AI Governance Maturity Assessment
A 91-question diagnostic across 12 domains that follows AI governance from the board mandate and AI policy through context and obligations, people and culture, risk and impact, data, model development, fairness, security...
Overview
A 91-question diagnostic across 12 domains that follows AI governance from the board mandate and AI policy through context and obligations, people and culture, risk and impact, data, model development, fairness, security and release readiness, operations, agentic AI, third parties and assurance. Written for the Chief AI Officer or AI governance lead who needs to answer: is our AI, including the agents acting for us, controlled, accountable and lawful across its whole lifecycle?
Detailed Description
Organizations now use AI to make or shape decisions about credit, hiring, healthcare, pricing and public services, often through models they did not build, and increasingly through agents that act on their own. Many have an AI policy or principles but cannot show which AI systems and agents they run, which are high risk, who approved each one, or whether anyone would notice if a model started to fail, discriminate or act beyond its authority.
This assessment looks at the whole governance system. It starts with the board mandate, policy, principles and roles, then establishes context, stakeholders, legal obligations, the AI inventory, shadow AI discovery and scope, and the resources and culture governance needs. It tests risk and impact assessment, data governance including rights to data and outputs, model development and generative AI evaluation, fairness, transparency and synthetic content marking, security and release readiness, and operations through to retirement. A dedicated domain covers agentic AI: autonomy tiers, agent identity and permissions, connector vetting, memory and context integrity, and containment. It closes with third-party and general-purpose AI obligations, and with assurance: audit, management review, portfolio value and cost review, and external certification.
AI cost depth sits in the AI Spend Management Maturity Assessment and data egress through AI tools and agents in Data Loss Prevention Operations; this model governs the decisions and controls around them.
Each question is scored on three dimensions: Documented, Implemented and Effective, exposing policies nobody applies, controls that depend on one person, and practices that run but are never measured.
Assessment Details
Audience
Chief AI Officer / CIO / CISO / Chief Risk Officer / Chief Data Officer / General Counsel. Secondary: AI governance office, data science and ML engineering leads, agent platform owners, data protection officer, procurement, internal audit.
Purpose
Shows whether AI governance controls operate across the full AI lifecycle, including agents, rather than existing on paper. Identifies where accountability, risk assessment, data and model controls, oversight, agent containment and assurance break down, and gives each gap a concrete next step. Supports readiness for ISO/IEC 42001 certification and EU AI Act obligations on the 2026 amended timetable.
Effort
Initial assessment: 7-9 hours of facilitated sessions with AI governance, data science, agent platform, security, legal and business owners. Evidence gathering: 2-3 weeks. Reassessment: 3-4 hours.
Cadence
Every six months while AI adoption, agents or regulation are changing quickly; annually once the governance system is stable, and after any major new AI regulation, significant AI incident or new agent platform.
Framework Alignment
KPIs
- AI Inventory Coverage - Share of AI systems and agents found in discovery that are already in the inventory. Target: 100%.
- Impact Assessment Before Go-Live - Share of high-risk AI systems with a completed impact assessment before deployment. Target: 100%.
- Deployment Gate Compliance - Share of AI deployments that passed the full pre-deployment gate before go-live. Target: 100%.
- Tiered Agents - Share of production agents with an owner and an approved autonomy tier. Target: 100%.
- Governance Action Closure - Share of governance actions closed by their due date. Target: 85%.
Dependencies
Assessment Outline
(12 domains · 91 questions)-
1
1 AI Governance Mandate and Policy
Board mandate, policy and principles, acceptable use, roles and decision rights, framework, document control and executive sponsorship
- 1.1 Board AI Mandate and Vision 1 questions
- 1.2 AI Policy 1 questions
- 1.3 Responsible AI Principles 1 questions
- 1.4 AI Acceptable Use 1 questions
- 1.5 AI Roles and Decision Rights 1 questions
- 1.6 AI Governance Framework 1 questions
- 1.7 Governance Document and Record Control 1 questions
- 1.8 Executive Sponsorship 1 questions
-
2
2 AI Context, Scope and Obligations
Context, stakeholders, regulatory obligations, AI system inventory, shadow AI discovery, scope, strategic alignment, objectives and sustainability
- 2.1 AI Context Analysis 1 questions
- 2.2 Stakeholder Needs 1 questions
- 2.3 AI Regulatory Obligations Register 1 questions
- 2.4 AI System Inventory 1 questions
- 2.5 Shadow AI Discovery 1 questions
- 2.6 AI Governance Scope 1 questions
- 2.7 AI Strategic Alignment 1 questions
- 2.8 AI Governance Objectives 1 questions
- 2.9 AI Environmental Sustainability 1 questions
-
3
3 AI Governance Resources, Competency and Culture
