Guide
AI governance maturity model: five levels, published models compared and a self-check
An AI governance maturity model is a scale, usually five levels running from ad hoc to continuously improving, that describes how well an organization controls its AI and what it must do to reach the next level. MITRE, Microsoft and Gartner each publish one; the NIST AI RMF and ISO/IEC 42001 don’t define levels at all [1][4][7][9][11]. This guide compares the published models, sets out a five-level model across six dimensions (our synthesis, mapped to NIST, ISO/IEC 42001 and the EU AI Act), and gives a self-check and a plan for moving up. To score yourself, take our free AI readiness assessment.
Reviewed 5 Nov 2026 · next review by 5 Mar 2027 · 20 sources · report an error
What is an AI governance maturity model?
A maturity model describes a path. Each level is a set of practices an organization either has or doesn’t, and you move up only once you meet everything at the level below. MITRE states this rule for its AI model: organizations advance to a level only after meeting the benchmarks of the previous one [1]. The point is not the score but the gap it shows between where you are and where you need to be.
An AI governance maturity model narrows this to control: inventory, policy, risk assessment, monitoring, accountability and regulatory readiness. A broader AI maturity model also scores strategy, talent, data platforms and business value. Most published models are the broader kind with governance as one pillar, which is why buyers searching for a governance model often land on an adoption model instead.
Maturity appears to pay off, though the evidence is correlational. In a Gartner survey of 432 organizations in the fourth quarter of 2024, 45% of high-maturity organizations kept AI projects in production for three years or more, against 20% of low-maturity ones; 57% of high-maturity organizations said business units trust new AI solutions, against 14% [8].
Which AI maturity models exist?
We describe only models whose publishers document them on their own pages. Level names are the publishers’ own.
| Model | Publisher and date | Structure | Levels | Governance coverage | Access |
|---|---|---|---|---|---|
| AI Maturity Model and Organizational Assessment Tool | MITRE, November 2023 [1] | 6 pillars, 20 dimensions [1] | 5: Initial, Adopted (Engaged in parts of the guide), Defined, Managed, Optimized [1][2] | A pillar for ethical, equitable and responsible use; governance and AI data governance dimensions [2] | Guide is free; the assessment tool is requested by email [1] |
| Responsible AI Maturity Model (RAI MM) | Microsoft Research, May 2023 [4] | 24 dimensions in 3 categories [4] | 5: Latent, Emerging, Developing, Realizing, Leading [4][5] | Governance, RAI policy, compliance processes, accountability, risk identification to monitoring [5] | Free PDF [5] |
| AI Maturity Assessment | Gartner [7] | 7 pillars, including governance [7] | 5: Foundational, Emerging, Operational, Scaled, Transformational [7] | One pillar of seven | Interactive assessment; full report is a client benefit [7] |
| AI Maturity Assessment (AIMA) | OWASP, version 1 [6] | 8 domains, adapted from OWASP SAMM [12] | 3 [12] | Responsible AI, governance, data management and privacy domains, plus design, implementation, verification and operations [12] | Free; incubator project with an Excel toolkit [6] |
| AI RMF | NIST, January 2023 [13] | 4 functions; current and target profiles [9] | None; no profile templates either [9] | GOVERN is one of four functions [14] | Free |
| ISO/IEC 42001 | ISO/IEC, December 2023 [10] | Management system requirements and controls [10] | None; continual improvement under clause 10 [11] | The whole standard | Certifiable; organizations certified since 2024 [11] |
MITRE. Built for enterprises adopting AI, with a focus on workforce and mission [1]. Its assessment has one multiple-choice question per dimension, and the chosen answer sets that dimension’s level [1]. For organizations with several business units, the guide uses the lowest level across the relevant units, says the top level may not be practical everywhere, and suggests reassessing every six to 12 months [2]. The guide itself is inconsistent about level 2, which it calls both Adopted and Engaged [2].
Microsoft. The only published model built entirely around responsible AI. Microsoft Research derived its 24 dimensions from interviews and focus groups with more than 90 people [4]. Its authors warn against averaging scores across dimensions, against using it punitively, and against treating level 5 as a target for everyone; they also note it is a first version with a pilot still pending [5]. It complements rather than replaces privacy and security maturity models [5].
Gartner. An enterprise AI maturity assessment, not a governance model: governance is one of seven pillars alongside strategy, data, engineering, operating model, culture and AI product value [7]. Its survey work measures maturity on a one-to-five scale [8].
