The Five Stages of AI Governance Maturity - and How to Move Up

The Five Stages of AI Governance Maturity - and How to Move Up

For three years a mid-sized healthcare services company had been "doing AI governance." They had a stack of policies, a 40-page vendor risk playbook, and a glossy slide deck for the board. Yet when the internal audit team ran a tabletop on a model that decided patient scheduling priorities, it blew up: conflicting approvals, no owner for model monitoring, and a month-long turnaround to fix a bias issue. The audit labeled them "reactive."

This is a familiar story: documents in place, behaviors not. Governance had become a compliance checklist, not a way of working. In this article I'll walk through a practical five-stage maturity model - ad hoc, reactive, defined, managed, optimized - how to diagnose where you are, and the concrete moves that will actually get you to the next stage. I'll use the healthcare company's real transition as a running example: define decision rights, instrument the program with metrics, run quarterly maturity reviews, and tie executive incentives to progress. Eighteen months later they were solidly "managed" - and could explain exactly why.

The five stages - what each looks like in practice

Think of maturity as a combination of artifacts (policies, inventories), processes (approval workflows, lifecycle rules), and most importantly, behaviors (who takes responsibility, how teams act under stress).

- Ad hoc
- What it looks like: AI projects sprout in silos. No inventory, no risk classification, ad hoc vendor choices, and decisions happen person-to-person.
- Risk: Hidden exposures, duplicated effort, surprise audits.
- Example: A data scientist deploys a scheduling model because it improves throughput, without notifying IT or compliance.

- Reactive
- What it looks like: Policies exist and teams react to incidents or regulator inquiries. Processes are inconsistent; approvals are informal. Documentation is sometimes created after the fact.
- Risk: Compliance gaps and slow remediation. Activity is event-driven rather than planned.
- Example: The healthcare company had model policies and a vendor checklist, but roles were unclear and monitoring rarely triggered until a complaint arrived.

- Defined
- What it looks like: Standardized processes, role definitions (RACI), lifecycle steps, an initial model inventory, and risk classification rules.
- Risk: Controls exist but aren't consistently followed; measurement is immature.
- Example: Every model now requires a documented approval before production, but enforcement is manual and inconsistent.

- Managed
- What it looks like: Controls are embedded in workflows, metrics drive decisions, there's routine monitoring and incident management, and governance is integrated with business operations.
- Benefit: Predictable risk posture and faster response. You can demonstrate control to boards and regulators.
- Example: The company had a model registry, automated monitoring for drift and fairness, quarterly reviews, and a clear chain of accountability.

- Optimized
- What it looks like: Continuous improvement and automation of governance (policy-as-code, integrated testing, automated remediation), tight alignment with enterprise risk frameworks, and performance metrics tied to incentives.
- Benefit: Governance is a competitive enabler; the organization moves fast under controlled risk.
- Example: Policies trigger automated tests during CI/CD; high-risk models have continuous control gates and self-healing mechanisms.

How to diagnose where you actually are

Self-assessments often overestimate maturity. To place yourself correctly, use a short diagnostic across five domains: Strategy & governance, Inventory & lifecycle, Risk management & controls, Monitoring & operations, and Culture & training. Score 0-4 on each sub-question and total the points.

Sample diagnostic questions (score 0-4 each):
- Do you have an up-to-date model inventory covering all production and near-production models?
- Are decision rights for model approval, deployment, monitoring, and retirement documented and enforced?
- Do you use a risk classification framework aligned to business impact (and regulators such as the EU AI Act where relevant)?
- Do you have automated monitoring (performance, drift, fairness) for critical models?
- Are there regular reviews of AI incidents with remediation tracking and SLA targets?
- Is training and role-based competency tracked and required for model owners?

Scoring guide:
- 0-20: Ad hoc
- 21-40: Reactive
- 41-60: Defined
- 61-80: Managed
- 81-100: Optimized

The healthcare company ran this diagnostic and scored 33 - solidly "reactive." That was a useful wake-up: plenty of paperwork, little enforcement, and no shared accountability.

The moves that make progress - what actually changes behavior

Many programs stall because they focus on policies and playbooks, not the levers that create new behaviors. The healthcare company's transition plan focused on four practical moves that any organization can replicate.

1. Define decision rights - who decides, who signs off, who fixes
- Create a simple RACI for the model lifecycle: who is Responsible (model owner), Accountable (business owner / CDO), Consulted (GC, CISO, compliance), Informed (operations, vendor management).
- Make approvals role-based, not person-based. That prevents single-point failures when someone leaves.
- Example: For high-risk scheduling models, the Chief Medical Officer (CMO) is the accountable executive; the Head of Data is responsible for monitoring; the GC signs off on regulatory classification. When a bias alert fires, the model owner must implement a mitigation within 10 business days.

2. Instrument the program with metrics - measure what matters
- Define a concise dashboard with leading and lagging indicators. Leading indicators drive behavior; lagging indicators track outcomes.
- Leading examples: % of models inventoried, % of high-risk models with documented controls, % of models with monitoring enabled, training completion rate for model owners.
- Lagging examples: number of AI incidents, mean time to remediate incidents, audit findings, regulatory inquiries.
- The healthcare company built a dashboard and targeted a 90% inventory completeness and reduction of average remediation time from 30 days to 7 days within 12 months.

