AI Governance Maturity Model: A 5-Level Framework for Assessing and Improving AI Governance

Most organizations now use AI in some form, and many build it into the products they sell. The governance of that use has developed far more slowly. Enterprise buyers have begun to ask detailed questions about it in security reviews, regulators in the European Union and several US states have set obligations for it, and breach data now attributes measurable cost to its absence.

An AI governance maturity model provides a structured way to answer a practical question: how developed is our oversight of AI today, and what should be done next? It establishes a baseline, sets a target, and orders the work between them so that effort is spent where it reduces the most risk or removes the most friction from sales.

This article sets out a five-level AI governance maturity model across eight dimensions. It describes each level in terms of observable practices and evidence, maps the model to the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act, and includes a self-assessment, a 90-day plan for reaching Level 3 and an example of an organization that reached independent certification in 93 days.

What is an AI governance maturity model?

An AI governance maturity model is a staged framework for assessing how well an organization directs, controls and evidences its use of artificial intelligence. It defines a sequence of maturity levels, from unmanaged use to continuously enforced controls, and a set of governance dimensions against which each level is assessed.

It is useful to distinguish three related terms:

• AI governance is the system of accountability, policies, processes and technical controls through which an organization directs and oversees the development, procurement and use of AI.
• An AI governance framework, such as the NIST AI RMF or ISO/IEC 42001, defines what a governance program should contain: outcomes, requirements or controls.
• An AI governance maturity model describes how well and how consistently those elements are implemented, and provides a scale for measuring progress over time.

The approach follows the capability maturity models that have been used in software engineering and information security for several decades, in which each level describes a more repeatable, measured and self-correcting set of practices than the one below it. The same principle applies to AI, with two differences. AI systems change behavior when models, data or prompts change, so controls must be re-applied more often than for conventional software. And AI is frequently adopted by individual employees before any central function knows it is in use, so the first level of maturity is usually less visible than it is in other domains.

Why AI governance maturity matters in 2026

Four developments have moved AI governance from a matter of policy to one of operational and commercial consequence.

Breach data now quantifies the governance gap. IBM’s 2025 Cost of a Data Breach report found that “13% of organizations reported breaches of AI models or applications,” and that “of those compromised, 97% report not having AI access controls in place.” It also found that “63% of breached organizations either don’t have an AI governance policy or are still developing a policy,” and that organizations with high levels of shadow AI “observed an average of $670,000 in higher breach costs” (IBM, 2025). The 2026 edition reports that “more than 20% of organizations reported a breach targeting AI models or applications,” and that AI-enabled breaches “cost an average of $6 million,” against a global average of $4.99 million (IBM, 2026).

Enterprise buyers assess AI governance directly. Security questionnaires increasingly contain a dedicated AI section. The 2026 edition of the Shared Assessments SIG questionnaire standardizes the assessment of a vendor’s AI governance controls across “the whole AI lifecycle,” with reference to recognized standards including ISO/IEC 42001 (Mitratech), and the Cloud Security Alliance’s AI Controls Matrix, released with “243 controls across 18 domains,” is accompanied by an AI-specific version of its CAIQ questionnaire (CSA). Many large customers now route AI vendors through a separate AI review committee in addition to the security review. For background on how these questionnaires work, see What Is a DDQ?

Regulation has become specific, and has continued to change. The EU AI Act entered into force on 1 August 2024. Its prohibitions and AI literacy provisions have applied since 2 February 2025, and obligations for general-purpose AI models since 2 August 2025. The Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744, moved the obligations for high-risk systems: according to the Commission’s AI Act Service Desk, the rules for high-risk systems in Annex III now apply from 2 December 2027, and those for high-risk AI embedded in products covered by Annex I from 2 August 2028 (AI Act Service Desk). In the United States, Colorado’s original AI Act (SB 24-205) was repealed and replaced by SB 26-189, signed on 14 May 2026, which takes effect on 1 January 2027 and removes the original risk management and impact assessment requirements (Seyfarth). Texas’s Responsible AI Governance Act took effect on 1 January 2026 and provides that an organization may not be found liable if it can show, among other things, that it substantially complies “with the NIST AI Risk Management Framework or other recognized standards” (Baker Botts). Because these requirements continue to move, a governance program anchored to recognized frameworks is more durable than one built to the text of any single law.

