An AI governance maturity model is supposed to tell an organization how much governance it needs, and most of them fail at exactly that because they let the organization answer the question about itself. A model that asks a team to rate its own AI governance on a scale of one to five returns a number shaped by how the team feels about its program rather than by what its AI actually does. The models that work invert this: they assess observable facts about the AI footprint and derive the maturity level from those facts, which means the organization can disagree with the result and still be bound by it. This article covers what separates a descriptive maturity model from a determinative one, how the financial services sector built the latter, and what happens when an institution assesses itself below its real position.
What an AI Governance Maturity Model Is For
The Purpose Is Scoping, Not Scoring
The common assumption is that a maturity model exists to measure progress, with an organization moving from level one to level five as its program improves. That framing works for a capability model where the levels describe how well something is done. It works poorly for AI governance, where the question is not how well the organization governs but how much governance the organization’s AI use actually requires.
Those are different questions with different answers. An organization running a single internal chatbot with excellent documentation and clear ownership is doing governance well and needs very little of it. An organization with AI embedded across customer-facing decisions and no documentation at all is doing governance badly and needs a great deal. A model that scores quality tells the first organization it is mature and the second that it is not, which is true and useless, because neither answer tells either organization what control set to build.
A maturity model built for scoping answers the useful question instead. It establishes what the AI footprint is, and the obligations follow from that rather than from an assessment of how well the organization currently handles them.
Why Uniform Control Sets Do Not Work
The alternative to a maturity model is applying the same control set to every organization, and that alternative fails in both directions at once. A control set sized for an institution running autonomous decisioning in critical functions is unusable at a community bank with two AI pilots. A control set sized for the community bank leaves the larger institution materially under-governed.
This is the specific problem a staged model solves, and it is why sector frameworks have converged on staging rather than on a single baseline. The value is not in the label an organization receives. It is in the fact that the label determines a scope, which makes the same framework document usable across institution sizes that otherwise have nothing operationally in common.
Why Self-Assessment Produces the Wrong Level
Organizations Estimate From Impression
When an organization places itself on a maturity scale without a determinative methodology, the answer reflects the felt state of the program rather than the actual footprint. Teams that know their documentation is thin, their ownership unclear, and their monitoring informal will place themselves low, because low is what the program feels like from inside.
The felt state and the required scope are unrelated. An organization can have genuinely immature governance practices and an AI footprint that demands a large control set, and in fact that combination is the most common one, because footprints grow faster than governance programs. Self-assessment produces a level that describes the program and is then used to size the program, which is circular in a way that consistently under-scopes.
The Averaging Problem
The second failure is subtler and more common. A model assessed across several dimensions invites an organization to average across them, and averaging is almost always wrong for risk.
An institution might look modest on technology implementation, having built nothing internally, modest on scalability, with AI confined to a few teams, and significant on business impact, because one of those few deployments touches customer communications. Averaged, that reads as a low or middle position. In risk terms it is not, because the exposure comes from the dimension with the highest reading rather than from the mean. The customer-facing deployment carries its consequences regardless of how little else the institution runs.
A determinative model removes the option to average. It resolves to the highest position the organization matches on any dimension, which produces a result the organization frequently disagrees with and which is defensible precisely because the organization could not talk itself out of it.
How a Determinative Model Works
The Financial Services Example
The clearest working example of a determinative AI governance maturity model in production is the adoption stage methodology inside the Financial Services AI Risk Management Framework. The Cyber Risk Institute published it at version 1.0 in February 2026, developed with the Financial Services Sector Coordinating Council, the US Department of the Treasury, and more than 100 financial institutions. It is a voluntary industry framework rather than a supervisory rule, and its weight comes from that sector consensus rather than from an agency issuing it.
The methodology places an institution in one of four stages, assessed across three dimensions: business impact, technology implementation, and scalability. What makes it determinative rather than descriptive is the mechanic underneath. The questionnaire runs from the highest stage downward and stops at the first stage with a matching statement, which means an institution lands at the highest stage it matches anywhere rather than at an average across the three dimensions.
