How to Use an AI Governance Maturity Model to Find Your Gaps

Govern AI like a new hire, moving from unsupervised experiments to earned autonomy in five stages

Govern AI like a new hire, moving from unsupervised experiments to earned autonomy in five stages

Where does your organization actually stand on AI governance, and what has to change to get to the next level? An AI governance maturity model answers that question by describing the stages an organization moves through, from scattered, unsupervised AI use to a system where each AI tool or agent has a defined role, a named owner, and autonomy it has earned through performance. A maturity model is not a policy or a framework you adopt. It is a diagnostic. It gives leadership teams a shared language for where they are today, which makes it far easier to agree on what to fix first.

Why AI Governance Needs a Maturity Model Now

The gap between AI adoption and AI oversight is widening, and most leaders can feel it even when they cannot measure it. Three public data points show the shape of the problem:

• Confidence is low. In Grant Thornton’s 2026 AI Impact Survey of roughly 1,000 US senior leaders, 78 percent lacked full confidence that their organization could pass an independent AI governance audit.
• Confidence is also misplaced. In an August 2026 survey of 202 IT and security leaders at large enterprises, 94 percent said they were confident their AI agents did not have more access than they needed. Only 33 percent actually provisioned agents with least-privilege access, and 65 percent had already seen an agent act outside its intended scope.
• The volume is about to jump. Gartner predicts that 40 percent of enterprise applications will feature task-specific AI agents by the end of 2026, up from less than 5 percent in 2025\.

Gartner also predicts that over 40 percent of agentic AI projects will be canceled by the end of 2027 due to escalating costs, unclear business value, or inadequate risk controls. Two of those three reasons are governance problems. Without a maturity model, governance conversations tend to collapse into two unhelpful positions: “we have a policy, so we’re fine” or “we’re nowhere, so we need a big program.” A maturity model replaces both with a more useful question: which stage are we in, and what is the one move that gets us to the next one?

The Hiring Lens: Govern AI Like a New Hire

Most AI governance maturity models borrow their stage names from software process models (initial, repeatable, defined, managed, optimizing). Those names are accurate but abstract. Leaders nod at them and then struggle to say what “managed” looks like on a Tuesday. A more practical lens is one every manager already knows: hiring. Organizations have a well-tested system for bringing in capable, unproven newcomers. A new hire gets a job description, access scoped to the role, a manager who reviews their work, and more responsibility as they prove themselves. Nobody gets admin rights to the finance system on day one. The same logic applies to AI tools and agents, and it is the core of Govern AI Like You Hire. Seen through that lens, AI governance maturity is really a measure of how well your organization onboards, supervises, and promotes its AI systems. It also keeps accountability where it belongs. An agent can have a role, but a named person stays responsible for its work, a point made sharply in AI Is Not a Legal Shield.

The 5 Dimensions an AI Governance Maturity Model Measures

Before looking at the stages, it helps to know what is being measured. This model scores an organization on five dimensions, each with a direct hiring parallel:

1. Inventory: Do you know which AI tools and agents are in use? (Do you know who works here?)
2. Role definition: Does each AI system have a written purpose, scope, and escalation rule? (Does each person have a job description?)
3. Access: Are permissions scoped to the task, or granted for convenience? (Did the new analyst get the access the job needs, or everything?)
4. Ownership and review: Is a named human accountable for each system’s output, with a regular review? (Does every new hire have a manager?)
5. Learning: Do incidents and wins change the rules, and does autonomy expand or contract based on evidence? (Do people get promoted, coached, or reassigned based on performance?)

The 5 Stages of AI Governance Maturity

Here is the model at a glance. Most organizations are not at a single stage across all five dimensions, and that unevenness is itself a useful finding.