Governance is now a recognized discipline with measurable effects. The IAPP’s AI Governance Profession Report 2025 found that “77% are currently working on AI governance,” rising to “near 90% for those organizations already using AI,” and that “for almost half of the respondents, AI governance was a top-five strategic priority” (IAPP). Gartner reports that “organizations that deployed AI governance platforms are 3.4 times more likely to achieve high effectiveness,” and expects AI governance spending “to reach $492 million in 2026 and surpass $1 billion by 2030” (Gartner). At the same time, implementation lags intent: in PwC’s 2025 US Responsible AI survey, about half of respondents cited turning principles into scalable, repeatable processes as their biggest hurdle (PwC).

Existing AI maturity models

Several AI maturity models have been published. Most measure AI adoption or responsible AI practice in general, rather than governance as a control system that can be evidenced to a customer or auditor.

Model	Publisher	Levels	Focus
Responsible AI Maturity Model (2023)	Microsoft Research (Aether)	5: Latent, Emerging, Developing, Realizing, Leading	Organizational responsible AI practice across 24 dimensions
AI Maturity Model (2023)	MITRE	5: Initial, Adopted, Defined, Managed, Optimized	Organizational AI capability across six pillars, one of which is ethical, equitable and responsible use
Generative AI maturity model	AWS	4: Envision, Experiment, Launch, Scale	Generative AI adoption, with governance as a criterion at each level
AI Adoption Framework (2020)	Google Cloud	3: Tactical, Strategic, Transformational	AI capability across six themes, including security
AI Risk Management Framework (2023)	NIST	None	Outcomes organized into four functions; supports Current and Target Profiles but defines no tiers
ISO/IEC 42001 (2023)	ISO/IEC	None	Certifiable requirements for an AI management system

Two observations follow. First, neither of the frameworks most often cited by customers and regulators, the NIST AI RMF and ISO/IEC 42001, defines maturity levels. The AI RMF’s core is organized into four functions and 19 categories (NIST AIRC), and ISO/IEC 42001 is a set of management system requirements that an organization either conforms to or does not. Organizations that want to measure progress toward either need a separate scale. Second, adoption models tend to treat governance as one pillar among several. For a company that sells software containing AI, governance is the dimension that customers and auditors examine most closely, and it benefits from a model of its own.

The model below is designed for that purpose. Each level is defined by evidence that a customer, auditor or board could inspect, and each is mapped to the frameworks those parties already use.

The five levels of AI governance maturity

Level	Name	Characteristic state	Typical evidence	Indicative framework anchor
1	Ad hoc	AI is adopted by individuals and teams without central visibility, policy or accountability	None that is reliable	None
2	Defined	An accountable owner, an approved AI use policy and an initial inventory exist; practice is inconsistent	Policy, owner, partial inventory, training records	EU AI Act Article 4 (AI literacy); NIST AI RMF Govern
3	Managed	Every material AI system is inventoried, risk-assessed and subject to lifecycle and access controls that produce evidence	Complete inventory, risk and impact assessments, release records, agent access reviews, incident runbook	NIST AI RMF Govern, Map, Measure and Manage; ISO/IEC 42001 controls implemented
4	Assured	The program is measured against defined metrics, internally audited, reviewed by management and independently verified	Metrics, internal audit reports, management review minutes, certificate	ISO/IEC 42001 certification; EU AI Act high-risk obligations
5	Adaptive	Controls are enforced in tooling, re-applied automatically when models, data or prompts change, and extended to autonomous agents	Policy-as-code, continuous evaluation results, automated attestations	Continuous improvement (ISO/IEC 42001 Clause 10) applied in engineering systems

Level 1: Ad hoc

At Level 1, AI is in use but is not governed as a category. Employees use generative AI tools with personal or team accounts, engineering teams call model APIs or run open-weight models without a review, and AI features may already be in production. No one is accountable for AI risk, and no inventory exists. The organization cannot answer basic questions from a customer, such as which models process customer data or which vendors act as AI sub-processors.

The principal risks at this level are data exposure through unsanctioned tools, unreviewed changes in vendor terms on the use of customer data for training, and the inability to complete the AI section of a security questionnaire. IBM’s finding that one in five organizations “reported a breach due to shadow AI” describes the typical consequence. Our article on shadow AI governance covers detection and remediation in detail.

