The Maturity Model describes four levels of AI governance capability, from an organisation that has simply taken a position through to one where consequence thinking happens before a tool is adopted. Maturity self-assessment forms part of every annual Assurance Review.
The four Maturity Levels
Aware
The organisation knows AI is in use and has taken a position
There is a written policy, a named Governance Lead and a register that exists. Coverage may be partial and profiling may not have started. The organisation can say what its position is, which is more than most.
Established
The system runs day to day
Every Activity is registered, profiled and carries a recorded Safeguard selection. People have been trained at the level their role requires. Governance happens as part of normal work rather than as an exercise.
Embedded
The organisation checks itself and can prove it
Assurance Reviews happen at the frequency the ratings require and cover all six mandatory scope areas. Incidents are categorised, investigated and produce lessons. The Governance Evidence Pack is complete and current.
Leading
Governance shapes decisions before they are made
Consequence thinking happens before a tool is adopted rather than after. Providers are assessed as part of procurement. Improvement actions come from the organisation noticing things rather than from something going wrong.
Assessing where you are
Use current operating evidence for the Maturity Self-Assessment. The six mandatory Assurance Review areas show whether the organisation’s governance practices are complete, current and effective.
| Assurance Review area | What a weak finding may indicate |
|---|---|
| Completeness of Activity Register | AI Activities are missing, so governance decisions may rely on an incomplete picture |
| Currency of Consequence Profiles | Profiles may no longer reflect how the AI Activities operate |
| Safeguard effectiveness | Safeguards may be recorded without operating as intended |
| Incident review | Concerns may not be reported or lessons may not be used |
| Competence and training | People may lack the competence their role requires |
| Regulatory and legal landscape changes | Governance decisions may not reflect current obligations |
Maturity is not purchased
Buying an AIGMS™ package provides implementation material. It does not award a Maturity Level and it does not replace the Maturity Self-Assessment.
An organisation determines its Maturity Level from current operating evidence. The level reflects what it has implemented, how consistently it operates and what it can demonstrate.
Continue reading
Material changes since the previous version See how AIGMS™ is structured
Put this into practice
The AIGMS™ packages provide the documents, registers, workbooks and training needed to implement the governance management system.