TL;DR
An AI governance maturity model is a five-level scale that shows how reliably an enterprise controls its AI systems. The five levels are Ad Hoc, Defined, Operationalized, Measured and Optimized. Each level is scored across six domains, from accountability and AI inventory to third-party AI and agent oversight. Evidence moves you up a level, such as approval records, test results and logs. Policy documents alone keep you at Level 2. The model maps onto NIST AI RMF and ISO/IEC 42001, but it replaces neither one.
Key Takeaways AI governance maturity measures how consistently controls run, rather than how much AI you build. The five levels are Ad Hoc, Defined, Operationalized, Measured and Optimized, and each one has its own evidence standard. Six domains get scored separately: accountability and policy, inventory and risk tiering, lifecycle controls, monitoring and evidence, third-party AI and agent oversight. A few blocking gaps, such as an unregistered high-risk system, cap the rating no matter how strong other domains look. Level 5 is the wrong target for low-risk domains, so set a target level per domain from your risk exposure. NIST AI RMF and ISO/IEC 42001 say what good governance includes, while the maturity model shows how far you have put it into practice. Watch on YouTube
Rogue AI Explained: Real Incidents, Why Agents Go Rogue & the Controls That Stop Them
Kanerika walks through real AI incidents and the specific controls that would have stopped them, which is exactly the gap a maturity model is built to expose.
Why Writing More AI Policy Rarely Raises Your Maturity
Here is an unpopular opinion in AI governance circles. The fastest way to look mature is to write more policy, and the fastest way to stay stuck is the same move.
A long acceptable use policy, a committee charter and a risk taxonomy will lift almost any organization to Level 2. Then progress stops. After that, auditors, regulators and boards ask for something else, which is proof.
They want to know which systems went through review, who signed off, what the logs show and whether anyone tested the control last quarter. Only records can answer that, because a policy describes intent rather than activity.
Then there is a second unpopular opinion, that Level 5 is the wrong goal for many domains. A low-risk internal summarizer does not need the oversight you would give an agent that can move money, so the target should vary.
What Is an AI Governance Maturity Model?
An AI governance maturity model is a scale for judging how dependably an organization defines, runs, checks and improves the controls around its AI systems. It describes stages, such as the move from informal habits to measured and self-correcting practice. It also says what evidence belongs at each stage.
The model answers a narrow question. Given everything the enterprise builds, buys and lets agents do, how much of it is governed in a way someone could prove tomorrow?
Governance Maturity Is Different From AI Capability Maturity
A company can be advanced at building AI while it stays immature at governing it. Data science teams may ship dozens of models a quarter while nobody keeps a full list of what runs in production.
Capability models such as Kanerika’s enterprise AI maturity model track adoption, platforms and the path from pilot to production. Governance maturity instead tracks the controls that keep those systems accountable. Because the two often move at different speeds, incidents tend to grow in the gap between them.
The same split also applies to data. A data governance maturity model covers lineage, quality and stewardship for datasets. AI governance then adds model behavior, use-case risk and autonomous actions on top of that foundation.
AI Assessment
Check Your AI Maturity Before You Govern It
Kanerika’s AI Maturity Assessment scores your AI/ML foundations, generative AI and AI agent readiness, then returns personalized recommendations from Kanerika’s AI experts.
Take the AI Maturity Assessment → Maturity Is Not the Same as Compliance
Passing one legal requirement shows that a single control existed at a single moment. Maturity, on the other hand, asks whether the same control runs every time, across every business unit, and whether anyone would notice if it stopped.
So a maturity model and a regulation work as a pair. The regulation sets the floor, while the maturity model tells you how reliably you stand on it. Our guide to AI compliance covers the regulatory side, while an AI governance strategy decides how much maturity the business should fund.
Where the Five-Level Pattern Comes From
The five-step shape comes from software process improvement. CMMI maturity levels 1 to 5 run from Initial through Managed, Defined and Quantitatively Managed to Optimizing. Four of the five top-ranking guides we reviewed for this keyword still reuse that five-level arc.
Level names vary from vendor to vendor. What matters is the jump in evidence between levels, so this model names each level after what an auditor can actually see.
The Five Levels of AI Governance Maturity at a Glance
The table below is the short version of the scale. Each row adds one thing the previous level lacked. The evidence column is the one that settles arguments about where you stand.
