AI Governance Maturity Model

An AI governance maturity model should describe what the organisation can demonstrate, where its capability is fragile and what evidence would support the next improvement. It should not turn the existence of policies or a software purchase into a claim that every AI use is controlled. The most useful result is a capability profile with specific gaps and actions.

The model in this guide is an original assessment aid for Saudi organisations establishing or improving governance. It uses four operating dimensions and five evidence states. It is not a validated benchmark, an official government score, an ISO certification method or a prediction of incident rates.

Use it to prioritise governance setup and to discuss progress with accountable owners. Keep the assessment boundary, cases and criteria visible so a later reviewer can understand why a capability received its stated result.

Assess operating capabilities rather than document volume

Start with the decisions governance must support: identifying and routing uses, reaching authorised decisions, maintaining conditions and responding to change. A policy, register or committee can contribute, but none is sufficient evidence of the whole capability. Ask what people can actually do with those artefacts.

The NIST AI Risk Management Framework is intended for voluntary use. The original rubric below can help organise local operating evidence alongside relevant framework work, without claiming that NIST has assigned these levels or validated the organisation's score.

Choose a scope that is meaningful. You might assess a defined business unit and its included AI uses, or a shared governance service with specified local interfaces. A narrow assessment can be rigorous if its limits are clear. A broad label such as “enterprise maturity” is misleading when only one cooperative project team was examined.

Identify the intended decision before assessment. A sponsor may need to allocate resources, choose the next setup phase or determine whether a process is ready for wider use. The rubric should supply evidence for that decision, not become a competition for the highest number.

Use four dimensions that reveal different weaknesses

Original operating dimensions for governance assessment

Dimension	Capability question	Evidence examples
Authority and routing	Can the right person reach a valid decision, including absence and disagreement?	Delegations, completed cases, alternate and escalation exercises
Evidence and traceability	Can the organisation support and reconstruct its material claims?	Versioned sources, configuration references, review reasoning and access
Condition maintenance	Do approved limits remain connected to actual operation?	Closure checks, operating permissions, expiry handling and owner records
Change and learning	Do changes and events produce appropriate decisions and verified improvements?	Change routes, incident exercises, corrective actions and later checks

These dimensions are deliberately separable. A team can have excellent evidence storage but weak authority, or a working approval route whose conditions are not maintained after launch. A combined score can hide that difference and lead to investment in the wrong place.

Extend the dimensions where the scope needs additional detail, but preserve the definitions and rationale. If a sector or contractual requirement needs separate evaluation, record it as such. The maturity profile should not absorb a mandatory unresolved condition into an average that looks acceptable.

Define five evidence states before reviewing cases

Original evidence states, numbered for ordering rather than certification

State	Meaning	What does not establish it
0 — Unestablished	The required arrangement or its owner cannot be established within scope	A verbal intention to address it later
1 — Specified	The role, rule and required evidence are documented and adopted for the assessed scope	An unapproved draft or a generic vendor template
2 — Exercised	The intended participants demonstrate the defined route in relevant normal and difficult cases	A presentation by the designer alone
3 — Operating	Current operating records show the capability being used over the assessed period and cases	A single staged exercise presented as sustained operation
4 — Improved with evidence	An observed weakness or change led to a verified improvement maintained in subsequent operation	A planned improvement or an untested procedure update

Agree the necessary case coverage and criteria for each dimension before examining the evidence. The ordering is cumulative for the defined capability: a claim of reliable operation should not ignore an essential route that exists only on paper. Record strengths within the dimension as well, so a gap does not erase useful evidence of working components.

Use “not assessed” where the evidence was outside scope or unavailable. It is different from state 0. Failure to inspect a capability is not proof that the organisation has none. Similarly, an inaccessible record is an evidence limitation that may prevent a conclusion even when the owner believes the process works.

Select cases that can challenge the claimed state

Use current ordinary cases and situations that stress the intended arrangement. Include a missing decision maker, an unresolved evidence item, a material change or an expiring condition where relevant. The selection should follow the capability being assessed, not only the cases easiest for the sponsor to present.

