📖What is this?
AI Governance Maturity Model
A framework for assessing an organization's AI governance capabilities across multiple dimensions, from ad-hoc practices (Level 1) to continuously optimizing governance (Level 5). Based on CMM/CMMI concepts adapted specifically for AI governance challenges.
of enterprise employees using GenAI at work access it through personal accounts
Source: TELUS Digital 2025
of those employees admit entering sensitive information into public GenAI assistants
Source: TELUS Digital 2025
Why AI Governance Maturity Matters
Many organizations have adopted AI faster than they have developed governance. A TELUS Digital survey of enterprise employees who use generative AI at work (February 2025) shows what that looks like:
- 68% access public GenAI assistants such as ChatGPT, Microsoft Copilot or Google Gemini through personal accounts
- 57% admit to entering sensitive information into them
An AI Governance Maturity Model provides a roadmap from chaos to control — and it shapes whether you should build, buy, or partner to get a stalled pilot into governed production.
The 5-Level Model
Our model adapts proven maturity frameworks (CMM, CMMI, NIST CSF) specifically for AI governance:
| Level | Name | Characteristics |
|---|
| Level 1 | Initial | Ad-hoc, reactive, no formal governance |
| Level 2 | Developing | Basic awareness, some policies |
| Level 3 | Defined | Formal governance, consistent processes |
| Level 4 | Managed | Measured, risk-based decisions |
| Level 5 | Optimizing | Continuous improvement, AI advantage |
Level 1: Initial (Chaos)
Characteristics
| Aspect | State |
|---|
| Awareness | Limited - AI usage not tracked |
| Policy | None or outdated |
| Inventory | Unknown what AI is in use |
| Risk management | Reactive - incident-driven |
| Accountability | No clear ownership |
Typical Indicators
| Indicator | Presence |
|---|
| Shadow AI is prevalent | Yes |
| No AI acceptable use policy | Yes |
| Unknown AI tool count | Yes |
| No AI-specific training | Yes |
| Incidents discovered accidentally | Yes |
Risks at Level 1
| Risk | Likelihood | Impact |
|---|
| Data breach via Shadow AI | High | Critical |
| Regulatory non-compliance | High | Critical |
| Reputational damage | Medium | High |
| IP leakage | High | High |
Priority Actions to Advance
| Action | Effort | Impact |
|---|
| Create AI inventory | Medium | High |
| Draft basic AI policy | Low | Medium |
| Assign AI governance owner | Low | High |
| Begin Shadow AI discovery | Medium | High |
Level 2: Developing (Emerging)
Characteristics
| Aspect | State |
|---|
| Awareness | Growing - leadership engaged |
| Policy | Basic policy exists |
| Inventory | Partial - major tools known |
| Risk management | Some assessment |
| Accountability | Owner identified |
Typical Indicators
| Indicator | Presence |
|---|
| AI policy published | Yes |
| Some approved AI tools | Yes |
| Basic training exists | Yes |
| Ad-hoc risk assessment | Yes |
| Governance committee forming | Yes |
Progress from Level 1
| Improvement | Status |
|---|
| Shadow AI visibility | Partial |
| Executive sponsorship | Achieved |
| Basic controls | Implemented |
| Incident response | Ad-hoc |
Risks at Level 2
| Risk | Likelihood | Impact |
|---|
| Inconsistent enforcement | High | Medium |
| Gaps in coverage | High | High |
| Policy drift | Medium | Medium |
Priority Actions to Advance
| Action | Effort | Impact |
|---|
| Complete AI inventory | Medium | High |
| Formalize governance structure | Medium | High |
| Implement monitoring | Medium | High |
| Develop risk assessment process | Medium | High |
Level 3: Defined (Structured)
Characteristics
| Aspect | State |
|---|
| Awareness | Organization-wide |
| Policy | Comprehensive, enforced |
| Inventory | Complete and current |
| Risk management | Formal process |
| Accountability | Clear RACI |
Typical Indicators
| Indicator | Presence |
|---|
| Governance committee active | Yes |
| Approved AI catalog | Yes |
| Regular training | Yes |
| Risk assessment process | Yes |
| Monitoring implemented | Yes |
Progress from Level 2
| Improvement | Status |
|---|
| Consistent processes | Achieved |
| Policy enforcement | Active |
| Risk visibility | Good |
| Incident response | Defined |
This is the Compliance Threshold
Level 3 is typically the minimum for:
- EU AI Act compliance
- ISO 42001 certification
- SOC 2 + AI controls
- Regulatory examinations
Risks at Level 3
| Risk | Likelihood | Impact |
|---|
| Process deviation | Medium | Medium |
| Measurement gaps | Medium | Medium |
| Improvement stagnation | Medium | Low |
Priority Actions to Advance
| Action | Effort | Impact |
|---|
| Implement metrics program | Medium | High |
| Automate governance | High | High |
| Advanced monitoring | Medium | High |
| Predictive risk management | High | High |
Level 4: Managed (Measured)
Characteristics
| Aspect | State |
|---|
| Awareness | Embedded in culture |
| Policy | Dynamic, risk-based |
| Inventory | Automated discovery |
| Risk management | Quantitative |
| Accountability | Performance measured |
