AI Governance Maturity Model
Score each of 14 control domains against five maturity levels. The resulting profile shows where your program works and where it needs attention.
Why one overall score doesn't work
Strong documentation can coexist with weak monitoring. An average score can hide that difference. Assess each control domain separately to produce 14 scores. Start reviewing the domains with the lowest scores.
Initial
Controls are ad hoc or don't exist. Activity happens reactively, usually after an incident, with no documented process.
What counts as evidence: No inventory, no assigned owners, no written policy for the domain.
Developing
A policy exists, but people follow it inconsistently. Enforcement depends on individual effort.
What counts as evidence: A policy or checklist exists. Reviewers cannot verify whether staff followed it for a particular system.
Defined
A documented, repeatable process exists and is generally followed, with clear ownership. Enforcement still relies partly on manual steps.
What counts as evidence: There is a named owner, a documented workflow, and records of completed reviews. Gaps can remain undetected between reviews.
Managed
Teams measure the control and enforce it systematically. Monitoring detects failures or bypasses before they cause harm.
What counts as evidence: Automated enforcement or alerting, a defined escalation path, and metrics tracked over time. The control cannot be silently skipped.
Optimizing
Teams revise the control using incidents, near-misses, regulatory changes, and changes in AI capability.
What counts as evidence: A feedback loop from incidents and audits back into the control design, with a documented revision history.
Check whether controls work
A policy document alone does not establish Defined or Managed maturity. Check whether staff and systems follow it. A human-review checkpoint that a bug could bypass illustrates the problem: the documented requirement did not prevent the bypass. Under this model, that domain was Developing. Score the control using enforcement evidence. Our guide to auditing an AI governance program explains how to check it.
Score every domain
Get your maturity profile
Use the self-assessment to compare your control domains and identify gaps that need work.
Start the self-assessment