Record the selection method and what it can support. A diagnostic selection can reveal a failure mechanism and test a route, but it does not estimate the frequency of all failures in the portfolio. Do not attach statistical confidence to the maturity label unless a separate valid method supports that claim.

Inspect the original decision and its evidence path. A summary prepared for the assessment can help navigation, but should not silently replace contemporaneous records. Verify whether the reviewer, configuration and source version match the claim. Keep document availability separate from the adequacy of what the document establishes.

The setup checklist can help structure individual checks. Use it as evidence input to the capability profile, not as an automatic percentage-to-level converter. Some missing conditions are decisive regardless of how many unrelated checks pass.

Worked example: project-correspondence governance

Consider a fictional engineering practice assessing governance for an assistant that drafts project correspondence. The assessment deliberately selects six situations: two completed routine approvals, one unavailable-approver exercise, one source change, one expired exception and one retirement case. The selection is diagnostic and does not represent a measured sample of all correspondence activity.

The two routine approvals have valid records. However, the unavailable-approver exercise reveals that the documented alternate cannot access the decision evidence. The authority-and-routing dimension therefore cannot claim the agreed exercised state for the complete route. The report records the routine strength and the specific gap; it does not describe all approval work as absent.

Evidence traceability is demonstrated through current records and accessible source versions for the assessed period. Condition maintenance has documented requirements and a successful expiry rehearsal, but the live exception case lacks the required closure verification. The report states which parts are exercised and which operating claim remains unsupported.

The source-change case shows a weakness found in an earlier exercise, a corrected notification route and subsequent operating evidence that the relevant owner received and handled a real change. That can support the defined improved-with-evidence state for the assessed change capability, provided the agreed criteria and scope are satisfied. It does not establish the same state for incident recovery or every other use.

The useful result is a profile and action plan, not an average of the strongest and weakest observations. The sponsor can repair alternate access and closure verification while preserving the demonstrated source-change improvement. Wider assessment may be needed before extending the conclusion to other offices or uses.

Resolve mixed evidence without forcing a misleading average

Define how a dimension is concluded when its components differ. One defensible approach is to require the stated essential conditions for a level and report stronger components separately. Another is to keep a more granular profile with explicit sub-capabilities. Choose the rule in advance and explain it; do not change the method to obtain a desired rating.

Do not multiply subjective ratings into a precise risk percentage. A maturity state describes evidence about an operating capability, not the probability of an incident or the legal acceptability of a use. A strong governance process can still face significant residual risk, and a narrow low-consequence use can exist within an immature wider programme.

Preserve dissent between reviewers. If they disagree about whether a case demonstrates the route, record the criterion, evidence and unresolved interpretation. Seek the relevant clarification instead of averaging their opinions numerically. The decision maker needs to understand the reason for uncertainty.

Show stale evidence explicitly. A capability may have operated under an earlier configuration but lack support after a material change. The change-trigger design should identify when the prior conclusion needs review. Maturity is a dated assessment of a scope, not a permanent badge attached to the organisation.

Turn each gap into a testable next capability

Write the gap as an observable limitation. “Improve governance culture” is difficult to accept. “The authorised alternate cannot obtain the decision evidence during the defined absence route” identifies a specific problem. Assign an owner, the required change, dependencies and the evidence that will demonstrate resolution.

For the engineering example, repair the alternate's appropriate access and rehearse the absence case again. For exception closure, define the verifier and inspect evidence from a relevant operating case. Do not claim an operating improvement merely because the procedure has been rewritten.

Prioritise according to consequence, dependencies and the intended next step. A missing authority or stop route may constrain expansion more than a polished reporting layout. The decision-rights guide and exception design can support those targeted repairs. The maturity model helps locate work; the page-specific operating method helps perform it.

Record which improvements depend on management decisions or resources. An action assigned to a coordinator cannot succeed if it requires a delegation or specialist capacity the coordinator cannot provide. Escalate the actual decision rather than repeatedly extending the action date.

