AI governance maturity assessment
Decide which governance gaps materially affect current agent decisions
When leadership needs a baseline before choosing governance investments, this area becomes relevant. For the AI governance leader, the concern is specific: a maturity score rewards documentation that no team actually uses. The governance implementation design starts from that consequence and follows the relevant evidence through the customer workflow. Assess maturity through actual decisions and evidence trails. The proposed assessment should distinguish missing documentation, weak implementation, and ineffective controls, because each requires a different investment and owner.
Connect the operating question to inspectable evidence
- AI governance leader
- Owns the bounded decision and the consequence of acting.
- Policy and process inventory
- Defines the starting context for the proposed work.
- Documented versus practiced controls
- Exposes the first material uncertainty to examine.
- Prioritised operating improvements
- Carries unresolved conditions into an accountable next action.
Decision at stake
Decide which governance gaps materially affect current agent decisions
Make the decision explicit
- AI governance leader
- Leadership needs a baseline before choosing governance investments.
- Decision
- Which governance gaps materially affect current agent decisions.
- Documented
- Use policy and process inventory to establish the relevant starting condition.
For the AI governance leader, this becomes relevant when leadership needs a baseline before choosing governance investments. The immediate decision is which governance gaps materially affect current agent decisions. The scope should be narrow enough that the governance owners can identify a meaningful alternative, including continuing the current approach if the available evidence already supports it.
The practical failure to challenge is that a maturity score rewards documentation that no team actually uses. That concern gives the work a concrete direction: establish what the relevant boundary should do, inspect how it behaves or would operate, and identify the owner of any gap. It should not be diluted into a broad transformation exercise before the specific question has been answered.
Coverage
Documented and practiced controls need different evidence
Keep the review distinctions visible
- Documented versus practiced controls
- Compare the policy description with a sampled operating decision.
- Evidence availability
- Keep inaccessible evidence distinct from evidence of a missing control.
- Escalation effectiveness
- Trace an exception to the person who could resolve it.
Documented versus practiced controls
For this scope, documented versus practiced controls should be examined alongside policy and process inventory. Compare the policy’s stated review steps with a sampled real decision. Identify which steps produced evidence and which rely on participant recollection. The assessment should separate undocumented operation from a control that demonstrably failed, because those observations support different remediation decisions.
Evidence availability
For this scope, evidence availability should be examined alongside sampled decision records. Check whether evidence can be located, attributed, and connected to the relevant system version. A document count does not show whether a release owner could use the records. Missing or inaccessible artefacts should become specific verification or retention questions, not invented maturity findings.
Escalation effectiveness
For this scope, escalation effectiveness should be examined alongside control owner interviews. Walk through an exception or unresolved issue and identify who could escalate it. The proposed review should inspect whether the escalation reached a decision and whether the action closed. A process that names a committee but cannot resolve a realistic disagreement has a different gap from missing policy text.
Prerequisites
Start with policy and process inventory
Give each input a specific job
- Policy and process inventory
- Defines the operating boundary.
- Sampled decision records
- Examine evidence availability.
- Control owner interviews
- Shows conditions affecting escalation effectiveness.
- Policy or risk owner
- Confirm access and a reviewer who can resolve gaps.
The starting material is policy and process inventory, sampled decision records, and control owner interviews. Review these together rather than assuming one document tells the whole story. A stated rule may differ from a configured behaviour, and a proposed responsibility may not yet have an available owner. Identify those differences before selecting the detailed work.
Participation should include an accountable policy or risk owner, relevant system owners, and qualified legal or domain reviewers when interpretation is needed. The customer should define which information and environments may be used. Synthetic or sanitised examples can support preparation when they preserve the relevant behaviour; if they omit a material dependency, record the limitation and agree how the missing evidence would be obtained.
How the work proceeds
Follow the requirement into an accountable operating practice
Follow the evidence through the work
- Documented versus practiced controls
Use policy and process inventory to define the decision criteria.
- Evidence availability
Inspect sampled decision records and retain observations that challenge the expected result.
- Escalation effectiveness
Use control owner interviews to identify unresolved conditions and a responsible owner.
