Framework · Maturity model
Find your AI governance maturity level and the evidence that moves it up.
Five levels, Unmapped to Assured, applied separately to each of the eleven elements of the PolyGovern framework. Work through the grid with the people who hold the evidence. You leave with a level for each element and the documents that take each one to the next level.
Set aside an hour with the people who hold the evidence: the owner of the AI register, the senior owner of AI governance, the risk function and internal audit. Ask each of them to bring the documents, records and logs they keep.
A level counts only when its evidence can be handed over today, so a record someone remembers and cannot find counts for nothing.
The elements come from the PolyGovern AI Governance Framework and the levels follow the four phases of the Evidence-First Method. This page produces no number. The AI Risk Calculator is the only PolyGovern tool that produces a score, and it scores one system at a time.
Step 1
Learn the test for each level before you score.
Each level describes the state of the evidence, in the order the method produces it. Levels apply to one element at a time, so an organisation can be Assured on board oversight and Unmapped on agentic AI on the same day. Read the test under each level. Every cell in the grid is judged the same way.
- L0
Unmapped.
The organisation does not know how many AI systems it runs. AI arrives through vendor updates, personal subscriptions and features switched on inside tools that were bought for something else. There is no policy, owner or register.
The test
Ask for the list of AI systems and nobody can produce one.
- L1
Located.
Every AI system has been found and classified, including AI embedded in HR, customer and productivity tools. Each entry on the register names the obligations the system triggers. Nothing governs the systems yet, but the organisation knows what it has.
The test
A register exists, is dated, and a risk reviewer can point to the highest-risk system on it.
- L2
Framed.
The board has approved an AI policy and a risk appetite. A senior leader owns AI governance and every system on the register has a named accountable person. The lines of defence are assigned. Policy exists, but the controls it describes are not yet operating in the workflows that carry the risk.
The test
A board paper approved the policy and appetite, and the register has an owner column with no blanks.
- L3
Controlled.
New AI uses pass through a documented intake: screening, impact assessment where triggered, privacy assessment where personal information is involved, approval. Override points and contestability channels exist on live systems. Agents that act have authority limits. Evidence is captured as the work happens.
The test
Pick any live system and the completed screening, assessment and approval record can be produced within a day.
- L4
Assured.
Monitoring runs on a schedule matched to risk, against thresholds taken from the appetite. Internal audit tests the controls on a defined cycle. The board receives a standing report. The evidence pack matches what is in production and could be handed to a regulator or a certification auditor without preparation.
The test
The last internal audit report on AI controls is less than a year old and the board minutes show the finding was discussed.
Step 2
Place each element on the self-score grid.
Read across each row and stop at the last cell whose evidence you could hand over today. Write that level next to the element. If the first cell fails, the element is at level 0. Keep the eleven levels separate, because the grid produces no total.
| Element | L1 Located | L2 Framed | L3 Controlled | L4 Assured |
|---|---|---|---|---|
| 01 Board oversight | AI mentioned in a board paper once | Policy and appetite approved; senior owner named | Board approves uses above appetite; decisions minuted | Standing report on a fixed cadence; audit findings tabled |
| 02 AI policy | Draft or borrowed policy, no approval | Approved, versioned, owned, acknowledged by staff | Policy drives the intake route and the approval gates | Reviewed on a cycle; changes traced to incidents and audits |
| 03 Roles and accountability | Register has systems but no owners | Accountable person per system; RACI in place | Vendor and model-provider accountability mapped | Role performance reviewed; handovers recorded |
| 04 Risk appetite | Risk discussed per project, nothing written | Appetite statement approved by the board | Thresholds applied at intake; declined uses recorded | Monitoring reports measured against the thresholds |
| 05 Governance loop | Projects approved ad hoc | Intake route documented | Screening, impact and privacy assessments completed per system | Reassessment triggers fire on change; records retained |
| 06 Assurance rhythm | No monitoring | Assurance calendar drafted | Monitoring live on high-risk systems | Internal audit cycle and management review operating |
| 07 Evidence artefacts | Register only | Register plus policy and appetite | Assessments, test results and transparency text per system | Pack refreshed on a cycle and reconciled to production |
| 08 Three lines of defence | AI handled by the project team alone | Line responsibilities written into the policy | Second line reviews each approval; records kept | Third line tests controls and reports to the board |
| 09 Federated governance | Units run separate programmes | Group standard issued; unit supplements agreed | Single register with unit ownership; escalation route used | Group reporting consolidates unit evidence |
| 10 Agentic AI | Agents deployed without an authority list | Authority matrix and tool access defined | Kill switch tested; action logs retained | Agent actions sampled by second line and audited |
| 11 Human oversight | Override possible in theory | Override points and contestability channel designed | Overseers trained; channel live and logged; disclosure published | Override and challenge data reviewed for patterns |
Worked example
The team says it has an AI policy. Nobody can find the board paper that approved it. On row 02 the policy matches the Located cell, a draft with no approval, and stops there. Element 02 sits at level 1 until the approval exists on paper.