Stage	Name	Inventory	Roles and access	Ownership and review	Learning
1	Unsupervised	Unknown	None defined, broad access	Nobody owns outcomes	Incidents are surprises
2	Policy on Paper	Partial, self-reported	Acceptable use policy, rarely enforced	Owners named for big tools only	Rules change after headlines
3	Onboarded	Maintained register	Role description and scoped access per system	Named owner for every system	Incidents logged
4	Supervised	Live, reviewed quarterly	Access reviewed on a schedule	Regular performance reviews	Findings update the rules
5	Earned Autonomy	Live and tied to risk tiers	Autonomy expands or contracts on evidence	Review effort matched to risk	Governance speeds adoption

Stage 1: Unsupervised

AI is in the building, but nobody can say exactly where. Teams sign up for tools on their own, connect them to whatever data is easiest, and share prompts in chat threads. Signals you’re here: Leadership cannot produce a list of AI tools in use. Security learns about new tools from expense reports. People use personal accounts for work tasks. Microsoft and LinkedIn’s 2024 Work Trend Index found that 78 percent of AI users were bringing their own AI tools to work, which is what Stage 1 looks like at scale. The move to Stage 2: Find out what is actually being used. An anonymous, no-penalty survey surfaces more than an audit, because people will tell you about tools they are not afraid to lose.

Stage 2: Policy on Paper

An acceptable use policy exists. It lists approved and banned tools and probably went out in an all-hands email. But it is a document, not a practice. Nobody checks it, and nobody owns the outcomes of the tools it approves. Signals you’re here: The policy is more than six months old. It talks about tools but not agents. Approval requests sit in a queue for weeks, so people work around them. Governance mostly shows up as “no.” The move to Stage 3: Shift from rules about tools to roles for systems. Pick the five highest-impact AI uses and write a one-page role description for each: what outcome it owns, which systems it can touch, which human owns its work, and when it escalates instead of acting.

Stage 3: Onboarded

Every AI system in meaningful use has the equivalent of a job description and a manager. There is a maintained register. Access is scoped to the task. When something goes wrong, someone can say whether the system did what it was supposed to do, because someone wrote down what it was supposed to do. Signals you’re here: You can answer “who owns this agent?” for any system in under a minute. New AI requests go through a defined intake path. Least privilege is the default rather than the exception. The move to Stage 4: Add a review rhythm. Onboarding without supervision decays quickly, because roles drift, access accumulates, and owners change jobs.

Stage 4: Supervised

AI systems get regular performance reviews, just like people do in their first year. Owners look at output quality, error patterns, and scope creep on a set schedule. Access is reviewed and pruned. Incidents are logged and, more importantly, change the rules. Signals you’re here: There is a standing cross-functional forum (not a one-time committee) that reviews AI performance and policy together. Review findings regularly lead to role or access changes. Teams treat the review as useful rather than as paperwork. The move to Stage 5: Connect review results to autonomy decisions. If a system has performed reliably for two quarters, what does it earn? If it has not, what does it lose?

Stage 5: Earned Autonomy

Governance has become the thing that lets the organization move faster. Low-risk systems with a strong track record get more scope and lighter review. High-risk systems keep a human in the loop. Autonomy is something a system earns through evidence, the same way a strong performer earns a bigger role. Signals you’re here: Teams ask governance for help instead of avoiding it. Risk tiers drive review effort, so the fast path really is fast. Leaders can point to specific cases where an AI system was given more scope, and specific cases where scope was pulled back. Stage 5 is not a finish line. New models, new agents, and new regulations reset parts of the picture, which is why the learning dimension matters most.

How to Assess Your Organization’s AI Governance Maturity

A maturity assessment works best as a facilitated working session, not a survey filled out by one person in compliance. The goal is a shared, honest picture, and the most valuable output is often the disagreement between functions. This is where human AI collaboration gets real: the people closest to the work know where the AI actually is.

Step 1: Invite the right cross-functional group

Bring together 6 to 10 people: an executive sponsor, someone from IT or security, legal or compliance, two or three business owners whose teams use AI heavily, and whoever is acting as AI transformation lead. If people only hear about governance from one function, they will assume it belongs to that function.

