0 / 24

Model 18 of 74 · Strategy & Governance

AI Governance Maturity Assessment

Assess how well your organisation governs AI systems for accountability, fairness, transparency, and regulatory compliance.

Pillars & areas

Regulate

Set the rules

  1. 01AI Policy & Regulatory Compliance
  2. 02AI Risk Classification & Impact Assessment

Assure

Ensure trust

  1. 04Transparency & Explainability
  2. 05Fairness, Bias & Ethical Review

Operate

Maintain control

  1. 03Accountability & Oversight Structures
  2. 06AI Lifecycle Governance

Levels

  1. 1UngovernedNo AI-specific governance
  2. 2Policy-LedPolicies and oversight defined
  3. 3AccountableGovernance in the AI lifecycle

01 AI Policy & Regulatory Compliance

Whether the organisation has AI-specific policies that address the regulatory landscape, sector requirements, and mechanisms to keep governance current.

0/4 answered

PR-1Does your organisation have a dedicated AI governance policy that is separate from general IT or data policies?

Think about whether AI-specific risks like automated decision-making, model opacity, and algorithmic bias are addressed in their own policy, or lumped into broader technology governance.

PR-2How well does your organisation understand and prepare for AI-specific regulation that applies to its operations?

Consider whether anyone in the organisation can explain which AI regulations apply — such as the EU AI Act, sector-specific rules, or national AI legislation — and what compliance requires.

PR-3How does your organisation handle AI governance requirements that differ across jurisdictions or sectors?

Think about whether the organisation applies a single standard everywhere, or whether it has a structured approach to managing different requirements in different markets or regulated sectors.

PR-4How frequently are AI governance policies reviewed and updated to reflect changes in technology, risk, and regulation?

Consider whether policies were written once and left on a shelf, or whether there is a defined review cycle that responds to how fast AI and its regulation are moving.

02 AI Risk Classification & Impact Assessment

How the organisation identifies, classifies, and assesses AI systems by risk level to ensure proportionate governance.

0/4 answered

RC-1Does your organisation classify AI systems according to their risk level before deployment?

Think about whether all AI systems are treated the same regardless of their potential impact, or whether high-risk applications like automated hiring or credit scoring receive greater scrutiny.

RC-2Does your organisation conduct formal impact assessments for AI systems before they are deployed?

Consider whether anyone formally evaluates the potential impact of an AI system on affected individuals and groups before it goes live, or whether this is left to the development team's judgement.

RC-3How does your organisation identify and govern AI systems that were not originally classified as high-risk but have evolved to become so?

Think about whether an AI system deployed for a low-risk purpose could quietly drift into high-risk territory through scope expansion, increased autonomy, or new data sources — and whether anyone would notice.

RC-4How does your organisation maintain an inventory of all AI systems in use, including those developed by third parties?

Consider whether anyone could produce a complete list of every AI system the organisation uses, who owns it, what data it processes, and what decisions it influences — including vendor-provided AI embedded in purchased software.

03 Accountability & Oversight Structures

Whether clear ownership exists for AI systems and their outcomes, with defined governance bodies, escalation paths, and human oversight requirements.

0/4 answered

AO-1Is there a named individual or body accountable for the governance of AI across the organisation?

Think about whether someone could answer the question 'Who is responsible for ensuring our AI systems are governed properly?' — and whether that person or body has actual authority.

AO-2Does every deployed AI system have a named owner who is accountable for its outcomes?

Consider whether someone would step forward if an AI system produced a harmful outcome — or whether ownership is ambiguous between the team that built it, the team that uses it, and the vendor that provided it.

AO-3How does your organisation determine where human oversight is required in AI-driven decision processes?

Think about whether any AI system in your organisation can make a consequential decision about a person — hiring, pricing, claims, access — without a human reviewing or approving that decision.

AO-4How does your organisation escalate and respond when an AI system produces an unexpected or harmful outcome?

Consider whether there is a defined process for what happens when an AI system makes a decision that is clearly wrong, discriminatory, or harmful — and how quickly the organisation can act.

04 Transparency & Explainability

How well the organisation documents AI systems, explains AI-driven decisions to affected parties, and maintains auditability.

0/4 answered

TE-1How well does your organisation document its AI systems so that a non-technical person could understand what they do and how they work?