To reach Level 2: name an accountable owner, publish an AI acceptable use policy, and begin an inventory of AI tools and vendors.

Level 2: Defined

At Level 2, governance exists on paper and is applied inconsistently. A named owner, often the CTO, CISO or head of legal, has responsibility for AI risk. An AI acceptable use policy specifies which tools are approved and what data may be used with them. An initial inventory lists the approved tools and major vendors, and staff have received basic training, which also addresses the AI literacy measure required of providers and deployers under Article 4 of the EU AI Act.

The limitation of Level 2 is that the policy is not yet connected to how AI systems are built, bought or operated. The inventory is incomplete, risk assessment happens informally if at all, and there is little evidence that controls operate. A customer reviewing a Level 2 organization will typically find acceptable answers on policy and unsatisfactory answers on implementation.

To reach Level 3: complete the inventory, including agents and AI sub-processors; assign each AI system a risk tier; and introduce documented risk and impact assessment and release controls for material systems.

Level 3: Managed

At Level 3, every material AI system is known, owned, assessed and controlled, and the controls produce evidence. This is the level at which an organization can implement the four functions of the NIST AI RMF in substance: Govern establishes the policies and accountability; Map “establishes the context to frame risks related to an AI system”; Measure “employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies” to analyze them; and Manage “entails allocating risk resources to mapped and measured risks on a regular basis” (NIST AIRC).

Characteristic practices at Level 3 include:

• A complete AI inventory covering internally developed systems, third-party models and APIs, AI features in purchased software, and autonomous agents, each with an owner and a risk tier.
• A documented risk and impact assessment for each high-risk use case before deployment, addressing intended use, affected parties, data, failure modes and human oversight. ISO/IEC 42001 requires an AI system impact assessment, and ISO/IEC 42005:2025 provides guidance on conducting one.
• AI-specific due diligence for vendors, covering training use of customer data, model provenance, sub-processors and contractual commitments.
• Lifecycle controls: pre-release testing including adversarial and prompt injection testing, scoped credentials and permissions for agents, logging of model inputs and outputs where appropriate, and change control for models, prompts and retrieval data.
• An AI incident definition and runbook integrated with the general incident response process.

Level 3 is the level most enterprise buyers implicitly expect of a vendor whose product contains AI, because it is the level at which every question in a typical AI questionnaire can be answered with evidence. Before deploying a specific AI system, our AI readiness assessment provides a pre-deployment check that fits within this level.

To reach Level 4: define metrics and thresholds for AI risk, conduct an internal audit and management review, and obtain independent verification.

Level 4: Assured

At Level 4, the governance program is measured, audited and independently verified. The organization operates an AI management system in the sense defined by ISO/IEC 42001, described by ISO as “the world’s first AI management system standard” (ISO): the scope is defined, objectives and metrics are set, an internal audit is performed, management reviews the results, and nonconformities are corrected.

ISO/IEC 42001 follows the same high-level structure as ISO/IEC 27001, with requirements in Clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation and improvement) and a reference set of controls in Annex A, organized into nine objectives that cover policies, internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems and third-party relationships. Certification bodies that audit against the standard are themselves subject to ISO/IEC 42006:2025, which “sets out the additional requirements for bodies that audit and certify artificial intelligence management systems.” Certification therefore provides a form of assurance that customers can rely on without performing their own assessment.

Level 4 is also the level at which the substantive obligations for providers of high-risk AI systems under the EU AI Act, including a risk management system, data governance, record-keeping, human oversight and post-market monitoring, can be met in a demonstrable way.

To reach Level 5: enforce policy in tooling rather than through review, automate re-assessment when models, data or prompts change, and extend identity and access governance to every agent.

Level 5: Adaptive

At Level 5, governance operates continuously and largely within engineering systems. Policies are expressed as code and enforced at AI gateways, in CI/CD pipelines and in agent runtimes. Evaluations are re-run automatically when a model version, system prompt, retrieval corpus or tool permission changes. Each agent has its own identity, scoped credentials and an accountable human owner, and its actions are logged and attributable. Metrics from incidents, evaluations and audits feed directly back into controls.