Table 1: The Five Levels of AI Governance Maturity
Level Name What It Looks Like Evidence an Auditor Accepts
1 Ad Hoc Each team governs AI its own way, if at all Scattered emails, partial lists, personal memory 2 Defined Policy, roles, risk tiers and templates exist on paper Signed policy, committee charter, register template, tier definitions 3 Operationalized Controls run on real systems in every business unit Completed reviews, approvals, change records, access logs 4 Measured Control performance gets tested and reported Test results, reconciliation reports, exception trends, management reviews 5 Optimized Governance updates itself when risk changes Risk-triggered policy updates, verified fixes, reassessment after change
Read the rows as a ladder of proof. Level 2 proves intent, Level 3 proves activity, Level 4 proves effectiveness and Level 5 proves the program can learn.
Higher Maturity Does Not Mean More Bureaucracy
A common fear is that each level adds more forms. In practice the opposite tends to happen, because a measured program knows which controls matter and can drop the rest.
Risk tiering makes that possible. For instance, a Level 4 organization sends a low-risk internal tool through a light review in days. It then saves the heavy review for systems that touch customers, money or health decisions.
Level 5 Is the Wrong Target for Some Domains
The right target depends on exposure. For example, a bank running credit models and payment agents should aim for Level 4 or 5 in lifecycle controls and agent oversight. By comparison, a firm that only uses a few copilots may be well served at Level 3 everywhere.
Set a target per domain, then spend where the gap between target and reality is widest. Climbing for the sake of a higher number wastes money and governance attention.
The Six Domains an AI Governance Maturity Model Scores
A single enterprise-wide level hides more than it shows. This model scores six domains separately, because each one fails in its own way and each one has different owners.
Accountability and Policy
This domain covers who decides. It includes the AI policy, decision rights, the governance committee, risk appetite and the exception process. It also names the executive who answers when something goes wrong.
The AI governance framework guide shows how these pieces fit together, while responsible AI principles usually supply the values the policy encodes.
AI Inventory and Risk Tiering
You cannot govern a system you do not know about. NIST makes this explicit in GOVERN 1.6 of the AI RMF Core , which calls for mechanisms to inventory AI systems, resourced according to risk priorities.
The inventory has to include embedded vendor AI and tools employees adopt on their own, since those rarely appear in procurement records. The shadow AI problem lives here. So does the tiering logic that decides how much scrutiny each system gets.
Lifecycle Controls
Lifecycle controls are the gates a system passes on its way to production and after it. They cover impact assessment, validation, release approval, change control, periodic reassessment and retirement. AI agent lifecycle management also extends the same gates to agents.
Monitoring and Evidence
This domain asks whether governance leaves a trail. Production monitoring, incident tickets, audit logs, control tests and retained records all belong here. The platforms in our roundup of AI observability tools supply much of the raw signal, even though they rarely capture approvals.
Third-Party AI
A growing share of enterprise AI arrives from outside, through models, APIs and SaaS features that switch on with a vendor update. NIST GOVERN 6.1 and 6.2 ask for policies covering third-party AI risk. They also ask for contingency plans when high-risk third-party systems fail.
Agent Oversight
Agents add a domain older models never needed. Once software can call tools, write records and trigger payments, governance must control what it may do. It must also decide when a human approves and how every action gets logged.
The EU AI Act sets the principle for high-risk systems in Article 14 , which requires that natural persons can effectively oversee them while in use. Our agentic AI governance guide goes deeper on permissions and approval gates.
Level 1: Ad Hoc Governance and Invisible AI
At Level 1, governance happens when someone remembers to do it. A product team might run a bias check because one engineer cares, while the team next door ships with no review at all.
Nobody holds a full list of the AI in use. Procurement records show some vendor tools, while a spreadsheet in IT lists a few models. The copilots staff installed on their own, however, appear nowhere.
An auditor at this level finds approval emails instead of approval records. Incidents live in chat threads, and agents connect to business systems with a developer’s own credentials. In short, every answer depends on who you ask.
The way out starts with visibility. Find the AI you already run before you write rules for it, because Level 1 risk hides in systems nobody registered. Our breakdown of rogue AI incidents shows how quickly an unwatched agent can turn into a headline.
Level 2: Defined Governance on Paper
Level 2 is where many programs land after their first serious push. There is an approved AI policy, a governance committee with a charter, a set of risk tiers and a template for registering new systems.