OWASP AIMA. A security-led model adapted from OWASP’s Software Assurance Maturity Model, with eight domains and three levels [12]. Its project page lists it as an incubator project [6], so expect it to change.
NIST and ISO. Neither publishes levels. The AI RMF uses a Current Profile (how AI risk is managed today) and a Target Profile (the outcomes you need), and says comparing them reveals gaps to close [9]. ISO/IEC 42001 sets requirements that, in effect, you either meet or don’t, plus a duty to improve continually [10][11]. A maturity model sits comfortably on top of either.
The five levels of AI governance maturity
The model below is our synthesis, not a published standard. It borrows the five-step shape the MITRE and Microsoft models share [1][5], uses the same level names as our AI readiness assessment so the two line up, and ties each level to evidence an auditor could ask for.
| Level | Name | What it looks like | Evidence you could show |
|---|---|---|---|
| 1 | Initial | AI is used, but decisions depend on individuals. No one knows the full list of AI in use. | Little beyond emails and vendor contracts |
| 2 | Developing | Some rules and a partial inventory exist; a few teams follow them, others don’t. | Draft policy, a spreadsheet inventory, ad hoc reviews |
| 3 | Defined | Documented, organization-wide practices that every team follows, with named owners. | Approved policy, complete inventory, risk tiers, assessment templates, committee minutes |
| 4 | Managed | Practices are measured. Metrics show coverage, turnaround, incidents and control results, and leaders act on them. | Dashboards, monitoring reports, internal audit results, closed corrective actions |
| 5 | Optimizing | The program improves itself from data, anticipates new laws and shares lessons across the organization. | Trend analysis, documented improvements, regulatory horizon scanning |
AI governance maturity by dimension
Six dimensions cover what auditors and regulators ask about. Read across a row to see what each level requires; your level in a dimension is the highest column where everything is true. This matrix is our synthesis.
| Dimension | 1 Initial | 2 Developing | 3 Defined | 4 Managed | 5 Optimizing |
|---|---|---|---|---|---|
| AI inventory | No list of AI in use | Partial list of known projects | Complete register of built, bought and embedded AI, with owner, purpose and risk tier | Register updated automatically from procurement, SSO or discovery tools; coverage measured | Inventory drives decisions: retirement, reuse and portfolio reviews |
| Policy and standards | None, or a ban nobody follows | Draft AI policy or acceptable use note | Approved AI policy with standards for testing, documentation and oversight | Policy exceptions and breaches tracked and reported | Policy updated on a schedule from incident and audit data |
| Risk and impact assessment | Risks considered informally, if at all | Assessments for some projects, inconsistent formats | Risk tiers with set review depth; impact assessments before launch for high tiers | Assessment quality and turnaround measured; residual risk formally accepted | Assessments calibrated against what actually went wrong |
| Monitoring and incidents | Problems found by users or the press | Some teams monitor some models | Monitoring plan for every deployed high-tier system; defined incident process | Metrics on drift, misuse and incidents; reporting deadlines met and tested | Monitoring results feed retraining, tiering and policy |
| Accountability and roles | No named owner | An enthusiast or working group | Executive sponsor, chartered committee and named system owners | Board receives regular AI risk reporting; roles in job descriptions and objectives | Accountability reviewed and adjusted as AI use changes |
| Regulatory readiness | Unaware which laws apply | Aware of some laws; no mapping | Obligations mapped to controls for each applicable law | Controls tested; evidence ready for audit or regulator | Horizon scanning; new laws mapped before they apply |
| Dimension | NIST AI RMF | ISO/IEC 42001 | EU AI Act |
|---|---|---|---|
| AI inventory | GOVERN 1.6 [14] | Resource documentation and resources for AI systems (B.4.2–B.4.6) [17] | No inventory article; deployer duties (Art. 26) assume one (our reading) [18] |
| Policy and standards | GOVERN 1.2, 1.4 [14] | AI policy (B.2.2–B.2.4) [17] | Human oversight by people with the necessary competence, training and authority (Art. 26(2)) [18] |
| Risk and impact assessment | GOVERN 1.3; MAP 1.1 [14] | Impact assessment (6.1.4, 8.4, B.5) [17] | Fundamental rights impact assessment (Art. 27) [19] |
| Monitoring and incidents | MANAGE 4.1, 4.3 [14] | Operation and monitoring (B.6.2.6) [17]; clause 10 [11] | Logs kept at least six months (Art. 26(6)) [18]; serious incident reports (Art. 73) [20] |
| Accountability and roles | GOVERN 2.1, 2.3 [14] | Competence (7.2) [17] | Oversight assigned to people with authority (Art. 26(2)) [18] |
| Regulatory readiness | GOVERN 1.1 [14] | Alignment with other policies (B.2.3) [17] | High-risk dates: Dec 2, 2027 and Aug 2, 2028 [16] |
Self-check: what is your AI governance maturity level?
