An AI governance maturity model measures how well an organisation’s practices for using AI responsibly are defined, applied and evidenced. This self-assessment uses eight dimensions aligned with the NIST AI RMF functions (govern, map, measure, manage) and with the requirements of ISO/IEC 42001, and returns an index, a level from 1 to 5, the priority gaps and practical recommendations.
How to use
- Optionally, enter the size and sector of the organisation.
- Score each dimension from 1 to 5, using the level descriptions in each field.
- Read the index, the level and the three gaps with their recommendations.
- Use the suggested certification to plan team development and export the result as PNG, PDF or DOCX.
What each field asks for
| Field | What to enter |
|---|---|
| Organisation size (optional) | Choose the size |
| Sector (optional) | Choose the sector |
| Govern: policy, roles and leadership | 1: nobody is accountable for AI. 3: approved policy and defined roles. 5: active committee, objectives and management review. |
| Map: inventory and context of use | 1: nobody knows which AI systems exist. 3: inventory with an owner per system. 5: every new use case is triaged before going live. |
| Measure: risk assessment and testing | 1: no testing before use. 3: risk and impact assessment for sensitive systems. 5: bias, robustness and accuracy metrics tracked. |
| Manage: controls, oversight and incidents | 1: no controls defined. 3: human oversight and an incident plan for critical systems. 5: continuous monitoring and lessons learned applied. |
| Data and privacy | 1: personal data goes into AI without review. 3: lawful basis checked and DPIA when needed. 5: privacy by design in every AI project. |
| Vendors and third parties | 1: AI tools bought without assessment. 3: questionnaire and clauses in new contracts. 5: periodic reassessment and audit rights. |
| People and AI literacy | 1: no guidance for staff. 3: basic training for people who use AI. 5: role-based paths and records of training. |
| Documentation and assurance | 1: nothing documented. 3: minimum records per system. 5: internal audit and management review, as ISO/IEC 42001 requires. |
Example
A fictional mid-sized lender scored 3 for Govern, Manage and People, 4 for Data and privacy and 2 for Map, Measure, Vendors and Assurance. The index came to 41 out of 100, level 3 (Defined). The gaps to tackle first are Map, Measure and Vendors, with recommendations such as building the AI inventory and assessing vendors with a standard questionnaire. The suggested certification for the team is RAIP Responsible AI Practitioner.
When to use
- At the start of an AI governance programme, to set a baseline.
- Before presenting the topic to the leadership team or the board.
- Once a year, to compare progress with the previous assessment.
- When preparing to implement an AI management system under ISO/IEC 42001.
Frequently asked questions
What is AI governance maturity?
It is the degree to which practices for using AI responsibly are defined, applied consistently and backed by evidence. An organisation at the initial level relies on isolated initiatives; at the optimising level, it measures results and improves continuously.
Why do the dimensions follow the NIST AI RMF and ISO/IEC 42001?
They are the most widely used references for organising AI governance. The NIST AI RMF splits the work into govern, map, measure and manage; ISO/IEC 42001 adds the management system, with documentation, internal audit and management review.
How is the index calculated?
The tool averages the scores of the dimensions answered and converts the average to a scale from 0 to 100. The level runs from 1 (Initial) to 5 (Optimising), and the gaps are the three dimensions with the lowest scores.
Does the result count as an audit or a certification of the organisation?
No. It is an educational self-assessment that reflects the view of whoever answered, not an audit, a certification of the organisation or legal advice. To confirm the level, gather evidence and run an internal audit.
Which DPCert certification covers this topic?
Building the AI governance programme is covered by RAIL Responsible AI Leader. The tool also suggests another certification based on the gaps, such as RAIF Responsible AI Foundation, the entry level, to give the team a common baseline.
Who should answer the self-assessment?
Ideally a small group covering governance, technology, legal or privacy and a business area that uses AI. Answers from a single person tend to reflect only their own area.