Few organizations operate at Level 5 across all dimensions, and it is not a necessary target for most. It becomes relevant where AI agents act autonomously on production systems or sensitive data at scale, because review-based controls cannot keep pace with the rate at which such agents act. Deloitte’s State of AI in the Enterprise 2026 found that, among companies planning to deploy agentic AI, “only 21% of those companies report having a mature model for agent governance” (Deloitte).

The eight dimensions of AI governance

An organization is rarely at the same level in every area. The model therefore assesses eight dimensions separately. Each is aligned with the NIST AI RMF functions and with the corresponding ISO/IEC 42001 requirements and Annex A objectives.

Dimension	What is assessed	NIST AI RMF	ISO/IEC 42001
1. Accountability and ownership	Executive ownership, decision rights, review committee, board reporting	Govern	Clause 5 (Leadership); A.3 Internal organization
2. AI inventory and visibility	Coverage of internal systems, third-party models, AI features in software, agents and shadow AI	Map	Clause 4 (Context); A.4 Resources for AI systems
3. Policy and acceptable use	AI policy, acceptable use, training and AI literacy	Govern	A.2 Policies related to AI; Clause 7 (Support)
4. Risk and impact assessment	Risk tiering, impact assessment, risk treatment and re-assessment triggers	Map, Measure	Clauses 6.1 and 8; A.5 Assessing impacts of AI systems
5. Data governance and provenance	Sources, quality, provenance and permitted use of training, fine-tuning and retrieval data	Map, Measure	A.7 Data for AI systems
6. Lifecycle and security controls	Release gates, adversarial testing, agent permissions, change control, logging	Measure, Manage	A.6 AI system life cycle; A.9 Use of AI systems
7. Third-party and supplier AI	AI vendor due diligence, contractual terms, sub-processors, model changes	Govern, Manage	A.10 Third-party and customer relationships
8. Monitoring, incidents and assurance	Monitoring, AI incident response, internal audit, management review, certification, transparency to customers	Measure, Manage	Clauses 9 and 10; A.8 Information for interested parties

Of the eight, data governance is the dimension most often underestimated, because data reaches AI systems through APIs, retrieval pipelines, agents and third-party services that are rarely mapped in one place. In episode 70 of our podcast, Abhi Sharma, CEO and co-founder of Relyance AI, discusses how companies get AI governance wrong when they cannot trace how their data moves, and the elements that determine whether an AI system can be trusted.

The episode 70 deep dive has his argument in full. Abhi defines trust as transparency times security times business value, so a zero in any one of them makes trust zero, and he explains why AI raises business value while straining the other two.

The overall maturity level is limited by the weakest dimension that matters to the organization’s customers and regulators. An organization with an excellent policy and no inventory is not at Level 3, because the policy cannot be shown to apply to systems it does not know about. In the self-assessment below, the overall level is calculated as the average of the eight scores, rounded down, and capped at one level above the lowest-scoring dimension.

AI governance maturity self-assessment

The assessment below scores each of the eight dimensions from 1 to 5. Select the statement that most accurately describes current practice, not intended practice, and where a dimension is partially implemented, select the lower level.

AI governance maturity self-assessment

Which level is your AI governance program at?

Eight questions, one per dimension. The result is an indicative score based on the model in this article, not an audit opinion. Your answers stay in your browser unless you request a review.

