The AI Governance Maturity Model
Published . Updated .
AI means artificial intelligence. An AI governance maturity model describes how far a company has moved from informal AI use to governance that is enforced and measured. It helps a leadership team see where it stands today and which single step would make the biggest difference next.
What are the five levels of AI governance maturity?
A planning model. Levels describe evidence a company can show, not intentions.
| Level | What you see | Evidence an auditor would accept | Next step |
|---|---|---|---|
| 1. Ad hoc | AI tools in use, no written rules, nobody can list every system | None | Name an owner and write a short usage policy |
| 2. Written | A policy exists; controls depend on people remembering it | The policy document | Build an inventory and put the first controls into systems |
| 3. Controlled | Every system has an owner; permissions, approval gates and logging are built in | Inventory, access settings, logs | Test the controls and audit for unapproved tools |
| 4. Measured | Regular audits, tests that show controls work, metrics reported to leadership | Audit and test results over time | Make governance part of each launch |
| 5. Continuous | New systems enter the inventory before launch; evidence is produced automatically | Records generated by the systems | Keep reviewing as models and rules change |
Field guide. The Field Guide to AI Governance covers the records an auditor expects, from consequential actions to provenance and audit records. Read the field guide.
Where do most companies stand?
Published data suggests many organisations have not reached level three. IBM's Cost of a Data Breach Report 2025 found that 63% of breached organisations either had no AI governance policy or were still developing one. Of those with a policy, only 34% performed regular audits for unsanctioned AI, a level four practice. One in five organisations reported a breach due to shadow AI, and only 37% had policies to manage AI or detect shadow AI. IBM, July 2025 The IBM figures describe breached organisations, not all companies.
Employee surveys point the same way. In a 2025 study of more than 48,000 people in 47 countries, led by the University of Melbourne with KPMG, only 47% of employees said they had received AI training and 40% said their workplace had a policy or guidance on generative AI use. KPMG, April 2025
How do you score your company in ten minutes?
Answer yes or no. Each pair of questions belongs to one level; stop at the first pair where either answer is no.
- Is one person accountable for AI across the company? (level 1)
- Do staff know which AI tools they may use? (level 1)
- Is there a written AI usage policy that people can find? (level 2)
- Does the policy say which data may never go into public AI tools? (level 2)
- Can the company list every AI system in use, with an owner for each? (level 3)
- Are permissions and approval steps enforced by the systems, not by memory? (level 3)
- Are unapproved AI tools audited on a schedule? (level 4)
- Has anyone tested that a blocked action is actually blocked? (level 4)
- Does every new AI system enter the inventory before launch? (level 5)
- Are audit records produced automatically by the systems? (level 5)
Scored level two or lower? Talk to Chiri or see how Chiri Brain handles it.
What does it take to move up one level?
The step from level two to level three takes the most work, because it moves rules out of documents and into systems. It starts with an inventory: every AI tool, model, agent and automation, including tools staff signed up for themselves. What Is Shadow AI? explains how to find them. Then each system gets permissions, approval steps for high-impact actions and logging. What Real AI Agent Governance Looks Like in Practice describes those controls for agents.
Published frameworks help structure the work. The AI Risk Management Framework from NIST, the US National Institute of Standards and Technology, sorts it into four functions: Govern, Map, Measure and Manage. ISO/IEC 42001:2023, from the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), sets requirements for an AI management system:
"ISO/IEC 42001 is the world's first AI management system standard, providing valuable guidance for this rapidly changing field of technology."
Levels four and five then depend on checking that the controls work over time: audits for unapproved tools, tests of each gate, and a launch review. The AI launch approval checklist for company leaders covers the launch decision.
Which level does a company of 50 to 500 people need?
Level three, for any system that acts on customer data, moves money or changes access. Below that, a mistake by an AI system cannot be traced or stopped reliably. Level four becomes necessary when customers, auditors or regulators ask for evidence that controls work. Level five suits companies that launch AI systems often.
The level also depends on the task. AI Readiness Assessment explains why a company-wide score should be combined with the requirements of each specific task.
How Chiri approaches this. Chiri builds, operates, and improves company-specific software as an AI managed service provider. Small teams of senior operators and engineers work with the customer. Login and roles, audit logging, data controls and checks that stop bad actions before they execute are part of the platform, so every application inherits them. See AI harness and governance
Ready to move from written rules to controls that run? Talk to Chiri.
Questions and answers
What is an AI governance maturity model?
A way to describe how far a company has moved from informal AI use to governance that is enforced by systems and checked over time, usually in five levels.
What level of AI governance do most companies have?
Many have not reached level three. In IBM's 2025 study, 63% of breached organisations had no AI governance policy or were still developing one.
How do you assess AI governance maturity?
Answer a short set of yes or no questions per level, such as whether every AI system has an owner and whether controls are enforced by the systems, and stop at the first level that fails.
What is the hardest step?
Moving from level two to level three: building a full inventory and putting permissions, approval steps and logging into the systems themselves.
Is a maturity model the same as NIST AI RMF or ISO/IEC 42001?
No. NIST AI RMF and ISO/IEC 42001 are frameworks and standards. A maturity model measures progress against them.