Maturity model · where is your institution now?
You can't plan the path until you know where you're standing.
Before the roadmap, locate yourself. Institutions are often further back than leadership assumes — and the honest answer sets your next move. Find the stage that sounds like today.
Why this matters
A shared, honest read of your current stage aligns leadership on the size of the gap and prevents skipping steps. You can't buy your way to "Managed" — each stage is the foundation the next stands on.
0
Ad hoc
AI is in use, but no one owns the risk.
Signs: Shadow tools, no policy, no inventory. Decisions happen and no one could reconstruct why.
Next move
Name a sponsor and stand up a governance body.
1
Aware
The institution knows it has an AI-risk problem.
Signs: A task force exists; some risks are named; no shared method or tiering yet.
Next move
Adopt a recognized method (NIST RMF) and a tiering standard.
2
Defined
A method and owners exist on paper.
Signs: Domains have owners; a tiering rubric and intake process are written down.
Next move
Operationalize — run real uses through the process, not just document it.
3
Managed
Governance runs as routine practice.
Signs: Every consequential use is tiered, reviewed, and logged; a standing committee meets on cadence.
Next move
Measure outcomes — is oversight actually reducing harm?
4
Adaptive
Governance learns and anticipates.
Signs: Incidents feed back into controls; the institution scans the horizon and shapes practice ahead of risk.
Next move
Sustain, share, and lead — become the reference others adopt.