1. Accountability and ownership No one is accountable for AI risk A named owner, without a defined mandate Executive owner and a review group with decision rights Leadership reviews AI risk on a schedule; internal audit covers AI Accountable owner for every AI system and agent, reviewed continuously 2. AI inventory and visibility No inventory; tools adopted by individuals and teams Partial list of approved tools and vendors Complete inventory of systems, models, vendors and agents, with owners and risk tiers Inventory reconciled against SSO, spend and network data to detect shadow AI Inventory updated automatically from pipelines, identity and procurement 3. Policy and acceptable use No AI policy AI acceptable use policy published Policies cover development, procurement, data and human oversight, with training Policies audited against ISO/IEC 42001 or NIST AI RMF and reviewed annually Policy enforced in tooling (AI gateways, CI checks, policy as code) 4. Risk and impact assessment No AI-specific risk assessment Informal review for some projects Documented risk and impact assessment for each high-risk use case before release Assessed against defined metrics and thresholds, with re-assessment triggers Re-assessed automatically when models, data or prompts change 5. Data governance and provenance No controls on what data reaches AI tools Rules on sensitive data in AI tools, not enforced Training, fine-tuning and retrieval sources documented, with provenance and access controls Data lineage and quality tested, with retained evidence Data controls enforced inline (classification-aware retrieval, DLP) 6. Lifecycle and security controls Models and agents ship without AI-specific testing Informal testing before release Release gates with adversarial testing, scoped agent credentials and logging Scheduled red teaming with tracked remediation Continuous evaluation and runtime guardrails with automated rollback 7. Third-party and supplier AI AI vendors are not reviewed Standard vendor review, without AI-specific questions AI due diligence: training use of data, model provenance, sub-processors, contract terms Vendor AI assurance (for example ISO/IEC 42001) verified and monitored Vendor model and sub-processor changes monitored continuously 8. Monitoring, incidents and assurance No AI monitoring or incident process General incident process; AI incidents not defined AI incidents defined and monitored; runbook tested; evidence retained Internal audit, management review and external certification Metrics drive control changes automatically

…overall maturity level

…average across eight dimensions

…lowest-scoring dimension

…dimensions below Level 3

Request a review of my results →

A member of our AI governance team will review your answers and reply personally with recommended next steps. You will not be added to a mailing sequence.

Two cautions apply to any self-assessment. Practitioners tend to score policy and accountability higher than the evidence supports, because those dimensions are documented rather than observed. And the score measures the program, not the risk: an organization at Level 2 with a single internal chatbot may carry less risk than one at Level 3 operating autonomous agents with production access. The appropriate target depends on what the organization’s AI systems do and who relies on them.

Mapping the model to NIST AI RMF, ISO/IEC 42001 and the EU AI Act

The model does not replace any of these frameworks. It provides a scale against which progress toward them can be measured, and it indicates the level at which each is typically satisfied.

NIST AI Risk Management Framework

The AI RMF 1.0 (NIST AI 100-1), released in January 2023, is voluntary and, in NIST’s words, “intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic.” Its core comprises four functions. NIST describes Govern as “a cross-cutting function that is infused throughout AI risk management and enables the other functions,” while Map, Measure and Manage apply to individual AI systems. The Generative AI Profile (NIST AI 600-1), published in July 2024, extends the framework with risks and suggested actions specific to generative AI.

In maturity terms, Level 2 corresponds to the establishment of the Govern function; Level 3 to the operation of all four functions for every material AI system; and Levels 4 and 5 to measuring their effectiveness and improving them over time. Because the AI RMF supports Current and Target Profiles but not tiers, the maturity levels in this model can be used to describe both profiles in a consistent way.

Two current developments are relevant. NIST states on its AI RMF page that “the AI RMF 1.0 is being revised as part of the White House AI Action Plan” (NIST). And NIST has published an initial preliminary draft of a Cyber AI Profile (NIST IR 8596) based on the Cybersecurity Framework, organized around securing AI system components, AI-enabled cyber defense and thwarting AI-enabled attacks. Programs built on the four functions should be able to absorb both without structural change.

ISO/IEC 42001

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. Unlike the AI RMF, it is certifiable. In maturity terms, its controls are implemented at Level 3, and the management system around them (performance evaluation, internal audit, management review and corrective action) is what distinguishes Level 4. Related standards fill in specific practices: ISO/IEC 23894:2023 provides guidance on AI risk management, and ISO/IEC 42005:2025 on AI system impact assessment.

Organizations that already hold ISO/IEC 27001 or a SOC 2 report typically find that a substantial part of the required management system and security controls already exists. The AI-specific work concentrates in impact assessment, data provenance, life cycle controls for models, human oversight and third-party AI. Our SOC 2 timeline article describes how the same organization later extended its program to ISO/IEC 42001.

