Why self-assessment overstates governance maturity
When we conduct AI governance maturity assessments for enterprise clients, we consistently find a gap between the organisation's self-assessment and the result of structured external evaluation. The gap is not random — it has a consistent pattern. Organisations typically overestimate their maturity in strategy and documentation (because they have produced governance documents) and underestimate the gap in operational effectiveness (whether the governance actually operates as documented).
The root cause is that AI governance is often built for the audit rather than for operation. A comprehensive AI governance policy, an AI ethics framework, and a vendor assessment questionnaire look like mature governance. But if the policy is not being applied to actual AI procurement decisions, if the ethics framework has not been used to evaluate any deployed AI system, and if the vendor assessment has not been completed for the AI systems already in production — the documentation is governance theatre, not governance.
The five dimensions and what each reveals
Strategy and policy reveals whether leadership has made deliberate decisions about AI governance — not whether they have produced a governance document, but whether governance considerations are integrated into AI investment and deployment decisions. The test: can the CEO or CRO describe one specific decision that was changed or delayed because of AI governance considerations? If not, strategy and policy is Level 1 regardless of what the documents say.
Risk identification and classification reveals whether the organisation knows what it is governing. The test: does a complete, current AI system inventory exist? Does it include systems procured by business units without central technology involvement? Does it classify each system by risk level against a defined framework? An incomplete inventory means risk identification is incomplete regardless of the sophistication of the framework applied to what is in the inventory.
Technical controls and documentation reveal the engineering substance of AI governance. The test: for high-risk AI systems, does technical documentation exist that meets the standard required by applicable regulation? Has model validation been conducted by someone independent of the model development team? Is model performance monitored in production against defined thresholds? These are binary questions — either the controls exist and are operating, or they are not.
