AI governance maturity model: levels and a small-team self-check

01What is a maturity model, and what is it for?

A maturity model lists levels for a practice. Level one is usually improvised, the top level is routine, measured and improved. The point is not a score. It is to show what the next step looks like and to start the right conversation.

Good level descriptions name things you can see: a list exists, a name is written down, a review took place. Vague wording such as a strong culture cannot be checked by anyone, so be wary of models that rely on it.

The authors of Microsoft's model say it works best as a high-level map. They write that looking ahead at higher levels matters more than grading your current level, and that because responsible AI is not yet a mature field, most organisations should expect to land low (Microsoft Research).

02What do published models look like?

Three public examples show different shapes. None is a certificate.

• Microsoft Responsible AI Maturity Model (May 2023). It has 24 dimensions grouped under organisational foundations, team approach and practice, each with five levels from Latent to Leading. It was built from interviews and focus groups with over 90 specialists and practitioners, and it is meant for planning workshops.
• NIST current and target profiles. The NIST AI Risk Management Framework does not use levels. It suggests describing how AI risk is managed today (a current profile), describing the goal (a target profile), comparing them, and writing an action plan for each gap (NIST AI 100-1).
• UK AI Management Essentials. A UK government self-assessment tool consulted on in November 2024. Its December 2025 response says it is being reworked into guidance focused on smaller businesses, so treat it as unfinished (UK government response).

03What are four simple bands for a small team?

These four bands are our own simplification, written for this page. They do not come from any standard, regulator or certifier, and they do not map to levels in the models above.

• Ad hoc: people use AI tools as they like. Nobody has a list, and nobody owns the decisions.
• Started: someone has listed the tools and written a first rule, but it is patchy.
• Defined: there is a named owner, written rules, a risk sort and vendor questions, and people know where to find them.
• Managed: the rules are followed, problems are logged, and the whole set is reviewed on a schedule.

04Which band are you in? An eight-question check

Answer yes only if it is true today and you could show it to someone. Count your yeses.

1. We keep a written list of the AI tools and uses in our organisation.
2. One named person owns AI decisions, with a backup.
3. We have written rules on what data may go into AI tools.
4. We sort uses by how much harm a wrong answer could do.
5. Any use that affects a person has a human who can review and reverse the result.
6. We asked each vendor how they test and what they do with our data, and kept the answers.
7. We log problems and near misses from AI use.
8. We review the list and the rules on a set schedule, at least yearly.

05What should you do after the check?

Pick the first question you answered no to and fix only that one this month. Then use the NIST idea: write what you have, write what you want a year from now, and list the gaps. If you work in a regulated area, ask your lawyer or regulator which rules apply, because this page is general information, not advice. Suggested next moves by band:

• Ad hoc: make the list of tools and uses first.
• Started: name the owner and write the rule on what data may go into AI tools.
• Defined: start the problem log and put the review date in a calendar.
• Managed: write a target profile for next year, and test whether staff can find and follow the rules.