01
Strategy & Ownership
AI governance has an accountable owner, a charter, and a defined relationship to business strategy and risk appetite.
The lightest way to get a defensible read on where your AI governance stands. The Maturity Assessment, our GAP Analysis & Review, scores eight governance domains on a five-level scale against a target state you choose, produces a risk-weighted gap register, and hands you a sequenced roadmap. It is the structural backbone of the full audit, and it stands on its own.
Each domain is scored 1 to 5, current versus target, against behavior we can observe and evidence we can cite. Together they describe a complete governance posture.
AI governance has an accountable owner, a charter, and a defined relationship to business strategy and risk appetite.
Current, coherent, enforceable policies govern AI use, with standards that translate them into specific required behavior.
A maintained inventory of where AI is used, by whom, on what data, and touching which decisions.
AI risks are identified, assessed for likelihood and impact, owned, and tracked through to mitigation.
Defined controls (human review, access, logging, vendor terms) exist and operate for higher-risk uses.
Obligations are mapped to AI use and the organization can evidence that it meets them.
The workforce is trained to a defined standard appropriate to its AI use and role.
AI use and AI outputs are monitored; metrics inform governance decisions and continuous improvement.
A target state is set in a leadership workshop, calibrated to risk appetite and sector. Current state is then scored against it, evidence in hand. Gaps are weighted by risk so the roadmap addresses the right things first.
Leadership selects a target maturity level per domain in a structured workshop. This is what makes the gap meaningful rather than abstract.
Each domain is scored against the maturity model using document review, interviews, and signals. A score is only assigned where evidence supports it.
The gap is the distance between current and target. Each is then weighted by the risk it represents.
Weighted gaps are ordered into a sequence that respects dependencies. An AI inventory must precede meaningful risk assessment, for example.
The Maturity Assessment is built to make the gap visible to leadership and actionable for the owners who close it.
A focused two-to-three-week engagement that gives you a defensible score and a sequenced roadmap, with no commitment to anything beyond it.