Think about whether someone from legal, compliance, or the board could pick up documentation for any AI system and understand its purpose, data inputs, decision logic, and limitations — without needing a data scientist to translate.

TE-2Can individuals affected by an AI-driven decision get a meaningful explanation of how that decision was reached?

Consider whether a customer denied a loan, an employee flagged by a performance algorithm, or an applicant rejected by an AI screening tool could request and receive an explanation they can understand.

TE-3How does your organisation disclose to customers, employees, or the public when AI is being used in decision-making that affects them?

Think about whether people interacting with your organisation know when they are subject to an AI-driven decision — or whether AI operates invisibly behind the scenes.

TE-4How auditable are your AI systems — could an internal auditor or regulator trace how a specific AI decision was made?

Consider whether the organisation could reconstruct, months after the fact, exactly how a particular AI system reached a specific decision for a specific individual — including the model version, data inputs, and logic applied.

05 Fairness, Bias & Ethical Review

Whether the organisation systematically tests for bias, defines fairness metrics, conducts ethical reviews, and monitors impact on protected groups.

0/4 answered

FB-1Does your organisation test AI systems for bias before they are deployed into production?

Think about whether anyone systematically checks whether an AI model treats different demographic groups differently — or whether the model goes live based purely on accuracy metrics.

FB-2How does your organisation monitor deployed AI systems for emerging bias over time?

Consider that a model which was fair at deployment can become biased as the population changes, data drifts, or the world shifts — does anyone check for this after launch?

FB-3Does your organisation have a formal ethical review process for new AI use cases before development begins?

Think about whether someone asks 'Should we build this?' before the team starts asking 'Can we build this?' — and whether ethical concerns can actually stop or reshape a project.

FB-4How does your organisation monitor the real-world impact of AI systems on protected and vulnerable groups?

Consider whether the organisation tracks what actually happens to people after AI decisions are made — not just whether the model's statistical fairness metrics look acceptable in a test environment.

06 AI Lifecycle Governance

How the organisation governs AI systems across their full lifecycle — from approval through deployment, monitoring, updates, and retirement.

0/4 answered

LG-1Does your organisation have defined approval gates that an AI system must pass before it can be deployed to production?

Think about whether an AI model can go from development to production based solely on the development team's decision, or whether there are mandatory checkpoints involving governance, risk, or compliance review.

LG-2How does your organisation manage version control and change management for deployed AI models?

Consider whether you could determine which version of an AI model was running on a specific date, what changed between versions, and who approved each update.

LG-3How does your organisation monitor the performance and behaviour of AI systems after they are deployed?

Think about whether deployed AI models are actively watched for degradation, drift, or unexpected behaviour — or whether they run unmonitored until someone notices a problem.

LG-4Does your organisation have a defined process for retiring AI systems that are no longer fit for purpose?

Consider whether old or underperforming AI models are formally decommissioned, or whether they continue running indefinitely because no one owns the decision to switch them off.

Self-assessment report

AI Governance

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the AI Governance maturity model

AI governance is not about slowing innovation — it is about ensuring that AI systems are accountable, transparent, fair, and compliant. As AI moves from isolated experiments to production systems making decisions that affect real people — hiring, lending, pricing, healthcare, compliance — organisations need governance structures that match the risk. Without governance, AI becomes an organisational liability: opaque systems making consequential decisions with no clear owner, no audit trail, and no mechanism for correction when things go wrong.

The organisations that get AI governance right will move faster, not slower, because they have the trust and frameworks to deploy AI confidently. When stakeholders, regulators, and the public can see that an organisation governs its AI systems responsibly — with clear policies, risk classification, accountability structures, and bias monitoring — it creates a licence to innovate. Governance is not a brake on AI adoption; it is the foundation that makes scaling AI sustainable and defensible.

This model assesses how well an organisation governs its AI systems once they are deployed and operating at scale. It is distinct from AI readiness (which focuses on adoption capability) and AI security (which focuses on protecting AI systems from attack). AI governance sits at the intersection of strategy, risk, compliance, and ethics — asking whether the organisation has the structures, processes, and culture to ensure its AI systems behave as intended, comply with regulation, and remain fair and explainable over time.

24 questions across 6 key areas, assessing how well an organisation governs AI systems throughout their lifecycle — from policy and risk classification through to transparency, fairness, and ongoing monitoring. Takes approximately 10-15 minutes to complete.