The Four Stages
| Stage | What characterizes it |
|---|---|
| Initial | AI is not embedded in critical functions or business decisions. Predictive AI on legacy systems, no modern AI, nothing external-facing, no internal model development |
| Minimal | Limited use for non-critical tasks. Narrow, not external-facing, no sensitive data, no internal model development, no infrastructure to scale |
| Evolving | Drives outcomes through external-facing solutions and sensitive data, but not critical decision-making. No internal model development yet |
| Embedded | Drives outcomes through autonomous decision-making in critical functions. Internal model development, high-sensitivity data, external-facing solutions, fully scalable |
Reading the table as a ladder misses the point of it. These are not four degrees of the same thing. Each stage boundary is crossed by a specific, identifiable event rather than by gradual improvement, which is what makes the model answerable from facts rather than from judgment.
Where the Lines Actually Fall
The boundaries matter more than the stage descriptions, because the boundaries are what an institution can check itself against. A stage description invites interpretation about whether it sounds like the organization. A boundary asks a factual question with a yes or no answer.
The line from Initial to Minimal is crossed by adopting modern AI at all. The line from Minimal to Evolving is crossed the moment AI touches sensitive data or an external-facing outcome. The line from Evolving to Embedded is crossed by internal model development together with autonomous decisioning in critical functions.
The middle boundary is where almost every dispute happens, and it is set far lower than institutions expect. An institution with a productivity assistant that reaches regulated data has crossed it. An institution with a vendor product whose AI feature touches customer-facing outcomes has crossed it, regardless of whether the institution deployed that feature deliberately. Neither situation feels like a governance milestone from inside the organization, and both change which control set applies.
What the Level Actually Buys
Scope, Expressed in Control Objectives
The reason a determinative model is worth the discomfort it creates is that the result translates directly into program size. Under the FS AI RMF, an institution at Minimal carries 120 control objectives. An institution at Evolving carries 193.
That gap of 73 control objectives is the practical consequence of the boundary described above, and it is why the stage determination is the single decision that sizes the entire program rather than a preliminary exercise. An institution that resolves to Minimal when its actual footprint sits at Evolving does not build a slightly smaller program. It builds a program missing a quarter of its required scope, and the gap sits in exactly the areas the higher stage exists to cover.
An Understated Level Is a Finding
The cost of getting this wrong is not theoretical, and it does not stay internal. A framework written below an institution’s actual AI footprint will be criticized by Internal Audit, and by an examiner if supervisory attention arrives before the institution corrects it. The criticism is not that the institution failed a control. It is that the institution scoped its own program incorrectly, which is a harder finding to remediate because it invalidates the work built on top of the scope rather than identifying a gap inside it.
This is also why the defensible move at a boundary is to build to the higher stage and implement in tranches. Where two stages differ on the same control objective, adopting the higher requirement is the position an institution can defend. Phasing implementation against capacity is a resourcing decision that a reviewer will accept. Scoping below the footprint is not.
The Level Changes Without Anyone Deciding
Maturity in this model moves through ordinary product decisions rather than governance events, which is why the assessment needs a fixed cadence rather than a trigger-based review. A team enabling a vendor feature, a business unit connecting an assistant to a regulated data source, or an engineering group fine-tuning a model for an internal use case can each move the institution across a boundary without anyone recognizing the decision as a governance decision at the time.
Internal model development is the trigger most likely to be crossed quietly, because it usually starts as an experiment rather than as a program. Reassessing the stage annually at minimum is what catches these movements before an audit does.
How This Differs From General AI Maturity Models
Sector Frameworks Assume a Context
General-purpose AI governance maturity models are written to apply anywhere, which forces them to stay abstract about what each level requires. A sector framework can be specific because it assumes an operating context, including who the supervisor is, what data is regulated, and what an external-facing outcome means in that industry.
That specificity is the trade. The NIST AI RMF applies to any organization and leaves the implementer to determine what adequate looks like in their context. The FS AI RMF builds on the same Govern, Map, Measure, Manage structure and adds the control objectives and staging logic that NIST deliberately leaves open, which is useful inside financial services and inappropriate outside it.
| Model type | What it determines | Where it fits |
|---|---|---|
| Self-scored maturity scale | How the organization rates its own program | Internal progress tracking, not scoping |
| General framework (NIST AI RMF) | The functions to cover, with scope left to the implementer | Any sector, requires local judgment on scope |
| Certifiable standard (ISO/IEC 42001) | Whether a defined management system meets the standard | Organizations needing an independently verifiable certificate |
| Sector staged framework (FS AI RMF) | The control objectives that apply, derived from the footprint | Supervised financial institutions |
The distinction that matters most in that table is between the second row and the fourth. Both are voluntary, both build on the same functional structure, and an institution can run either. The difference is who decides scope. Under a general framework the institution decides and defends that decision alone. Under a staged sector framework the methodology decides, and the institution’s defense is that it applied a framework built with Treasury and sector participation rather than one it authored itself.