- Prioritised operating improvements
Link the recommendation to its evidence, remaining limits and next validation condition.
Sample a recent approval, change, exception, and incident where records are available. For each, compare the stated process with what participants actually did and what evidence remains. The proposed maturity assessment should identify practical causes of gaps, such as unclear authority or unavailable reviewers, rather than assume every weakness requires another policy.
A practical first slice would focus on documented versus practiced controls and then follow its consequences into evidence availability. Keep escalation effectiveness visible as a separate review question rather than assuming it is satisfied by the first result. The governance owners should record observations, competing explanations, and changes to the original assumptions. A second reviewer can challenge whether the evidence supports the recommendation and whether an apparently successful example omitted the condition that matters most.
Indicative artefacts
Use prioritised operating improvements to make the next action explicit
Every artefact needs an operating use
Illustrative working format
- Governance baseline
- Boundary — policy and process inventory.
- Evidence-backed gap map
- Findings about evidence availability.
- Prioritised operating improvements
- Action on escalation effectiveness.
Indicative outputs include governance baseline, evidence-backed gap map, and prioritised operating improvements. Their form should follow the decision and the customer’s existing operating records. The first should establish the assessed boundary and relevant observations; the second should make material gaps or dependencies inspectable; the third should identify the action, owner, and evidence needed to revisit the decision.
Acceptance should be tested through use: can the responsible owner explain what was examined, identify an unresolved issue, and act on the next step without reconstructing the whole engagement? Findings should preserve counterevidence and limits. A polished document is insufficient if it does not help resolve the customer’s specific question.
Illustrative scenario
Release rule exists: targeted verification
Examine the constructed decision boundary
Illustrative scenario
- Release rule exists
An enterprise has AI policies but no review record for its latest agent.
- Evidence gap
Trace the release rule to its expected decision record.
- Targeted verification
Missing evidence does not prove control failure; verify operation or improve the process.
Consider an illustrative situation in which an enterprise has AI policies but cannot show how a recent agent release was reviewed. This is a constructed example, not a client engagement or an observed Softlander outcome.
For the policy-rich enterprise, the illustrative review could find a well-written release rule with no recorded application to the latest agent. The output would distinguish the missing evidence from proof that the control never operated. The governance owner could then choose a targeted verification or process improvement instead of relying on an unsupported maturity score.
The useful learning would be the difference between the expected behaviour and the behaviour or responsibility actually demonstrated. If the exercise leaves escalation effectiveness unresolved, that should remain a named next step. A recommendation to narrow the scope, improve a prerequisite, or hold the decision can be appropriate when the example exposes a material dependency.
Scope and authority
Governance evidence supports decisions within defined professional limits
Keep analytical work separate from decision authority
- Operating requirements and evidence mapping
- Can include governance baseline.
- Policy or risk owner
- Authorised policy owners decide; qualified specialists interpret professional requirements.
- Legal conclusions and certification decisions
- Cannot be inferred from evidence-backed gap map.
This work supports governance preparation and operating evidence. It does not provide legal advice, determine regulatory compliance, award certification, or replace a formal audit. Authorised customer owners retain policy, release, and residual-risk decisions.
Ways to engage
Related engagement scopes
AI Privacy Engineering Review
Trace personal data through your agent workflow. Examine collection, memory, retrieval, tool access and retention against your agreed requirements.
AI Governance Operating System
Make AI oversight part of daily operations. Connect inventories, accountable owners, change decisions and evidence into a workable governance process.
Continue exploring
Related insights and resources
Governing agent decisions
Governance becomes useful when it changes a decision. Connect each agent workflow to an accountable owner, explicit operating conditions, proportionate evidence and a practical route for exceptions and withdrawal.
Protecting agent data and memory
An agent's information footprint extends beyond the conversation. Map the copies, derived records and retrieval paths that influence future actions, then connect each to purpose, access, retention and verifiable handling.
AI agents in legal operations: assistance without invented authority
Legal agents can organize evidence and prepare work, but professional judgement, client authority and verified legal positions cannot be delegated by interface.