Designed for organisations that have moved beyond AI experimentation and are deploying AI systems that influence decisions affecting customers, employees, or the public. The assessment helps identify gaps in governance before regulators, stakeholders, or the public find them first.

Who this assessment is for

  • Board members and non-executive directors responsible for AI oversight
  • Chief Information Officers, Chief Technology Officers, and Chief AI Officers
  • Risk, compliance, and legal teams navigating AI regulation
  • AI programme leads and heads of data science accountable for deployed models
  • Ethics officers and responsible AI leads embedding fairness and transparency
  • Internal audit teams assessing AI governance controls

The three maturity levels

  • Level 1 — Ungoverned: AI systems are deployed without formal governance structures. There are no AI-specific policies, no risk classification of AI use cases, and no clear accountability for AI outcomes. Individual teams make their own decisions about how AI is built, tested, and deployed. When an AI system produces a problematic outcome — biased decisions, unexplainable results, regulatory exposure — the organisation has no established process to detect, escalate, or remediate the issue. AI governance is an afterthought, if it is thought about at all.
  • Level 2 — Policy-Led: The organisation has established AI-specific policies, a risk classification framework for AI systems, and designated accountability structures. High-risk AI use cases are identified and subject to impact assessments before deployment. Governance boards or committees review AI initiatives at key decision points. Documentation standards exist for models, and there are defined processes for transparency and bias testing — though these may not yet be applied consistently across all AI systems. The organisation is aware of its regulatory obligations and is actively working to meet them.
  • Level 3 — Accountable: AI governance is integrated into the full AI lifecycle — from ideation through deployment, monitoring, and retirement. Risk classification, impact assessment, fairness testing, and explainability are standard practice for every AI system, not just high-risk ones. Accountability is clear and enforced, with named owners for every deployed model. The organisation continuously monitors deployed AI for drift, bias, and compliance, and has established processes for model update, escalation, and retirement. Governance enables rather than constrains innovation, and the organisation is confident in its ability to meet current and emerging regulatory requirements.

The 6 areas assessed

  1. AI Policy & Regulatory Compliance — Whether the organisation has AI-specific policies that address the regulatory landscape, including sector-specific requirements, cross-border obligations, and mechanisms to keep policies current as regulation evolves.
  1. AI Risk Classification & Impact Assessment — How the organisation identifies, classifies, and assesses AI systems by risk level — ensuring that high-risk applications receive proportionate scrutiny through formal impact assessments before and after deployment.
  1. Accountability & Oversight Structures — Whether clear ownership exists for AI systems and their outcomes, including governance boards, escalation paths, human-in-the-loop requirements, and defined authority for approving, pausing, or retiring AI systems.
  1. Transparency & Explainability — How well the organisation documents AI systems, explains AI-driven decisions to affected parties, meets disclosure obligations, and maintains model documentation standards that support auditability.
  1. Fairness, Bias & Ethical Review — Whether the organisation systematically tests for bias before and after deployment, defines and monitors fairness metrics, conducts ethical reviews of AI use cases, and tracks impact on protected and vulnerable groups.
  1. AI Lifecycle Governance — How the organisation governs AI systems across their full lifecycle — including approval gates, version control, performance monitoring, change management for model updates, and formal retirement processes.

How this model relates to other frameworks

  • EU Artificial Intelligence Act — risk-based regulatory framework for AI systems in the European Union
  • NIST AI Risk Management Framework (AI RMF 1.0) — voluntary framework for managing AI risks
  • OECD AI Principles — international principles for trustworthy AI adopted by OECD members and partner countries
  • Singapore Model AI Governance Framework — practical guidance for deploying AI responsibly
  • ISO/IEC 42001 AI Management System — international standard for AI governance
  • UNESCO Recommendation on the Ethics of AI — global normative instrument for AI ethics

Frequently asked questions

What is the AI Governance maturity model?

Assess how well your organisation governs AI systems for accountability, fairness, transparency, and regulatory compliance. It is an original, simplified model with three maturity levels (Ungoverned, Policy-Led and Accountable), assessed through 24 questions across 6 areas: AI Policy & Regulatory Compliance, AI Risk Classification & Impact Assessment, Accountability & Oversight Structures, Transparency & Explainability, Fairness, Bias & Ethical Review and AI Lifecycle Governance.

How long does the AI Governance assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Ungoverned), 2 (Policy-Led) or 3 (Accountable). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.