Resources, competency, communication, awareness and responsible AI culture
- 3.1 Governance Resources and Funding 1 questions
- 3.2 AI Competency Framework 1 questions
- 3.3 AI Governance Communication 1 questions
- 3.4 Staff AI Awareness 1 questions
- 3.5 Responsible AI Culture 1 questions
-
4
4 AI Risk and Impact Management
Risk methodology, identification, assessment, impact assessment, control selection, residual risk and reassessment
- 4.1 AI Risk Methodology and Criteria 1 questions
- 4.2 AI Risk and Opportunity Identification 1 questions
- 4.3 AI Risk Assessment 1 questions
- 4.4 AI System Impact Assessment 1 questions
- 4.5 AI Control Selection 1 questions
- 4.6 Residual Risk Acceptance 1 questions
- 4.7 Risk and Impact Reassessment 1 questions
-
5
5 Data Governance for AI Systems
Data standard, catalog, lineage, labeling, synthetic data, privacy, lawful basis, retention and rights to data and AI outputs
- 5.1 AI Data Governance Standard 1 questions
- 5.2 AI Dataset Catalog 1 questions
- 5.3 AI Data Lineage (Bridge) 1 questions
- 5.4 Data Labeling Quality 1 questions
- 5.5 Synthetic and Augmented Data 1 questions
- 5.6 Privacy by Design for AI 1 questions
- 5.7 Lawful Basis for AI Data Use 1 questions
- 5.8 AI Data Retention and Deletion 1 questions
- 5.9 Rights to Data and AI Outputs 1 questions
-
6
6 AI Model Development and Testing
Development standard, training and validation, registry, pre-release testing, technical debt and generative AI output evaluation
- 6.1 AI Model Development Standard 1 questions
- 6.2 Validation Requirements (Bridge) 1 questions
- 6.3 Governed Model Registry (Bridge) 1 questions
- 6.4 Pre-Release Testing Requirements (Bridge) 1 questions
- 6.5 AI Technical Debt Oversight (Bridge) 1 questions
- 6.6 Generative AI Evaluation Requirements (Bridge) 1 questions
-
7
7 Fairness, Transparency and Explainability
Fairness standard, subgroup testing, mitigation validation, explainability, disclosure, recourse, community engagement and synthetic content marking
- 7.1 AI Fairness and Bias Standard 1 questions
- 7.2 Representative Subgroup Testing 1 questions
- 7.3 Bias Mitigation Validation 1 questions
- 7.4 Explainability 1 questions
- 7.5 AI Disclosure 1 questions
- 7.6 Recourse and Human Review 1 questions
- 7.7 Affected Community Engagement 1 questions
- 7.8 Synthetic Content Marking 1 questions
-
8
8 AI Security, Resilience and Release Readiness
Security standard, secure pipelines, component provenance, adversarial testing, fallback, incident response, emergency override and the deployment gate
- 8.1 AI Security Standard and Threat Models 1 questions
- 8.2 Secure ML Pipeline Requirements (Bridge) 1 questions
- 8.3 Component Provenance Requirements (Bridge) 1 questions
- 8.4 Adversarial Testing 1 questions
- 8.5 Degradation and Fallback 1 questions
- 8.6 AI Incident Response 1 questions
- 8.7 Emergency Override 1 questions
- 8.8 Pre-Deployment Gate 1 questions
-
9
9 AI Operations and Human Oversight
Operating procedures, governance in business processes, oversight, operator training, change control, monitoring, drift, fairness monitoring, logging and retirement
- 9.1 AI Operating Procedures 1 questions
- 9.2 Governance in Business Processes 1 questions
- 9.3 Human Oversight Points 1 questions
- 9.4 AI Operator Training 1 questions
- 9.5 AI Change and Release Control 1 questions
- 9.6 Runtime Monitoring Requirements (Bridge) 1 questions
- 9.7 Drift Monitoring Requirements (Bridge) 1 questions
- 9.8 Production Fairness Monitoring 1 questions
- 9.9 AI Event Logs and Audit Trail 1 questions
- 9.10 AI System Retirement 1 questions
-
10
10 Agentic AI Governance
Agent registry and autonomy tiers, agent identity and tool permissions, connector and agent-to-agent vetting, memory and context integrity, and action monitoring and containment
- 10.1 AI Agent Registry and Autonomy Tiers 1 questions
- 10.2 Agent Identity and Tool Permissions (Bridge) 1 questions
- 10.3 Connector and Agent-to-Agent Vetting 1 questions
- 10.4 Agent Memory and Context Integrity 1 questions
- 10.5 Agent Action Monitoring and Containment 1 questions
-
11
11 Third-Party AI and Regulatory Compliance
Supplier due diligence, contract clauses, control equivalence, downstream information, conformity and reporting, and general-purpose AI model obligations
- 11.1 AI Supplier Due Diligence 1 questions
- 11.2 AI Contract Clauses 1 questions
- 11.3 Third-Party Control Equivalence 1 questions
- 11.4 Downstream Use Information 1 questions
- 11.5 Conformity and Regulatory Reporting 1 questions
- 11.6 General-Purpose AI Model Obligations 1 questions
-
12
12 Assurance, Review and Improvement
Monitoring plan, effectiveness, internal audit, management review, nonconformity, corrective action, lessons, framework change, portfolio value and cost review, and external assurance
- 12.1 Governance Monitoring Plan 1 questions
- 12.2 Governance Effectiveness Evaluation 1 questions
- 12.3 AI Governance Internal Audit 1 questions
- 12.4 Management Review 1 questions
- 12.5 Nonconformity and Root Cause 1 questions
- 12.6 Corrective Action Tracking 1 questions
- 12.7 Lessons Learned and Prevention 1 questions
- 12.8 Controlled Framework Change 1 questions
- 12.9 AI Portfolio Value and Cost Review 1 questions
- 12.10 External Assurance and Certification 1 questions
At a Glance
Still have questions? Get in touch
Business Bay, Dubai, UAE
ITSGovernance