3. Run quarterly maturity reviews - governance becomes operational
- Make reviews short, regular, and outcome-oriented. Agenda: inventory changes, incidents since last review, progress on remediation, new high-risk models, vendor updates, and a single runway for next quarter.
- Attendees: COO or CAO chair, Head of Data, CISO, GC, business unit heads, and the model owner for any escalated items.
- Output: an action register with owners, deadlines, and clear escalation paths to the executive leadership team if SLA breach risk is high.
- The company's reviews quickly replaced emergency meetings with predictable, proactive discussions.

4. Tie executive incentives to maturity progress - make it matter at the top
- Adjust scorecards and variable compensation so that executives share responsibility for governance outcomes: inventory completeness, remediation SLAs, and percentage of high-risk models with formal approval.
- Choose a mix of short-term milestones (e.g., deploy monitoring on top 20 models) and longer-term maturity targets (move from reactive to defined within 12 months).
- The healthcare company linked 10-15% of the Head of Data's bonus to maturity milestones and included governance metrics in the annual performance goals for relevant business leaders.

The tactical sequence - a practical 18-month roadmap

Progress is easier when you sequence work into bite-sized waves. Here's the sequence the healthcare company used to move from reactive to managed in 18 months.

- 0-3 months (Stabilize)
- Run the diagnostic and publish the baseline.
- Define decision rights and publish a simple RACI for the model lifecycle.
- Launch a model registry template and inventory the top 50 models.

- 3-9 months (Control)
- Implement risk classification and require approvals for high-risk models.
- Deploy basic monitoring for performance and drift on the top 20 models.
- Launch quarterly maturity review cadence and a governance dashboard.

- 9-15 months (Operationalize)
- Automate reporting and escalate flows; remediate outstanding control gaps.
- Tie executive KPIs to the governance dashboard and begin tracking incentive-linked targets.
- Run tabletop exercises for incident response and vendor failure scenarios.

- 15-18 months (Demonstrate)
- Report maturity improvements to the board and external auditors.
- Publish a one-page "why we are managed" summary describing controls, behaviors, and metrics.

At 18 months the healthcare company could point to tangible evidence: 95% model inventory coverage, monitoring on 100% of high-risk models, average remediation time down to 6 days, and an established quarterly review chaired by the COO. They had moved from reacting to problems to managing them.

Metrics that prove progress - what boards and regulators want to see

Boards and regulators increasingly ask for evidence, not promises. Focus on a short set of metrics that tell the story of control, not the entire universe of telemetry.

Suggested executive dashboard (6-10 metrics):
- Model inventory coverage: % of production models recorded in the registry.
- High-risk model controls: % of high-risk models with documented controls and sign-off.
- Monitoring coverage: % of models with automated monitoring (performance, drift, bias).
- Incident rate and severity: number of AI-related incidents per quarter, with severity classification.
- Mean time to remediate: average days to close AI control defects.
- Audit readiness: time to produce necessary artifacts for an audit (target: <5 business days).
- Training and competencies: % of model owners with required training/certification.
- Vendor coverage: % of third-party AI tools evaluated against vendor risk criteria.

Use trends and targets, not static snapshots. A steady fall in remediation time and a rise in monitoring coverage is more convincing than a single "compliant" status.

Map these metrics where useful to industry frameworks:
- NIST AI RMF helps you frame risk management and measurement.
- EU AI Act (for organizations operating in or serving the EU) informs what is "high-risk."
- ISO/IEC 42001 (AI management system) provides language for management system maturity.

But don't let frameworks become a substitute for clear, business-focused metrics.

Why governance is an enabler - not a brake

The healthcare company's leaders discovered an important lesson: governance isn't about slowing innovation - it's about predictable, sustainable innovation. When decision rights are clear, teams move faster because they know the route to production. When monitoring is in place, business leaders feel comfortable scaling models. When incentives align, governance becomes part of how success is measured.

For boards and executives, the right question isn't "How do we stop AI risk?" It's "How do we make AI risk visible and controllable so we can scale where it delivers value?"

Conclusion - a practical takeaway

If you're unsure where your organization sits on this maturity curve, run the five-domain diagnostic this week. If you score in the reactive range - lots of documents, poor enforcement - start with decision rights, a focused set of metrics, quarterly maturity reviews, and executive incentives tied to measurable progress. Sequence your work in 90-day waves: stabilize, control, operationalize, demonstrate.

Governance is not an end state; it's a capability that lets you take more calculated risks with confidence. Companies that treat governance as a behavioral change - not just a policy exercise - will be the ones that move from reactive to managed and ultimately to optimized, where governance becomes a competitive advantage.

Next step: pick one high-risk model, document the RACI, add monitoring, and bring it to your next quarterly maturity review. That single experiment will tell you more about your true maturity than any slide deck ever will.