EU AI Act

The EU AI Act is a regulation rather than a framework, and its obligations depend on an organization’s role (provider, deployer, importer or distributor) and the risk classification of each AI system. Its requirements correspond to maturity levels as follows:

• Prohibited practices (Article 5, applicable since 2 February 2025) require at least Level 2 visibility, since an organization cannot confirm that it does not engage in a prohibited practice without knowing which AI systems it operates.
• AI literacy (Article 4, applicable since 2 February 2025) corresponds to Level 2. As amended by the Digital Omnibus, Article 4 requires providers and deployers to “take measures to support the development of AI literacy of their staff,” and states that “this obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”
• Transparency obligations under Article 50, most of which have applied since 2 August 2026, correspond to Level 3 for organizations that deploy chatbots or generate synthetic content.
• High-risk obligations for providers, including a risk management system, data governance, technical documentation, record-keeping, human oversight, accuracy and robustness, and a quality management system, correspond to Level 4. Following the Digital Omnibus, they apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.

Penalties under Article 99 reach €35 million or 7% of worldwide annual turnover for prohibited practices, and €15 million or 3% for most other obligations. US companies are within scope when they place AI systems on the EU market or when the output of their AI systems is used in the EU.

Governing AI agents

Agentic AI systems, which plan and take actions through tools and APIs with limited human involvement, change what each maturity level requires. Controls designed for models that return text to a person are insufficient for agents that can modify code, move data or initiate transactions.

The OWASP Top 10 for Agentic Applications, released in December 2025, identifies risks including agent goal hijack, tool misuse, identity and privilege abuse, memory and context poisoning, cascading failures and rogue agents. It complements the OWASP Top 10 for LLM Applications, which addresses prompt injection, sensitive information disclosure, excessive agency and related risks, and MITRE ATLAS, which catalogs adversary tactics and techniques against AI systems. Singapore’s Model AI Governance Framework for Agentic AI, published in January 2026, organizes agent governance around assessing and bounding risks upfront, “making humans meaningfully accountable for agents by defining significant checkpoints at which human approval is required,” technical controls across the agent life cycle and end-user responsibility.

In practice, agents affect three dimensions of the model most directly:

• Inventory. At Level 3, agents must appear in the inventory as distinct entries with their own owners, tools, permissions and data access, not as features of the application that hosts them. Our 30-minute AI credential inventory is a practical starting point.
• Lifecycle and security controls. At Level 3, each agent should operate with its own scoped credentials rather than a shared key, with least-privilege permissions and logging that attributes each action to the agent and its accountable owner. See Agentic AI Security: Why Agents Need Least Privilege and AI Agent Governance Starts at Onboarding.
• Accountability. For each agent, a named person should be accountable for its actions, and the points at which human approval is required should be defined in advance. Our one-page accountability map is designed to answer this question for an enterprise questionnaire.

Where agents act autonomously on production systems at scale, the controls of Level 5, enforced in tooling and re-applied automatically, become necessary rather than aspirational.

A 90-day plan from Level 1 to Level 3

For most organizations that sell software containing AI, Level 3 is the appropriate first target: it is the level at which customer AI questionnaires can be answered with evidence, and it provides the foundation on which certification can later be built. The following sequence is the one we use with clients that start at Level 1 or 2.

Days 1 to 30: establish visibility.

1. Name an accountable executive owner and define the decision rights of a small cross-functional review group, typically engineering, security, legal and product.
2. Build the AI inventory from several sources: engineering interviews, cloud and API billing, SSO and OAuth grants, expense reports and network or browser telemetry. Include agents, AI features in purchased software and AI sub-processors.
3. Approve an AI acceptable use policy that specifies approved tools, prohibited data categories and the approval route for new tools.
4. Assign each AI system or use case a risk tier based on the data it processes, the decisions it informs or makes, its degree of autonomy and its exposure to customers.

Days 31 to 60: assess the risk.

1. Complete a documented risk and impact assessment for each high-tier system, covering intended use, affected parties, failure modes, human oversight and residual risk.
2. Perform AI-specific due diligence on vendors and model providers, including the training use of customer data, retention, sub-processors and contractual terms.
3. Review the credentials and data access of every agent, replace shared keys with scoped credentials, and remove unused permissions.
4. Record the sources, permitted use and provenance of training, fine-tuning and retrieval data.

Days 61 to 90: operate the controls.

