AI Governance Maturity Model and Checklist

An AI governance maturity model describes the stages an organization passes through as it moves from unmanaged AI use to a program that is defined, operated, measured and audited. The model below has five levels. Level 1 is ad hoc: people use AI tools and nobody tracks it. Level 5 is measured: every AI system is inventoried, tiered, assessed, controlled, monitored and audited against a published framework. Most organizations we meet sit at level 1 or 2 and can reach level 3 in about six weeks. Use the checklist to place yourself, then the section after it to plan the next step.

The five levels

Level	Name	What it looks like
1	Ad hoc	Staff use AI tools on their own initiative. No policy, no inventory, no owner. Leadership may not know what is in use.
2	Aware	Leadership has raised the question. A draft policy or an email with rules exists. Someone has a partial list of tools. Decisions are made case by case.
3	Defined	A named owner, an approved acceptable-use policy, a complete inventory with risk tiers, assessments for high-tier systems, vendor checks, and a review forum with a calendar.
4	Managed	Controls are assigned and operating by tier. Intake, change and incident processes run. Monitoring produces data that is reviewed. Evidence is kept as a matter of course.
5	Measured	The program is mapped to NIST AI RMF or ISO/IEC 42001, measured against defined objectives, internally audited, and reported to leadership. Independent audit or certification is in place or available on request.

Level 1: ad hoc

AI is being used, productively and invisibly. The risks are the familiar ones: confidential data in public tools, outputs used without review, and AI features in purchased software switched on by default. There is nothing wrong with being here as a starting point; staying here is the problem.

Level 2: aware

Someone has been asked to look into it, usually after a customer questionnaire, an insurance form or a near miss. There may be a draft policy that was never approved, or a ban that nobody follows. The inventory is a memory rather than a document. This is the most common level, and the most unstable, because the effort can stall for a year.

Level 3: defined

The program exists on paper and in practice: owner, policy, inventory, tiers, assessments for the systems that matter, vendor reviews and a review rhythm. This is the level that answers most customer and auditor questions and the one our six-week starter program targets. Our guide to building an AI governance framework describes the artifacts.

Level 4: managed

The difference from level 3 is operation. Controls are not just assigned but running: human review steps happen, vendor features are configured, change control triggers re-assessment, incidents are handled and recorded, monitoring data is reviewed on schedule. Evidence accumulates without a special effort.

Level 5: measured

The program is managed against objectives and checked by someone independent of the people who run it. Metrics exist for coverage (share of AI systems inventoried and assessed), timeliness (reviews on schedule) and outcomes (incidents, complaints, test results). Mapping to NIST AI RMF or ISO 42001 is explicit, and the organization can face an external audit or certification without a scramble.

Self-assessment checklist

This AI governance checklist has 25 statements in five domains. Answer each one yes or no based on what is true today, not what is planned; a “partly” is a no. Count the yes answers at the end.

Policy and accountability

1. One named person is accountable for AI governance across the organization.
2. An AI acceptable-use policy has been approved by leadership and published to all staff.
3. Staff have acknowledged the policy and received training on it.
4. Every AI system in use has a named business owner.
5. A forum (a standing agenda item or a committee) meets on a schedule to make AI decisions.

Inventory and intake

6. A written inventory lists every AI system in use, including AI features inside purchased software.
7. Each inventory entry records the data the system touches and the people it affects.
8. Each inventory entry has a risk tier assigned by a defined method.
9. Staff can request a new AI tool or use case through a defined process with a known turnaround.
10. The inventory is reconciled against subscriptions, spend and vendor release notes at least quarterly.

Risk and impact assessment

11. A risk assessment template exists and has been completed for every high-tier system.
12. An impact assessment has been completed for every system that influences decisions about people.
13. Assessments are repeated when a system, its data or its vendor changes materially.
14. Systems you build are tested for accuracy, bias where people are affected, and security before release.
15. Assessment results are reviewed by someone other than the system owner.

Controls and vendors

16. Controls are defined by tier in a written matrix and each control has an owner.
17. Technical controls prevent prohibited data from reaching unapproved tools.
18. AI vendors and AI features in existing vendors have passed a due diligence review covering data use, retention and security.
19. Where regulated data is involved, the required agreements (for example, a business associate agreement) are in place with AI vendors.
20. Human review and override steps are designed into every high-tier workflow and staff know when they apply.

Monitoring, evidence and review

21. Defined metrics are collected for high-tier systems and reviewed on a schedule.
22. Harmful or wrong AI outputs are reported and handled through the incident process, with records.
23. Decisions, assessments, reviews and training are recorded in a form you could hand to an auditor this week.
24. The program is explicitly mapped to NIST AI RMF, ISO/IEC 42001 or both.
25. The program has been reviewed by someone independent of the people who run it, internally or externally, in the past year.