Answer yes or no. Score each dimension separately, then take the lowest as your overall level, as MITRE does across business units [2]: a strong policy can’t make up for an inventory you don’t have. Our AI readiness assessment does this scoring for you, with a slightly softer rule (the overall level is capped one level above your weakest area).
- Reaching level 2: Is there a written AI policy, even a draft? Is there a list of known AI projects? Has anyone been asked to coordinate AI governance?
- Reaching level 3: Does the inventory include purchased tools and AI features inside existing software? Is every system assigned a risk tier and an owner? Do high-tier systems get an impact assessment before launch? Has a committee or executive formally approved the policy?
- Reaching level 4: Can you report the share of AI systems with a completed assessment and current monitoring? Do you track incidents, policy exceptions and review turnaround? Has internal audit or an outside party tested the controls? Does the board get regular AI risk reporting?
- Reaching level 5: Has the policy or tiering changed because of what incidents or metrics showed? Are new laws mapped to controls before they apply? Are lessons shared across business units?
Have leaders and practitioners answer separately. The Microsoft model recommends exactly this, because different answers from the two groups show where perception and practice diverge [5].
How do you move up a maturity level?
The steps are not equal. Microsoft’s authors note that leaving levels 1 and 2 means building processes that don’t exist yet, which costs more than formalizing ones you already run at levels 3 and 4 [5]. Budget the first jump accordingly.
- 01
From Initial to Developing
Name a coordinator, draft an AI policy (our AI policy generator produces a first draft), and start a list of AI in use. Survey teams and check procurement and expense records.
- 02
From Developing to Defined
Complete the inventory, including third-party and embedded AI (NIST GOVERN 1.6 and 6.1) [14]. Set risk tiers, adopt one impact assessment template, charter a committee and get the policy formally approved. This is the level most frameworks assume.
- 03
From Defined to Managed
Pick four to six metrics (inventory coverage, assessments completed, review turnaround, incidents, exceptions, monitoring coverage), report them to leadership, and have internal audit test the controls. Governance software usually earns its cost here; see our ranking of AI governance platforms.
- 04
From Managed to Optimizing
Use the data: change tiers and policy when incidents or audits show gaps, scan for new laws, and share lessons across teams. MITRE describes level 5 as an enterprise that continually improves and refines policy from data [2].
Reassess on a schedule. MITRE suggests every six to 12 months [2]. Re-score after any major change too: a new law, an acquisition or a move into AI agents.
What maturity level should you aim for?
Not level 5 everywhere. MITRE says the highest level in every dimension may not be practical and that targets should reflect the organization’s mission [2]; Microsoft calls level 5 highly aspirational [5]. Set a target per dimension instead, in the way NIST’s Target Profile describes the outcomes an organization needs [9].
- Low-risk AI use only (productivity tools, no decisions about people): level 3 for inventory and policy is usually enough, in our view.
- Customer-facing or decision-making AI: level 3 across all six dimensions, and level 4 for monitoring and incidents.
- High-risk AI under the EU AI Act, or regulated sectors: level 4 across the board before the obligations apply on December 2, 2027 (Annex III) or August 2, 2028 (Annex I) [16]. In our reading, evidence that controls work is what a level 4 program produces and what conformity assessment and supervisors will expect.
- Seeking ISO/IEC 42001 certification: a level 3 program with internal audit and management review running, which the standard requires [11], is the practical minimum.
Leadership matters at every level. Gartner found that 91% of high-maturity organizations had appointed dedicated AI leaders and almost 60% had centralized AI strategy, governance, data and infrastructure [8]. For the structure those leaders run, see what AI governance is.
Frequently asked questions
+What is an AI governance maturity model?
It is a scale, usually of five levels, that describes how well an organization controls its AI, from ad hoc practices to measured, continuously improving ones. Organizations move up only after meeting the requirements of the level below, as MITRE’s model states [1].
+What are the five levels of AI maturity?