This is real progress. Writing things down forces decisions about who owns what, which uses are off limits and what high risk means for this particular business.
Paper looks like control, and that is the trap. For instance, the register template exists, yet half the production systems never made it in. Similarly, a release checklist exists, yet nobody can show a completed one for last month’s launch.
At Level 2 an auditor accepts signed policies, role descriptions, process maps and vendor questionnaires as design evidence. But ask for operating evidence, and the answer is that it is coming soon. The AI governance best practices guide lists what a complete design set includes.
Level 3: Operationalized Governance With Records
Level 3 begins when controls run on real systems and leave records behind. Every production AI system appears in the register with an owner and a risk tier. Whenever a system changes, it triggers a fresh review.
Checklist
AI Governance Checklist
Confirm your policy, roles, risk tiers and review gates are complete before you start chasing Level 3 records.
Get the Checklist → Teams use the lifecycle gates instead of just documenting them. Impact assessments, validation reports and release approvals exist for each system in scope, and their dates fall before go-live rather than after it.
Guardrails also move from slides into the runtime. Prompt filters, output checks and routing rules in an LLM gateway enforce policy on every call. The AI guardrails they apply get versioned like code, so every change has a history.
For agents, Level 3 means scoped and enforced tool permissions. Approval gates block sensitive actions, and each agent has its own identity and action history. Third-party AI goes through an AI-specific supplier review inside procurement, so a new vendor model cannot slip in through a renewal.
The auditor’s view changes completely here. Instead of reading policies, they sample systems and ask to see the trail for each one, and the trail exists.
Level 4: Measured Governance That Proves Control Works
Controls run at Level 3. Level 4 shows that they work, which is a harder claim and the one boards and regulators eventually want to see.
Measurement starts with reconciliation. Teams compare the register against cloud bills, network logs, SaaS admin consoles and procurement data. After that, every unregistered system they find becomes a tracked finding.
Then someone tests the controls on a schedule. Did the release gate actually stop the model that failed validation? Did the agent approval gate fire on every high-value action, or did some actions bypass it?
NIST builds this self-check into the framework. MEASURE 2.13 asks organizations to evaluate and document how well their own test, evaluation, verification and validation (TEVV) metrics work. In other words, at Level 4 governance measures its own instruments.
Evidence here looks like dashboards, control test results, exception trends and overdue reassessment counts. It also includes minutes that show leaders acted on those numbers. An AI auditing framework makes that independent review routine instead of a yearly scramble.
Datasheet
Elevate Data Governance, Compliance and Security
See how Kanerika approaches data governance, compliance and security, the layer that supplies much of the evidence for Level 4 governance.
Download the Datasheet → Level 5: Optimized Governance That Adapts to Risk
Level 5 governance changes itself. When an incident, a new regulation, a model upgrade or a supplier change alters the risk, the relevant controls update on a trigger. They do not wait for the annual policy review.
Two signs separate real Level 5 from a slide that claims it. First, policy changes trace back to specific evidence, such as a root-cause finding or a result from LLM red teaming . Second, the organization can show the fix reduced repeat failures, which proves more than the fact that it shipped.
Agent oversight at Level 5 adjusts as agents gain tools or authority. A new permission triggers a reassessment and a containment test before it goes live.
Level 5 is also unstable. A new class of AI, an acquisition or a major regulatory change can push a domain back down a level. For that reason, every rating needs a refresh date.
The AI Governance Maturity Evidence Matrix
This matrix is the working core of the model. Each cell names one artifact an auditor could ask to see. So a team can place itself by asking whether that artifact exists today, for every system in scope.
Table 2: AI Governance Maturity Evidence Matrix by Domain and Level
Domain 1 Ad Hoc 2 Defined 3 Operationalized 4 Measured 5 Optimized
Accountability and Policy Decisions made in email Signed AI policy and charter Recorded committee decisions and exceptions Exception and overdue-action trends reviewed Policy changes traced to incidents and reviews AI Inventory and Risk Tiering Partial lists per team Register template and tier rules Every production system registered with owner and tier Reconciliation finds and closes unregistered AI New AI detected and tiered on a trigger Lifecycle Controls Team-by-team testing Written gate requirements Dated assessments and approvals per system Gate effectiveness tested, failures tracked Gate depth adjusts to system risk and change Monitoring and Evidence Incidents handled in chat Logging and retention standards System-linked logs and incident tickets Control test results and evidence completeness Root-cause fixes proven to cut repeats Third-Party AI Generic security questionnaire AI-specific vendor requirements AI supplier reviews inside procurement Ongoing supplier monitoring and findings Provider changes trigger impact review Agent Oversight Agents on personal credentials Autonomy and approval policy Scoped permissions, agent identity, action logs Bypass attempts and override rates reviewed Permissions reassessed when tools change
Read the matrix row by row and resist adding it up. In effect, a domain sits at the highest level where the artifact exists for every in-scope system, including the unglamorous ones far from the flagship project.
