AI and Intelligent Automation Assessment

AI Governance Maturity Assessment

Evaluates AI governance maturity across the mandate and policy, context and regulatory obligations, resources and culture, risk and impact management, data governance, model development and generative AI evaluation, fairness and transparency, security and release readiness, operations and oversight, agentic AI, third-party and general-purpose AI, and assurance, aligned with ISO/IEC 42001, NIST AI RMF and the EU AI Act as amended in 2026.

Already have an account? Log in to start

At a glance

Questions: 91
Domains: 12
Working time: Initial assessment: 7-9 hours of facilitated sessions with AI governance, data science, agent platform, security, legal and business owners. Evidence gathering: 2-3 weeks. Reassessment: 3-4 hours.
Repeat: Every six months while AI adoption, agents or regulation are changing quickly; annually once the governance system is stable, and after any major new AI regulation, significant AI incident or new agent platform.
Roles: 6
Updated: October 2026

Who it is for

Executive Leadership
AI Governance and Risk
Data and Model Engineering
Legal, Privacy and Compliance
Security and Operations
Process Owner/Full Model Assessor

Chief AI Officer / CIO / CISO / Chief Risk Officer / Chief Data Officer / General Counsel. Secondary: AI governance office, data science and ML engineering leads, agent platform owners, data protection officer, procurement, internal audit.

What you will gain

Shows whether AI governance controls operate across the full AI lifecycle, including agents, rather than existing on paper. Identifies where accountability, risk assessment, data and model controls, oversight, agent containment and assurance break down, and gives each gap a concrete next step. Supports readiness for ISO/IEC 42001 certification and EU AI Act obligations on the 2026 amended timetable.

About this assessment

Organizations now use AI to make or shape decisions about credit, hiring, healthcare, pricing and public services, often through models they did not build, and increasingly through agents that act on their own. Many have an AI policy or principles but cannot show which AI systems and agents they run, which are high risk, who approved each one, or whether anyone would notice if a model started to fail, discriminate or act beyond its authority.

This assessment looks at the whole governance system. It starts with the board mandate, policy, principles and roles, then establishes context, stakeholders, legal obligations, the AI inventory, shadow AI discovery and scope, and the resources and culture governance needs. It tests risk and impact assessment, data governance including rights to data and outputs, model development and generative AI evaluation, fairness, transparency and synthetic content marking, security and release readiness, and operations through to retirement. A dedicated domain covers agentic AI: autonomy tiers, agent identity and permissions, connector vetting, memory and context integrity, and containment. It closes with third-party and general-purpose AI obligations, and with assurance: audit, management review, portfolio value and cost review, and external certification.

AI cost depth sits in the AI Spend Management Maturity Assessment and data egress through AI tools and agents in Data Loss Prevention Operations; this model governs the decisions and controls around them.

Each question is scored on three dimensions: Documented, Implemented and Effective, exposing policies nobody applies, controls that depend on one person, and practices that run but are never measured.

What we assess: 12 domains

Each domain is a group of related questions, scored on its own and rolled up into your overall result.

01 · 8 questions

1 AI Governance Mandate and Policy

Board mandate, policy and principles, acceptable use, roles and decision rights, framework, document control and executive sponsorship

02 · 9 questions

2 AI Context, Scope and Obligations

Context, stakeholders, regulatory obligations, AI system inventory, shadow AI discovery, scope, strategic alignment, objectives and sustainability

03 · 5 questions

3 AI Governance Resources, Competency and Culture

Resources, competency, communication, awareness and responsible AI culture

04 · 7 questions

4 AI Risk and Impact Management

Risk methodology, identification, assessment, impact assessment, control selection, residual risk and reassessment

05 · 9 questions

5 Data Governance for AI Systems

Data standard, catalog, lineage, labeling, synthetic data, privacy, lawful basis, retention and rights to data and AI outputs

06 · 6 questions

6 AI Model Development and Testing

Development standard, training and validation, registry, pre-release testing, technical debt and generative AI output evaluation

07 · 8 questions

7 Fairness, Transparency and Explainability

Fairness standard, subgroup testing, mitigation validation, explainability, disclosure, recourse, community engagement and synthetic content marking

08 · 8 questions

8 AI Security, Resilience and Release Readiness

Security standard, secure pipelines, component provenance, adversarial testing, fallback, incident response, emergency override and the deployment gate

09 · 10 questions

9 AI Operations and Human Oversight

Operating procedures, governance in business processes, oversight, operator training, change control, monitoring, drift, fairness monitoring, logging and retirement

10 · 5 questions

10 Agentic AI Governance

Agent registry and autonomy tiers, agent identity and tool permissions, connector and agent-to-agent vetting, memory and context integrity, and action monitoring and containment

11 · 6 questions

11 Third-Party AI and Regulatory Compliance

Supplier due diligence, contract clauses, control equivalence, downstream information, conformity and reporting, and general-purpose AI model obligations

12 · 10 questions

12 Assurance, Review and Improvement

Monitoring plan, effectiveness, internal audit, management review, nonconformity, corrective action, lessons, framework change, portfolio value and cost review, and external assurance

KPIs to track

Measures that show whether the improvements hold.

KPI
AI Inventory Coverage - Share of AI systems and agents found in discovery that are already in the inventory. Target: 100%.
Impact Assessment Before Go-Live - Share of high-risk AI systems with a completed impact assessment before deployment. Target: 100%.
Deployment Gate Compliance - Share of AI deployments that passed the full pre-deployment gate before go-live. Target: 100%.
Tiered Agents - Share of production agents with an owner and an approved autonomy tier. Target: 100%.
Governance Action Closure - Share of governance actions closed by their due date. Target: 85%.

Framework alignment

Questions are written in plain language and mapped to:

ISO/IEC 42001:2023
NIST AI RMF 1.0
NIST AI 600-1
EU AI Act
ISO/IEC 23894:2023
ISO/IEC 42005:2025
ISO/IEC 42006:2025
ISO/IEC 5338:2023
ISO/IEC TR 24027:2021
ISO/IEC 27001:2022
ISO/IEC 27701
ISO 22301:2019
ISO 19011:2026
GDPR
COBIT 2019
OECD AI Principles
IEEE 7000-2021
MITRE ATLAS
OWASP Top 10 for LLM Applications 2025
OWASP Top 10 for Agentic Applications 2026

Works best with

Practices this assessment relies on. Assessing them too gives a fuller picture.

Technology Governance and Strategy (v10.9.6): sets the enterprise governance structures and decision forums that the AI mandate and framework extend.

Master Data and Data Quality Management: provides the data ownership and quality foundations the AI data governance questions rely on.

Security Operations Center, Cyber and Incident Response: provides the detection and incident capability behind AI security, agent containment and emergency override.

AI Pipeline and MLOps (v11.9.6): owns the AI Model Registry and assesses the engineering depth behind registry, pipelines, monitoring and drift (bridges 6.2, 6.3, 6.4, 6.5, 6.6, 8.2, 8.3, 9.6, 9.7); this model governs those practices. Metadata, Catalog and Lineage (v1.9.6) owns lineage to AI models (bridge 5.3).

AI Spend Management (v12.9.6): supplies AI cost and return through its AI Product Portfolio, used in the portfolio value and cost review (12.9).

Data Loss Prevention Operations (v8.9.6): covers data egress through AI tools and agents; this model governs agent authority, identity and context (Domain 10).

Recommended: Run AI Use Case Lifecycle Management alongside this assessment to cover intake, prioritization and value tracking of individual AI use cases.