1. Unaware
AI is in use across the business, in your tools and your suppliers' tools, and nobody has written down where. Most businesses start here without knowing it.
AI maturity: where you actually are
Most models score your tools. This one scores who owns the risk.
The five levels of AI governance maturity, what separates them, and four questions to place your own business. Free, no form.
TL;DR
- Most AI maturity models measure data, infrastructure, skills and model management. They do not tell a board whether anyone owns what AI is doing to the plan.
- This page scores governance maturity in five levels, from unaware to steering.
- Four yes-or-no questions place your business on the scale.
- EY found 98% of large US companies have formal AI governance policies and 47% have set them aside for an urgent deployment. A policy is level two, not level five.
What is AI maturity?
AI maturity is how far a business has got with AI, measured against a set of levels. The best-known models measure capability: MITRE's AI Maturity Model runs from Initial to Optimized across six pillars, including data, technology and strategy. Those models answer "how good are we at using AI". This page answers a different question: how well does the business govern what AI is doing to it, whoever's AI it is. That is the maturity a board can change this quarter.
The five levels of AI governance maturity
2. Aware
A policy exists and people have signed it. Nobody checks what happens next. EY found 98% of large companies at this level or above, and 47% had set the policy aside when a deployment was urgent.
3. Owned
Each risk AI is driving sits on the register with a named owner and a safeguard. Objectives, not tools, decide what is on the list.
4. Reviewed
Scores are re-checked on a set cadence and incidents change them. The register moves when the world does.
5. Steering
The board decides where to lead, lag or exit, objective by objective, from the register's evidence. AI sits on the strategy agenda, not only the IT one.
Place yourself
Four questions, one level
Four questions, yes or no. Count the yes answers and add one: that is your level.
- Have you written down where AI is in use, in your own tools and your critical suppliers' tools, and is there a signed policy?
- Does every risk AI is driving on the register have a named owner and a safeguard?
- Are those scores re-checked on a fixed cadence, with incidents feeding back?
- Has the board decided, per objective, where to lead, lag or exit?
Most businesses that have "done AI governance" land on two. That is normal, and it can move in a quarter.
The gap
Why most maturity models measure the wrong thing
Capability models score data, infrastructure, skills and model management. They say nothing about the AI you did not deploy: the models inside your suppliers' products, the tools your people use without asking, the AI a competitor points at your customers.
PwC's January 2026 CEO survey found the companies seeing both cost and revenue gains from AI were two to three times more likely to have embedded it across the business, and that foundations, including responsible AI frameworks, matter as much as scale. Governance is the foundation the capability models leave out.
Two different questions
Maturity is not readiness
AI readiness assessments measure whether the business could adopt AI: data quality, infrastructure, talent, budget. That is a different question from whether it governs AI well. A business can be ready and ungoverned, or well governed with modest tooling.
Readiness is a technology programme and takes years. Governance maturity is a set of decisions and can move two levels in a quarter. Start with the one you control.
FAQs
AI maturity FAQs
What is an AI maturity model?
A set of levels describing how far a business has got with AI. Capability models such as MITRE's measure data, technology and skills. Governance maturity, the scale on this page, measures whether anyone owns what AI is doing to the business.
What are the levels of AI maturity?
On this page: unaware, aware, owned, reviewed, steering. MITRE's capability model uses Initial, Adopted, Defined, Managed and Optimized.
How do we assess our AI maturity?
Answer the four questions above and add one. For the register that levels three and four depend on, how to run an AI risk assessment has the method.
Is AI maturity the same as AI readiness?
No. Readiness asks whether you could adopt AI. Maturity, as used here, asks how well you govern the AI already acting on your business.
Why does having a policy not make us mature?
A policy describes intent. EY found 98% of large US companies had formal AI governance policies and 47% had set theirs aside for an urgent deployment. Level three starts when each risk has an owner.
The risks AI is driving under each objective, scored, with a safeguard drafted for each. Free.
See where AI is already acting on your plan
AI strategy and AI risk
Explore related topics
An AI strategy that starts from your objectives
The series hub: five steps, a one-page template, and one decision per objective.
AI governance, in plain English
Who owns AI decisions and how they are checked.
The AI policy your business actually needs
The full template, free on the page.
How to run an AI risk assessment
The five steps and what a complete entry needs.
The AI risk register
What every entry carries, with worked examples.
The real risks of AI for a business
The AI risk series hub.
ISO 42001 compliance explained
The AI management system standard, in plain terms.