Kanerika Service
AI Governance Consulting Services
Kanerika builds the controls and evidence trails that move each row of this matrix up a level, from inventory to agent oversight.
Explore AI Governance Services Exit Criteria for Moving Up Each Level
Each step up has a clear test. The question is always whether the next level’s evidence exists across the whole scope, rather than in one pilot.
Table 3: Exit Criteria Between AI Governance Maturity Levels
Transition What Has to Change Evidence That Proves It
Level 1 to Level 2 Decide and document Approved policy, named owners, tier definitions, register template, gate requirements for all six domains Level 2 to Level 3 Run the controls Completed approvals, a populated register, enforced agent permissions, AI supplier reviews on file Level 3 to Level 4 Test the controls Scheduled control tests, inventory reconciliation, exception tracking, management review minutes Level 4 to Level 5 Adapt the controls Risk-triggered updates, verified fixes, reassessment after model, tool or vendor changes
The hardest jump is usually Level 2 to Level 3, because it moves governance from the policy team to the delivery teams. That is also the step where executive sponsorship matters most.
Blocking Gaps That Cap Your Rating
Some gaps cap the rating no matter how strong other domains are. A program cannot honestly claim Level 3 overall while any of these remain open.
Any high-risk AI system missing from the inventory, even if it is a vendor feature. A production system with no accountable owner. An agent with write access to business systems and no approval gate. No incident response path for AI failures. A critical vendor model with no contingency plan for when it fails. Strength elsewhere cannot offset these gaps, because each one is a direct route to harm that no other control catches. In practice, the honest overall rating is the level of the domain that holds the gap. Report the weakest critical domain next to any average you publish.
How the AI Governance Maturity Model Maps to NIST AI RMF and ISO/IEC 42001
Neither NIST nor ISO defines these five levels. Instead, the model measures how far an organization has gone in putting their requirements into daily practice.
The NIST AI Risk Management Framework , released on January 26, 2023, organizes outcomes into four functions, Govern, Map, Measure and Manage. NIST later added a Generative AI Profile, NIST-AI-600-1, on July 26, 2024. Its AI RMF Playbook offers suggested actions per subcategory and says it is neither a checklist nor a set of steps to follow in full.
ISO/IEC 42001:2023 takes a management-system approach instead. Its clauses 4 to 10 run from organizational context and leadership through planning, support, operation, performance evaluation and improvement. The Annex A control groups run from A.2, AI policies, to A.10, third-party and customer relationships.
Table 4: How the Six Domains Map to NIST AI RMF and ISO/IEC 42001
Governance Domain NIST AI RMF ISO/IEC 42001
Accountability and Policy Govern (GOVERN 1 policies, GOVERN 2 accountability) Clauses 5 and 6; Annex A.2, A.3 AI Inventory and Risk Tiering Govern (GOVERN 1.6 inventory), Map Clause 6; Annex A.4, A.5 Lifecycle Controls Map, Measure, Manage Clause 8; Annex A.6, A.7 Monitoring and Evidence Measure (MEASURE 2.13), Manage (MANAGE 4.1) Clauses 9 and 10 Third-Party AI Govern (GOVERN 6.1, 6.2) Annex A.10 Agent Oversight Govern, Manage Annex A.9 (use of AI systems)
Treat the mapping as indicative. It shows where to look in each standard rather than claiming an equivalence, and the exact ISO requirements still need their own gap review.
What the Model Adds Beyond NIST AI RMF
NIST describes what good outcomes look like. The maturity model then adds how consistently those outcomes happen, which is the question a board asks after reading a NIST gap analysis. Our NIST AI RMF Playbook guide turns the subcategories into concrete actions.