Reassess with comparable scope and meaningful new evidence

Keep the rubric version, scope, evidence period and selection method from the first assessment. At reassessment, explain any changes before comparing states. A larger portfolio or more demanding cases can reveal gaps without meaning that previously demonstrated capabilities deteriorated.

Test whether the improvement survived ordinary work and a relevant change. A successful retest establishes the specific repaired route; later operating records support a stronger continuing claim. If the programme has not yet had a suitable live event, say so and retain the exercised state rather than inventing operating evidence.

Track regressions and reopened findings. A capability that once worked can weaken after turnover, a supplier change or a new deployment. Reassessment should be allowed to lower confidence. If the organisation treats any lower rating as unacceptable, participants may hide precisely the evidence the model is meant to expose.

Use executive reporting to show the decision supported by the reassessment: investment, narrower scope, further observation or readiness for a defined handover. The number is secondary to the evidence and operating consequence.

Calibrate reviewers with an evidence-to-state worksheet

Before assessing the engineering practice, give reviewers the same short evidence packet and ask each to identify the supported state for one defined capability. Record the criterion used, the evidence relied on and the limitation. The purpose is to expose differences in interpretation before they become inconsistent ratings across business units.

Use the unavailable-approver case as the calibration exercise. Both reviewers can acknowledge valid routine approvals. The relevant question is whether the complete authority-and-routing capability meets the agreed exercised criterion when the alternate cannot access the decision evidence. A reviewer who assigns the stronger state solely because the ordinary route works should explain how that conclusion satisfies the agreed essential conditions.

A completed calibration entry for the illustrative access gap

Worksheet field	Entry
Capability assessed	Authority and routing, including the defined absence route
Claim under consideration	The complete route is exercised under the agreed case coverage
Positive evidence	Two routine approvals have valid contemporaneous records
Contrary evidence	The documented alternate cannot retrieve the decision evidence
Conclusion	The stronger whole-route claim is unsupported; retain the routine component's demonstrated strength
Next evidence	Appropriate access correction and a repeated absence exercise

Discuss disagreements by returning to the criterion. Reviewers may discover that the definition of “complete route” was ambiguous or that one assumed an exclusion the other did not. Resolve and record that issue, then assess affected cases consistently. Do not simply instruct reviewers to choose the lower or higher number without explaining the evidence logic.

Preserve the role of judgement where the rubric cannot remove it. Some evidence may be relevant but weak, or a case may only partly represent ordinary operation. The report should explain how that uncertainty affects the conclusion. A numerical label accompanied by a clear limitation is more usable than a confident label produced by hiding the disagreement.

Set a rule for rubric changes during the assessment. If a criterion is clarified, identify earlier cases affected and revisit them. If the model itself changes materially, retain the old version and explain whether comparisons remain meaningful. This prevents a programme from reporting an apparent maturity increase caused only by easier definitions.

Use calibration again when new reviewers join or the assessment moves into a substantially different operating context. The aim is consistent reasoning, not identical scores for unlike capabilities. A well-calibrated team can reach different conclusions for different units and still provide a coherent account of why the evidence supports each one.

The final worksheet also improves handover. The capability owner can see exactly what would justify reassessment and avoid spending effort on unrelated documents that make the evidence pack larger without addressing the limiting condition.

Present the profile without claiming certification or universal readiness

The report should include the assessed boundary, rubric, evidence sources, cases, capability findings, limitations, reviewer roles and action plan. Clearly label the model as an internal or commissioned assessment aid. Do not imply regulator endorsement, accredited certification or validated benchmarking that the engagement did not establish.

The ISO 42001 and NIST AI RMF comparison explains why different frameworks and assessment objectives need distinct treatment. A maturity exercise can support planning or readiness work, but it should not be substituted for a separate conformity assessment or legal applicability decision.

Discuss an evidence-based governance maturity review with Open for AI using the capability you need to improve and the operating records available. A useful result will show what is established, what is fragile and which next test would justify greater confidence, with a scope your organisation can understand and act upon.