Step 2: Score each dimension independently first

Have each participant silently score the five dimensions from 1 to 5 before any discussion. Silent scoring prevents the most senior voice in the room from anchoring everyone else, a technique borrowed from the same design thinking model facilitators use to separate idea generation from judgment.

Step 3: Reveal and discuss the gaps

Put the scores side by side. Where security scores access a 2 and a business owner scores it a 4, you have found something important. Spend most of the session on the largest gaps, not on the averages.

Step 4: Agree on one stage per dimension

Converge on a single stage for each dimension. Expect an uneven profile, such as Stage 3 for inventory and Stage 1 for learning. That shape tells you more than a single overall score would.

Step 5: Pick the next move, not the end state

Choose one or two moves that advance the weakest dimension by a single stage within 90 days. Assign an owner and a date. Then schedule the next assessment for one quarter out.

Common Pitfalls When Using an AI Governance Maturity Model

Treating the model as a scorecard. If teams are rewarded for higher scores, they will inflate them. The model is useful only if people are honest about where they are.

Jumping stages. Organizations at Stage 1 often try to build a Stage 5 system with risk tiers, automated monitoring, and a full council before they know what tools are in use. That effort usually stalls. Move one stage at a time.

Confusing a policy with maturity. Writing an acceptable use policy moves an organization from Stage 1 to Stage 2 at most. It does not create owners, scoped access, or reviews.

Governing tools instead of systems. “Is ChatGPT approved?” is a Stage 2 question. “What is this agent allowed to do, and who owns its output?” is a Stage 3 question. Agents are where the access and accountability risks are concentrated.

Leaving it to one function. When governance lives only in legal or security, it tends to become a brake. When it is shared, it tends to become an enabler.

Where Established Frameworks Fit

A maturity model complements, rather than replaces, the major frameworks. The NIST AI Risk Management Framework, released in January 2023, organizes AI risk work into four functions: Govern, Map, Measure, and Manage. ISO/IEC 42001, published in December 2023, specifies requirements for an AI management system that organizations can be certified against. Those frameworks describe what a mature system should contain. A maturity model tells you how far you are from it and what to do next. Many organizations use NIST or ISO 42001 as the target and a maturity assessment as the quarterly progress check. For the structures that sit underneath a Stage 4 or 5 organization, such as decision rights, intake paths, and standing forums, see our companion piece on building an enterprise AI governance operating model.

Frequently Asked Questions

What is an AI governance maturity model?

An AI governance maturity model is a staged framework that describes how an organization’s oversight of AI evolves, from unmanaged use to a system where every AI tool or agent has a defined role, scoped access, a named owner, and autonomy based on its track record. It is used to diagnose current state and choose the next improvement.

How many stages should an AI governance maturity model have?

Most models use four or five stages. Five stages, as in this model, give enough resolution to see real progress quarter over quarter without becoming so granular that teams argue about the difference between neighboring stages.

How often should we reassess AI governance maturity?

Quarterly is a good default. AI adoption moves fast enough that an annual assessment is out of date before the next one, and quarterly matches the review rhythm a Stage 4 organization should already be running.

Who should own the AI governance maturity assessment?

An executive sponsor should own the outcome, and an AI transformation leader or a neutral facilitator should run the session. Ownership by a single function such as legal or IT tends to skew the scores toward that function’s view.

Do we need an AI transformation consultant to run this?

Not necessarily. Any organization can run the five-step assessment above. An outside AI transformation consultant or facilitator is most useful when functions disagree sharply or when the most senior people in the room would otherwise dominate the scoring.

Find Your Gaps and Pick Your Next Move

An AI governance maturity model is only as useful as the conversation it starts. The point is not to reach Stage 5 on paper. It is to get the right people in a room, agree honestly on where you stand, and leave with one concrete move and an owner. Voltage Control helps leadership teams run exactly these working sessions as part of our AI transformation program, designing the human AI collaboration practices that let governance speed adoption instead of slowing it. If you want help assessing where your organization stands, book a free intro call with our facilitation team.