Why High Maturity Is Not ISO/IEC 42001 Certification
Certification comes from a formal audit by an independent certification body against the standard’s requirements. A Level 4 rating from an internal review can make that audit far easier. It is still a different kind of assurance.
Many teams use the model as a readiness gauge before they engage an auditor. The ISO 42001 certification guide covers that path step by step.
Reading an Uneven Maturity Profile
Real profiles are lumpy. For instance, a bank with years of model risk management might sit at Level 4 in lifecycle controls. Its agent oversight could still sit at Level 1, because agents arrived through a different team.
That lopsided shape is normal, and it is also where the risk concentrates. An average of 3.0 across six domains would hide an agent with payment access and no approval gate.
Plot the six domains as a heat map and read the coldest cell first. Then compare each domain against the target the business set, rather than against Level 5.
A Worked Example Across All Six Domains
Picture a mid-size insurer, used here purely as an illustration. Its policy and committee are solid, so accountability sits at Level 3. Lifecycle controls reach Level 4 because the insurer inherited a model validation team from its actuarial work.
The inventory is weaker. Claims staff use two SaaS tools with built-in AI that nobody registered. As a result, inventory sits at Level 2, and third-party AI sits at Level 2 as well. Monitoring, meanwhile, reaches Level 3 for in-house models but has nothing for vendor features. Under the every-system rule, it rates Level 2 until vendor AI is covered.
Then there is the claims triage agent a business unit launched last spring. It can update claim records, yet it has no approval gate on payouts. Agent oversight is Level 1, and that single cell sets the insurer’s real exposure.
The fix order follows the blocking gaps. Put an approval gate on the agent first, register the SaaS tools second, then extend monitoring to vendor AI. Only after that does it make sense to push lifecycle controls toward Level 5.
Agent Oversight Often Lags Model Governance
Teams built classic model review for systems that predict. Agents act, so the controls that matter are tool permissions, approval points and action logs, and few model-risk teams owned those before. That is why an AI agent observability setup is usually the first gap to close.
Where Self-Assessment Fits
The model gives the scale, while an assessment applies it. Scoping, interviews, evidence sampling and scoring belong to the procedure in our AI governance assessment guide. For the adjacent question of whether a company is ready to adopt AI at all, see the AI readiness assessment walkthrough.
Common Mistakes That Inflate an AI Governance Maturity Rating
Ratings drift upward for predictable reasons. These five come up again and again when a self-reported level meets an outside reviewer.
Counting policies as proof. A published policy with no completed records behind it is Level 2, however polished the document looks.Confusing model monitoring with governance monitoring. Drift dashboards show that a model behaves. But they do not show that approvals, supplier checks and reviews happened.Leaving vendor AI out of scope. Embedded SaaS AI and API models can carry as much exposure as in-house models. Even so, they vanish from inventories built only from the data science team’s list.Assuming humans can intervene. A person who could step in is not an approval gate. Real oversight instead needs defined approval points, enforced limits and recorded decisions.Treating Level 5 as permanent. New AI types, suppliers and rules can outpace existing controls, so a rating without a review date ages fast.A related trap is scoring governance and security as one thing. An AI security assessment tests attack resistance, while maturity tests whether governance runs. Both also feed the wider AI governance, risk and compliance picture.
How Kanerika Helps Enterprises Climb the AI Governance Maturity Model
Kanerika’s AI governance consulting services surface governance gaps before they become audit findings and test controls on the highest-risk systems first. Applied to this model, that work runs in four steps.
Baseline. Build the AI inventory, including vendor and agent systems, and place each domain on the matrix using artifacts, with interviews only as support.Design. Set a target level per domain from the risk tiers, then write only the policies and gates those targets need.Operationalize. Wire controls into delivery pipelines, gateways and agent runtimes so records appear as a side effect of normal work.Measure. Add reconciliation, control tests and dashboards so leaders can see effectiveness, then set a refresh date for each rating.Data is where AI governance evidence often breaks first, because classification, lineage and access policy feed every AI control above them. Kanerika’s data governance services and data lineage work cover that layer.
A Bank That Automated Its Sensitive-Data Evidence
Take, for instance, a global bank with nearly 9,000 branches and 22,000 ATMs. Its data sat across SAP, Dynamics 365, Oracle, Netezza and a central lakehouse, under strict privacy rules. Kanerika used the Microsoft Purview Data Map and Purview policies to discover and classify sensitive data automatically.
