AI governance maturity
Maturity models are usually flattering. This one is scored on artefacts that exist, not intentions, policies without owners, or programmes with a start date. Place yourself by what someone could pull up in ten minutes.
The five levels
| Level | What exists | |
|---|---|---|
| 0 | Unaware | Nobody can list the AI systems in use. AI arrives through features and expense claims. No owner. |
| 1 | Aware | Someone owns the question. A partial inventory exists. A policy exists, possibly unread. Nothing is classified. |
| 2 | Documented | Inventory is complete and dated. Systems are classified with reasoning recorded. Live obligations — Art. 50 disclosure, Art. 4 literacy record — are met. Someone is named for each system. |
| 3 | Operating | A management system runs: risk assessments per system, oversight defined with override authority, incident procedure rehearsed, monitoring producing findings, internal audit performed. Evidence is a by-product of operating rather than assembled. |
| 4 | Assured | Independent assurance held with a scope that covers what you actually sell. Post-market monitoring feeds documented risk-file updates. Suppliers assessed on the same basis. Customer questionnaires answered from standing artefacts in days. |
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
How to place yourself honestly
For each claim, ask whether someone could produce the artefact in ten minutes without preparing it. If not, you are at the level below.
| The claim | The test |
|---|---|
| “We have an AI inventory” | Show it. Check the last-reviewed date and whether the newest system is on it. |
| “Our systems are classified” | Show one assessment. Does it address profiling? Is it dated before market placement? |
| “We have human oversight” | Show the override rate. Show one override that changed an outcome. |
| “We monitor post-market” | Show a risk-file update triggered by a monitoring finding. |
| “We are compliant” | With which article, for which system, evidenced by what? |
Most organisations that describe themselves as Level 3 are at Level 2 with a plan. That is not a criticism — Level 2 by 2026 is reasonable. Describing it as Level 3 to a customer is the problem.
What moves you up a level
- 0 → 1: name an owner. That is the whole step.
- 1 → 2: complete the inventory, classify with reasoning, close the live obligations. Weeks, not quarters. Inventory →
- 2 → 3: a management system, because the difference is whether evidence is produced or assembled. This is where ISO/IEC 42001 earns its cost. What it covers →
- 3 → 4: certification with the right scope, plus supplier assessment on the same basis. Supplier programme →
Status labels on this page
Verified fact: Article references and dates cited above, checked against the consolidated Regulation.
Expert analysis: The tables, tiering and assessments on this page are our practice, not a standard.
Unsettled: Procurement practice is not codified and varies by buyer. Verify specific programme requirements against the buyer's own published materials.
Level 2 is reachable this quarter
Inventory, classification with reasoning, and the live obligations closed. It is weeks of work, it answers most of a customer questionnaire, and it is the honest floor for anyone selling into enterprise.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Frequently asked
What is AI governance maturity?
A description of how far an organisation has moved from ad hoc AI use to a governed, evidenced and independently assured position. A useful model is scored on artefacts that exist rather than on intentions: whether a complete dated inventory exists, whether systems are classified with recorded reasoning, whether live obligations are met, whether a management system produces evidence as a by-product of operating, and whether independent assurance is held with a scope covering what the organisation sells.
What level should an organisation be at in 2026?
For an organisation selling into enterprise, a complete inventory, classifications with recorded reasoning and the live obligations met, Article 50 disclosure and an Article 4 literacy record, is a reasonable position for 2026. The high-risk obligations apply from 2 December 2027, which makes an operating management system the target for organisations with Annex III exposure rather than a 2026 requirement.