Scoring

Yes answers	Indicative level	Condition
0 to 5	Level 1, ad hoc	No conditions; you are starting
6 to 10	Level 2, aware	Usually a draft policy and a partial inventory
11 to 16	Level 3, defined	Only if items 1, 2, 6 and 8 are all yes
17 to 21	Level 4, managed	Only if items 11, 16, 18 and 22 are all yes
22 to 25	Level 5, measured	Only if items 23, 24 and 25 are all yes

The conditions matter more than the count. An organization with 14 yes answers but no approved policy is at level 2, whatever the score says. Treat the result as an AI governance assessment of where you stand, not a grade, and not as a statement of legal compliance; where a law applies to your AI use, check the current official text. This is general information, not legal advice.

Moving up one level

Nobody moves from level 1 to level 5 in one step, and trying to usually produces a shelf of documents and no change. The AI governance roadmap below gives the three actions that move an organization up exactly one level. Do them, re-run the checklist, then take the next three.

From level 1 to level 2

• Name an owner and give them two things: authority to approve or stop AI use, and a deadline for a first inventory.
• Send a one-page interim rule set: no regulated or confidential data in any tool outside a short approved list, and human review of any AI output before it reaches a client or a decision.
• Ask every team lead to list the AI tools and AI features their team uses. Expect the list to be incomplete; it is still the first inventory.

From level 2 to level 3

• Approve and publish the acceptable-use policy with an approved-tools list, and record acknowledgments.
• Complete the inventory by reconciling against subscriptions, spend and vendor release notes; assign a risk tier to every entry.
• Run a risk assessment for each high-tier system and an impact assessment where decisions about people are involved; send due diligence questions to the vendors that matter; put the review forum on the calendar.

From level 3 to level 4

• Turn the control matrix into operating controls: configure vendor features, switch on data-loss prevention for AI prompts, build the human review step into each high-tier workflow and train the people who perform it.
• Add intake, change and incident handling for AI to the processes you already run, rather than creating parallel ones.
• Define the metrics for each high-tier system, start collecting them, and review them at the forum.

From level 4 to level 5

• Map every part of the program to NIST AI RMF or ISO/IEC 42001 and write current and target profiles; the gap is the next year’s plan.
• Set measurable objectives for coverage, timeliness and outcomes, and report them to leadership on a schedule.
• Commission an internal audit by someone independent of the program, or an external readiness review, and act on the findings before considering certification.

Tooling follows maturity rather than leading it. A spreadsheet is enough through level 3 for most organizations; our guide to AI governance tools and platforms explains when a platform starts to earn its place. If the vocabulary in this model is new, start with our overview of what AI governance is.

Where PS3G fits

PS3G runs this assessment as the first step of its AI governance consulting service, for organizations of every size. The six-week starter program is designed to take an organization from level 1 or 2 to level 3, and our managed-services option operates the program toward levels 4 and 5, including NIST AI RMF and ISO/IEC 42001 mapping and readiness for external audit. We apply the same model to the AI features in our own HIPAA-compliant EHR and telehealth platform, DocVilla, so the checklist reflects what it takes to run a program, not only to describe one.

Related reading

• AI Governance Framework: How to Build One (Structure + Examples)
• What Is AI Governance? A Practical Guide for Any Size of Organization
• AI Governance Tools and Platforms: Do You Need One?
• AI governance consulting services

Frequently asked questions

What level of AI governance maturity should we aim for?

Level 3 is the minimum for any organization that uses AI with confidential or personal data, because it is the level that answers customer, auditor and insurer questions. Level 4 is appropriate when you build AI or use it in decisions about people. Level 5 is for organizations facing regulatory expectations, certification requests or significant AI in their products.

How long does it take to move up a level?

Level 1 to 2 takes days: an owner, interim rules and a first list. Level 2 to 3 takes about six weeks for a mid-sized organization and less for a small one. Level 3 to 4 is a matter of operating the controls through at least one review cycle. Level 4 to 5 depends on how quickly you can measure, map and arrange an independent review.

Can a small business reach level 5?

Yes, and with less effort than a large one, because the inventory is short. The level is defined by what is in place and measured, not by headcount or budget. A small AI product company with a dozen systems can be mapped, measured and audited; a large company with hundreds of unlisted tools is still at level 2.

Is this maturity model based on NIST AI RMF or ISO 42001?

It is consistent with both but owned by neither. Levels 3 and 4 correspond to having the Govern, Map, Measure and Manage functions in place and operating; level 5 corresponds to explicit mapping, measurement and independent review, which is what an ISO/IEC 42001 audit would examine. The checklist items are written so the evidence serves either framework.