Organizations Outside Financial Services
The FS AI RMF control objectives assume a supervised institution, and organizations outside the sector should not adopt it as a primary framework. What transfers is the architecture rather than the content: the practice of scaling obligations to a documented position rather than applying one control set to every environment, the requirement that every control statement carries an owner, a frequency, the evidence it produces and a source anchor, and the discipline of routing to existing programs rather than restating them.
Elevate applies that same architecture on AI governance program engagements built on NIST AI RMF for organizations outside financial services. That is the appropriate route for an organization that wants the staging discipline without adopting a sector framework written for someone else’s supervisor. The staging logic has to be constructed rather than inherited in that case, which is additional work, and it is still less work than defending a control set with no scoping rationale behind it.
Where Elevate Fits
Elevate Consult runs the FS AI RMF adoption stage determination for financial institutions and their technology suppliers, including the AI inventory that the determination depends on, the control objective gap read-out scoped to the confirmed stage, and the framework design that follows. The determination is a formal gate rather than a workshop output: the stage is confirmed and accepted before any drafting begins, because everything after it is sized by the answer. To determine where an institution actually sits, book a readiness call with an Elevate advisor.
Conclusion
An AI governance maturity model earns its place by removing a decision from the organization rather than by giving it a score. The models that let an organization rate itself return the program’s self-image, and the program’s self-image is systematically below the footprint because governance grows more slowly than deployment does.
A determinative model produces a result the organization frequently disagrees with, and that disagreement is the feature. An institution that resolves to a higher stage than expected has learned something actionable about its exposure. An institution that resolves exactly where it expected has usually assessed itself rather than its AI.
Elevate Consult works with banks, credit unions, insurers, asset managers and the technology vendors serving them on adoption stage determination, control objective gap analysis and framework design. To scope what applies at a specific institution, schedule a readiness call.
Key Takeaways
- A maturity model for AI governance should scope, not score. The useful question is how much governance the AI footprint requires, not how well the organization currently performs governance.
- Self-assessment systematically under-scopes. Organizations place themselves according to how the program feels from inside, and the felt state is unrelated to the control set the footprint actually demands.
- Averaging across dimensions is the most common error. Exposure comes from the highest dimension, not the mean, which is why determinative models resolve to the highest match rather than to an average.
- The FS AI RMF stage methodology is determinative by design. It runs from the highest stage downward and stops at the first match, removing the option to negotiate a position between two stages.
- The result translates directly into program size. Minimal carries 120 control objectives and Evolving carries 193, and the boundary between them is crossed the moment AI touches sensitive data or an external-facing outcome.
- Scoping below the footprint is a finding, not a gap. It invalidates the work built on the scope rather than identifying a missing control, which makes it harder to remediate than a failed control would be.
FAQs
What is an AI governance maturity model? It is a structured method for determining how much AI governance an organization requires, based on what its AI does rather than on how well the organization currently governs it. The strongest versions are determinative rather than descriptive: they assess observable facts about the AI footprint and derive a position from them, which then determines the control set that applies.
Why do self-scored AI maturity assessments produce the wrong result? Because the organization answers according to how its program feels from the inside, and that impression tracks the state of the governance program rather than the state of the AI footprint. Since footprints generally grow faster than governance programs do, self-assessment consistently produces a position below the organization’s actual exposure, which then sizes a program too small.
Can an organization be between two maturity levels? Under a determinative methodology, no. The FS AI RMF adoption stage questionnaire runs from the highest stage downward and stops at the first stage with a matching statement, so an organization resolves to the highest stage it matches on any dimension rather than to an average across dimensions. Being modest on two dimensions and significant on one resolves to the significant one.
What happens if an institution assesses itself at too low a stage? It builds a control set smaller than its footprint requires, and the gap sits precisely in the areas the higher stage exists to address. Internal Audit or an examiner is likely to criticize the scoping decision itself rather than an individual control, which is harder to remediate because it invalidates the framework built on that scope rather than identifying a gap inside it.
Does an AI governance maturity model apply outside financial services? The staging architecture does; the FS AI RMF control objectives do not, because they assume a supervised financial institution. An organization in another sector can apply the same discipline, meaning obligations scaled to a documented position and control statements carrying an owner, a frequency, the evidence produced and a source anchor, on top of a general framework such as the NIST AI RMF.