you find will almost never be technical.

You will discover the answer exists, and it exists in one person's head, in an email thread, or in a folder whose location is itself tribal knowledge, not in an auditable, reliable system.

When a firm tells us it is AI-forward, that usually means tools are deployed. It rarely means the knowledge in them is connected, which is what a client's question reaches for.

The last two years of internal AI policy debate have not moved this, because the debate was about permission and the question your client is preparing is about evidence.

Permission you can grant in a meeting. Evidence has to have been accumulating.

It is also why the firms furthest ahead are rarely those with the most licenses. They are the ones whose organizational intelligence is reachable, which is a workflow problem before it is a software problem.

The point is not the score. It is a short, specific list of answers your firm cannot produce without interrupting a particular person: the interrupt list. How long is yours? That is the work.

Three things worth doing before the question arrives

Download the USDOT capability maturity model, the one AASHTO's roadmap points agencies at. It is free, and the four rows that matter are an afternoon's work even though the full report runs sixty-seven pages.

Score the four institutional dimensions first and leave the other three for later. I would not spend time on the two technical ones at all: they describe building AI systems, which most design firms do not do. The institutional rows describe what it means to be a firm in your client's eyes.

Then ask your three largest public clients where they are on their own AI governance, before they ask you about yours. If one of them is running this self-assessment, ask for a copy of their scoring. Arriving at that conversation having already taken the test is a different posture from arriving with a memo from March.

The uncomfortable part is that none of this is a technology decision. Most of us have handed this kind of thing to the technology people, and that is not the desk where it gets resolved.

The question behind the question

The policy that governs your next project is being drafted right now, and not by you.

That is not a threat. It is a schedule. Somebody at an agency is working through a five-step roadmap you can read this afternoon.

The real question is not whether your firm has an AI policy. Plenty of firms do, and it is a document.

The question is whether your firm can produce evidence for it, from a record, without calling anyone. If the honest answer is no, you already know what the first project is.

---

Where to go next: pulling down a sixty-seven-page federal model and scoring yourself against it can feel like a lot, and it does not have to. We can start with a thirty-minute conversation about the answers your firm cannot produce today, and if a Source of Truth engagement fits, we will say so.