The results were zero data breaches, 100% adherence to compliance regulations and a 72% improvement in data classification accuracy. This was a data governance project rather than an AI governance one. Still, it shows the shift the model asks for: sensitive-data classification moved from a manual, error-prone process to automated, auditable records. Every AI control above it can rely on those records.
Two pitfalls show up again and again. Programs over-invest in Level 2 documents and under-invest in inventory reconciliation. They also treat agents as a later problem until one is already in production.
Kanerika’s own delivery runs under ISO 27001, ISO 27701:2019, ISO 9001:2015 and SOC 2 Type II certifications, with CMMI Level 3 appraised processes. Those frameworks also shape how the team builds evidence trails for clients.
Case Study
Zero Breaches, 100% Compliance for a Bank with Purview
A global bank used Microsoft Purview with Kanerika to classify sensitive data automatically, improving classification accuracy by 72%.
Read the Case Study → Evidence Is the Only Honest Maturity Score
An AI governance maturity model is worth using only if it changes what you check. Five levels and six domains give the structure, while the evidence matrix tells you where you really stand. Climb where your risk is highest, accept Level 3 where exposure is low, and never let a policy document stand in for a record.
The test is simple. Could you prove, tomorrow, that each AI system you run is owned, reviewed, monitored and contained? The level you can prove is your level.
Frequently Asked Questions
What is an AI governance maturity model?
An AI governance maturity model is a scale that shows how reliably an organization defines, runs, tests and improves the controls around its AI systems. It usually has five levels, from ad hoc habits to optimized, risk-driven governance, and it ties each level to evidence an auditor could inspect, such as approval records, logs and control test results.
What are the five levels of AI governance maturity?
The five levels are Ad Hoc, Defined, Operationalized, Measured and Optimized. Ad Hoc means teams govern AI their own way. Defined means policy and roles exist on paper. Operationalized means controls run with records. Measured means controls get tested and reported. Optimized means governance updates itself when risk changes.
Which domains does an AI governance maturity model score?
This model scores six domains separately. They are accountability and policy, AI inventory and risk tiering, lifecycle controls, monitoring and evidence, third-party AI, and agent oversight. Scoring them one by one shows uneven strength, such as strong model validation sitting next to weak control over autonomous agents and vendor AI features.
What is the difference between Level 2 and Level 3 AI governance?
Level 2 means the design exists, such as a signed policy, a register template and written review gates. Level 3 means those controls actually run on production systems and leave records behind. An auditor at Level 3 can sample any system and find its owner, risk tier, dated approvals and an action history for agents.
What is the highest AI governance maturity level?
Level 5, Optimized, is the highest level in this model. Governance at Level 5 changes its own controls when incidents, regulations, model upgrades or supplier changes alter the risk, and it can prove that fixes reduced repeat failures. It is not the right target for every domain, because low-risk uses rarely justify the cost.
How does an AI governance maturity model relate to NIST AI RMF?
NIST AI RMF describes the outcomes good AI risk management should reach, organized into Govern, Map, Measure and Manage. A maturity model measures how consistently an organization achieves those outcomes. NIST does not define maturity levels, so the model works as a practical lens on top of the framework rather than a replacement for it.
Is ISO/IEC 42001 certification the same as high AI governance maturity?
No. ISO/IEC 42001 certification is a formal audit by an independent certification body against the standard’s management system requirements. A maturity rating is usually an internal or advisory judgment about how well controls run. A strong Level 4 profile can make certification easier, but the two give different kinds of assurance to stakeholders.
Can different parts of a company sit at different maturity levels?
Yes, and that is normal. A business unit with long-standing model risk management may reach Level 4 in lifecycle controls while a newer unit running AI agents sits at Level 1 for oversight. Report each domain separately, read the weakest critical domain first, and avoid a single average that hides real exposure.
How often should an organization reassess its AI governance maturity?
Reassess at least once a year, and also whenever something material changes, such as a new class of AI, a major vendor switch, an acquisition or a new regulation. Ratings age quickly because AI use spreads faster than controls. Give every domain rating a refresh date so nobody relies on an outdated score.
What blocks an organization from reaching Level 3 maturity?
Certain gaps cap the rating regardless of other strengths. These include an unregistered high-risk AI system, a production system with no accountable owner, an agent with write access and no approval gate, no incident response path for AI failures, and a critical vendor model without a contingency plan. Close those before claiming Level 3.