Names vary by publisher. MITRE uses Initial, Adopted, Defined, Managed and Optimized [1]; Microsoft’s responsible AI model uses Latent, Emerging, Developing, Realizing and Leading [4]; Gartner uses Foundational, Emerging, Operational, Scaled and Transformational [7]. Our model uses Initial, Developing, Defined, Managed and Optimizing.
+Does NIST have an AI maturity model?
No. The NIST AI RMF is built from four functions (GOVERN, MAP, MEASURE, MANAGE) with categories and subcategories [14], and it defines no maturity levels or scoring. Unlike NIST’s Cybersecurity Framework 2.0, which has four Tiers [15], it has no Tiers either. It uses Current and Target Profiles instead: describe how you manage AI risk today, describe the outcomes you need, and close the gaps between them; NIST does not prescribe profile templates [9].
+Is there an ISO standard for AI governance maturity?
Not as a maturity scale. ISO/IEC 42001 sets requirements for an AI management system that an organization either meets or doesn’t, and requires continual improvement under clause 10 [10][11]. Many organizations use a maturity model to plan their way to 42001 conformity.
+What is the MITRE AI Maturity Model?
A model MITRE published in November 2023 with six pillars, 20 dimensions and five levels, plus an assessment tool with one multiple-choice question per dimension [1]. One pillar covers ethical, equitable and responsible use, and others include governance and AI data governance dimensions [2].
+What is the Microsoft Responsible AI Maturity Model?
A Microsoft Research model from May 2023 with 24 dimensions grouped into organizational foundations, team approach and responsible AI practice, scored on five levels from Latent to Leading [4]. Its authors advise against averaging scores or using it punitively [5].
+How often should you assess AI governance maturity?
MITRE suggests reassessing every six to 12 months [2]. Re-score sooner after a major change, such as a new law that applies to you, a merger, or a move into AI agents.
+What is the difference between AI readiness and AI governance maturity?
Readiness asks whether you can adopt AI well: strategy, data, skills and security. Governance maturity asks whether you control it: inventory, policy, risk, monitoring and accountability. Broad models such as Gartner’s cover both, with governance as one of seven pillars [7].
Sources
- [1]MITRE, MITRE AI Maturity Model and Organizational Assessment Tool Guide (2023-11-03).
- [2]MITRE, MITRE AI Maturity Model and Organizational Assessment Tool Guide (PDF, PR 22-1879) (2023-11).
- [3]NIST AI Resource Center, AI RMF crosswalks.
- [4]Microsoft Research, Responsible AI Maturity Model (MSR-TR-2023-26) (2023-05-17).
- [5]Microsoft Research, Responsible AI Maturity Model (full report, PDF) (2023-05).
- [6]OWASP, OWASP AI Maturity Assessment (project page).
- [7]Gartner, Gartner AI Maturity Assessment.
- [8]Gartner, Gartner survey finds 45% of organizations with high AI maturity keep AI projects operational for at least three years (2025-06-30).
- [9]NIST, AI RMF section 6: AI RMF Profiles.
- [10]ISO, ISO/IEC 42001:2023 — Artificial intelligence — Management system (2023-12).
- [11]GLOCERT International, What is ISO/IEC 42001? (structure, clause 10 and Plan-Do-Check-Act).
- [12]Tripwire, Understanding the OWASP AI Maturity Assessment.
- [13]NIST, AI Risk Management Framework (2026-08-13).
- [14]NIST, AI RMF Core (GOVERN, MAP, MEASURE, MANAGE).
- [15]NIST, NIST SP 1302: NIST CSF 2.0 — Using the CSF Tiers, a quick-start guide (2024-10).
- [16]White & Case, EU AI Omnibus enters into force, amending the AI Act (2026-08-04).
- [17]Microsoft, hosted by NIST AI Resource Center, NIST AI RMF to ISO/IEC FDIS 42001 AI Management System Crosswalk.
- [18]European Commission (AI Act Service Desk), Article 26: Obligations of deployers of high-risk AI systems.
- [19]European Commission (AI Act Service Desk), Article 27: Fundamental rights impact assessment for high-risk AI systems.
- [20]European Commission (AI Act Service Desk), Article 73: Reporting of serious incidents.
How we keep this page current
Every claim links to its source. We re-check this page at least every 120 days, and sooner when a standard, law or vendor changes; vendor names, acquisitions and shutdowns update automatically from our directory. Vendors cannot pay to be included or ranked.