1. Introduce release gates for AI systems, including adversarial and prompt injection testing proportionate to the risk tier.
2. Configure logging and monitoring, define what constitutes an AI incident, and add an AI section to the incident response runbook.
3. Begin collecting evidence as controls operate, so that a customer or auditor can later verify them.
4. Hold a management review of the inventory, assessments and open risks, and prepare a standard set of answers for customer AI questionnaires.

Two factors most often extend this timeline: no single owner with time allocated to the program, and an inventory that grows substantially once shadow AI is measured. Both are easier to address at the start than in the middle.

Case study: ISO/IEC 42001 in 93 days

Augment Code, which builds AI software for engineering teams, illustrates the step from Level 3 to Level 4. According to the case study, Augment “almost lost a strategic enterprise deal after failing to comply” with a customer’s AI committee requirements, and needed an AI governance certification quickly. YSecurity had previously led its SOC 2 Type 2 program, which meant that a substantial part of the management system and security controls was already operating.

The engagement began with a gap assessment that mapped the existing SOC 2 controls to ISO/IEC 42001. In the case study’s words, “We found 9 major and 10 minor gaps clustered around model provenance, bias stress-testing,” adversarial testing and human-in-the-loop checkpoints. A lean set of policies and procedures followed, covering risk, provenance logging, human oversight, release criteria and third-party model governance. Engineering work on data lineage tagging, bias stress tests and scheduled adversarial red teaming was integrated into existing sprints, with YSecurity documenting the evidence.

The certification audit was performed by Coalfire. Augment “cleared Stage 2 on day 93—three weeks ahead of target,” and the auditor’s only note was “maturity beyond typical first-year programs.” The case study reports that Augment became “one of the first 30 companies worldwide with ISO 42001,” and that the certification contributed to “cutting customer conversion cost by 64.9% and closing a 7-figure deal.”

In terms of the model, Augment entered the engagement with Level 3 practices in most dimensions, inherited in part from its SOC 2 program, and the work concentrated in the AI-specific dimensions in which it was weakest: data provenance, lifecycle controls for models, and assurance.

When to use AI governance consulting

Organizations can reach Level 2 without outside help. The decision to engage AI governance consulting usually depends on one of three circumstances: a customer or prospect requires evidence of AI governance on a timeline the internal team cannot meet; the organization intends to obtain ISO/IEC 42001 certification; or no one internally has both the security and the AI engineering background to assess agents, models and data pipelines.

When evaluating an AI governance consulting firm, the following questions are useful:

• Does the firm implement controls, or only write policy? Moving from Level 2 to Level 3 depends on engineering changes, such as agent credentials, release gates and logging, not on documents alone.
• Has the firm taken clients through ISO/IEC 42001 certification? Ask for the certification body involved and the elapsed time.
• Can it reuse existing SOC 2 or ISO/IEC 27001 controls? A substantial share of the work should be mapping rather than rebuilding.
• Will it support the customer review? The commercial value of governance is realized in questionnaires and AI committee meetings, and the firm should be able to participate in them.
• How is the work priced? Fixed retainers can obscure how much work is being performed; time-based billing with a cap is easier to compare.

Our article on hiring a vCISO covers the broader question of how startups should staff security leadership, which often includes ownership of AI governance.

Summary

An AI governance maturity model measures how well an organization directs, controls and evidences its use of AI. The model in this article defines five levels (Ad hoc, Defined, Managed, Assured and Adaptive) across eight dimensions, and limits the overall level by the weakest dimension. Neither the NIST AI RMF nor ISO/IEC 42001 defines maturity levels, so a model of this kind provides the scale against which progress toward both can be measured.

For most organizations that sell software containing AI, Level 3 is the appropriate first target, because it is the level at which customer AI questionnaires can be answered with evidence, and it is achievable in about 90 days with a dedicated owner. Level 4, typically evidenced by ISO/IEC 42001 certification, is increasingly requested by enterprise AI committees and corresponds to the obligations for high-risk systems under the EU AI Act.

YSecurity’s ISO 42001 team works as an embedded AI governance function: we assess current maturity, build the AI inventory and management system, implement the technical controls for models and agents, and support customer AI reviews after certification. We bill in 15-minute increments with no retainers or minimums.

To discuss your current level and a realistic target, book a 15-minute call or review the full Augment Code ISO 42001 case study. Startups can claim their first 8 hours free.