Where the evidence comes from
Each cell names evidence that an Australian or New Zealand instrument already asks for: the AI policy, risk screening and AI register templates in the National AI Centre Guidance for AI Adoption; the accountable official, use-case register and transparency statement in the DTA policy; the privacy impact assessment and senior approval the Office of the Privacy Commissioner expects; the privacy-policy disclosure required by APP 1.8; and the risk rating in the Algorithm Charter.
Step 3
Turn the next cell on each row into a work list.
The cell to the right of where you stopped names the evidence that moves that element up one level. Copy it into a list with an owner and a date, allowing one to two quarters for each level. Raise the lowest rows first, since the levels follow the phases of the method: Located is what Map produces, then Framed comes out of Frame, Controlled out of Control and Assured out of Assure.
| Element | Level today | Evidence that moves it up |
|---|---|---|
| 07 Evidence artefacts | L1 Located | Add the approved policy and the risk appetite to the pack beside the register (L2 Framed) |
| 11 Human oversight | L2 Framed | Training records for the overseers, a live challenge channel with its log, and the published disclosure text (L3 Controlled) |
| 10 Agentic AI | L1 Located | An authority matrix and a tool access list for each agent on the register (L2 Framed) |
From 10 December 2026, APP 1.7 to 1.9 need a current register of automated decisions that significantly affect people and the privacy policy text that describes them. On the grid that is Located on element 07 and the disclosure part of Controlled on element 11, so those two cells go to the top of an Australian work list.
Step 4
Check the levels against your highest-risk systems.
The grid describes the organisation and the calculator describes one system. Read together, they show where a low level sits under a system with real obligations.
Frequently asked.
The model is a reading aid. For a scored view of a specific system, use the calculator. For a view of the whole organisation, book a call.
Which tool scores the maturity model?
The AI Risk Calculator is the single PolyGovern scoring tool. It classifies one system at a time and lists the obligations it triggers under the Australian and New Zealand instruments. This page describes the organisational levels. The self-score grid below is a reading aid and produces no score.
How do the five levels relate to the Evidence-First Method?
Directly. Located is what the Map phase produces, Framed comes out of Frame, Controlled out of Control and Assured out of Assure. An organisation can be at a different level on different elements, which is why the grid scores each element on its own.
How is this model different from other published maturity models?
Several maturity models are published, and many of them rate an organisation on what it says about itself. This one sets each level by the documents, records and logs an auditor can inspect. It also reads the levels against the ISO 42001 clause groups and the readiness work for APP 1.7 to 1.9 and IPP 3A.
Is level 4 the same as being ready for ISO 42001 certification?
Close to it. Assured means internal audit and management review are operating and the evidence pack is current, which is what ISO 42001 clause 9 asks for. Certification also requires a scope statement, a statement of applicability and a certification body engagement, covered on the ISO 42001 service pages.
What level does APP 1.7 to 1.9 require from 10 December 2026?
The disclosure duty needs a current register of automated decisions that significantly affect people and the privacy policy text that describes them. That is Located on element 07 and the disclosure part of Controlled on element 11. The rest of the framework is not required for the disclosure. The OAIC expects the organisation to know which programs are in scope, and that knowledge comes from the register.
How long does it take to move one level?
Most organisations need one to two quarters to move one level, provided the work has named owners with time set aside for it. Where you land in that range depends on how many systems are on the register and how many of them are high risk. A thirty-minute call with a senior consultant gives you a view of your current level on each element and the phase to start in.
Score one system. Then score the organisation.
The calculator takes about three minutes and needs no login, while the grid takes an hour with the people who hold the evidence. A call with us turns both into a phase to start in.
Free tool · No login
AI Risk Calculator.
The single PolyGovern scoring tool. Ten questions, one system, every Australian and New Zealand obligation it triggers.
Run the calculatorThirty-minute call
Maturity review.
A senior consultant works through the grid with you and names the level on each element and the phase to start in.