Typical Indicators
| Indicator | Presence |
|---|
| KPIs and dashboards | Yes |
| Automated controls | Yes |
| Predictive capabilities | Yes |
| Benchmarking | Yes |
| Integration with enterprise risk | Yes |
Progress from Level 3
| Improvement | Status |
|---|
| Quantified risk | Achieved |
| Automated discovery | Implemented |
| Continuous monitoring | Active |
| Performance tracking | Established |
Benefits at Level 4
| Benefit | Evidence |
|---|
| Incident trend tracked | Against your own baseline |
| Faster issue resolution | MTTD/MTTR improvements |
| Risk-based prioritization | Data-driven decisions |
| Regulatory confidence | Audit-ready posture |
Risks at Level 4
| Risk | Likelihood | Impact |
|---|
| Metric gaming | Low | Medium |
| Innovation friction | Medium | Medium |
| Complacency | Low | Medium |
Priority Actions to Advance
| Action | Effort | Impact |
|---|
| AI-assisted governance | High | High |
| Continuous optimization | Medium | Medium |
| Innovation enablement | High | High |
| Industry leadership | Medium | Medium |
Level 5: Optimizing (Leading)
Characteristics
| Aspect | State |
|---|
| Awareness | Strategic asset |
| Policy | Self-improving |
| Inventory | Real-time, predictive |
| Risk management | Anticipatory |
| Accountability | Business outcome linked |
Typical Indicators
| Indicator | Presence |
|---|
| AI governs AI | Yes |
| Competitive advantage | Yes |
| Industry benchmark | Yes |
| Continuous innovation | Yes |
| Strategic enablement | Yes |
Progress from Level 4
| Improvement | Status |
|---|
| Predictive governance | Achieved |
| Self-improving controls | Implemented |
| Strategic integration | Complete |
| Innovation enablement | Active |
Characteristics of Level 5 Organizations
| Attribute | Description |
|---|
| AI-assisted governance | Use AI to govern AI |
| Predictive risk | Anticipate issues before they occur |
| Innovation enablement | Governance accelerates AI adoption |
| Industry leadership | Set standards for others |
| Strategic alignment | AI governance drives business value |
Assessment Dimensions
Evaluate your organization across these dimensions:
Dimension 1: Strategy & Leadership
| Level | Criteria |
|---|
| 1 | No AI strategy |
| 2 | Basic awareness |
| 3 | Formal strategy |
| 4 | Measured execution |
| 5 | Strategic advantage |
Dimension 2: Policy & Process
| Level | Criteria |
|---|
| 1 | No AI policies |
| 2 | Basic policy exists |
| 3 | Comprehensive, enforced |
| 4 | Risk-based, adaptive |
| 5 | Self-improving |
Dimension 3: Technology & Tools
| Level | Criteria |
|---|
| 1 | No governance tools |
| 2 | Manual processes |
| 3 | Basic automation |
| 4 | Integrated platforms |
| 5 | AI-powered governance |
Dimension 4: People & Culture
| Level | Criteria |
|---|
| 1 | No awareness |
| 2 | Basic training |
| 3 | Regular programs |
| 4 | Embedded culture |
| 5 | Strategic capability |
Dimension 5: Risk & Compliance
| Level | Criteria |
|---|
| 1 | Reactive only |
| 2 | Ad-hoc assessment |
| 3 | Formal process |
| 4 | Quantitative |
| 5 | Predictive |
Maturity Assessment Scorecard
| Dimension | Weight | L1 | L2 | L3 | L4 | L5 |
|---|
| Strategy & Leadership | 20% | 1 | 2 | 3 | 4 | 5 |
| Policy & Process | 25% | 1 | 2 | 3 | 4 | 5 |
| Technology & Tools | 20% | 1 | 2 | 3 | 4 | 5 |
| People & Culture | 15% | 1 | 2 | 3 | 4 | 5 |
| Risk & Compliance | 20% | 1 | 2 | 3 | 4 | 5 |
Overall Score Calculation:
| Score Range | Overall Level |
|---|
| 1.0 - 1.4 | Level 1 |
| 1.5 - 2.4 | Level 2 |
| 2.5 - 3.4 | Level 3 |
| 3.5 - 4.4 | Level 4 |
| 4.5 - 5.0 | Level 5 |
Advancement Timeline
These horizons are planning assumptions for this model, not measured industry benchmarks: your pace depends on scope, starting point and sponsorship.
| Transition | Planning Horizon (assumption) | Key Investments |
|---|
| Level 1 → 2 | 3-6 months | Policy, awareness, basic tools |
| Level 2 → 3 | 6-12 months | Processes, governance structure |
| Level 3 → 4 | 12-18 months | Metrics, automation, integration |
| Level 4 → 5 | 18-24 months | AI-powered governance, culture |
The Bottom Line
AI governance maturity is a journey, not a destination. Understanding where you are enables focused improvement.
Key takeaways:
- Know your starting level - Score each dimension before you plan
- Level 3 is the compliance minimum - Get here for regulatory readiness
- Level 4 delivers measurable value - Risk is quantified and tracked against your own baseline
- Level 5 creates competitive advantage - AI governance as enabler
- Advancement is a planned program - Treat the timeline above as a planning assumption, not a benchmark
The organizations that invest in governance maturity now will be best positioned to capture AI's benefits while managing its risks.
Free • 5 min
Assess Your Shadow AI Risk
1 in 5
organizations reported a breach due to shadow AI (IBM)
+$670K
higher avg. breach cost, high vs. low/no shadow AI (IBM)
40%+
of enterprises will face shadow AI security or compliance incidents by 2030 (Gartner)
5-dimension governance score. The gaps behind it. EU AI Act roadmap included.