AI Capability Maturity Assessment · Version 1.0.0

Know where your AI capability stands, and what to do next.

Eight domains, 40 criteria and five levels, rated on evidence rather than opinion. The gaps become findings, a strategy and roadmap, and recommendations for governance and the operating model, for the whole organisation or one business function.

Start the free assessment Read the model

8 domains
40 criteria
Five levels with pass tests
80 initiatives
Australian Government and organisation editions
Enterprise or one function
Mapped to ISO/IEC 42001, the EU AI Act and the NIST AI RMF

Five levels

Rated on what can be shown, not what is intended.

Every criterion has a descriptor for each level and a pass test for levels 2 to 5. A level counts only when its pass test is met, and a claim you cannot yet evidence is capped, so the result stands up to an auditor’s questions.

Level 3 is the realistic 12 to 24 month target for most organisations and is the level at which most current obligations are met by design.
Level 4 is warranted where AI acts with supervised autonomy, makes or shapes decisions about people at scale, or handles sensitive information. The step from 3 to 4 is where assurance moves from reviewing outputs to governing systems at runtime.

The five levels in full

Eight domains, three layers

Everything AI capability depends on, in the order to build it.

Foundations first: direction, accountability and people. Then the ways of working that assess and deliver each use case, and the data, platform and engineering practice that make AI safe to run and to extend.

Foundations

Direction, accountability and people: the decisions and rules every other domain depends on.

1Strategy and leadershipSets the direction for AI: why the organisation uses it, how far and how fast, where it will not go, and who at the top answers for it.1.11.21.31.41.5 2Governance and operating modelDefines who is accountable, who decides and how AI use is overseen: owners, the governance committee, the register, the lines of assurance and...2.12.22.32.42.5 8People, capability and cultureCovers the people side of AI: foundational literacy, role-based capability, acceptable use, adoption and change, and a culture in which people...8.18.28.38.48.5

Ways of working

How use cases are assessed, governed and delivered day to day.

3Risk, assurance and transparencyCovers how AI risk is assessed and managed for each use case: impact assessments, tiering, the lifecycle and its gates, transparency and...3.13.23.33.43.5 7Use-case delivery and valueCovers how AI use cases are chosen, delivered, scaled and measured: intake and portfolio, lifecycle execution, pilot-to-scale discipline, benefits...7.17.27.37.47.5

Practice

The data, platform and engineering disciplines that make AI safe to run and to extend.

4Data, knowledge and semanticsCovers the data and knowledge AI depends on: quality, shared meaning, classification and handling, records of what AI did and why, and retention...4.14.24.34.44.5 5Platform, architecture and securityCovers where and how AI runs: the approved platform, AI-specific security controls, the approved tool and model list, third-party and embedded AI,...5.15.25.35.45.5 6Design and engineering practiceCovers how AI systems are designed, tested and released: specification before build, deliberate autonomy and human oversight, evaluation and...6.16.26.36.46.5

Free assessment

Rate it, then leave with a plan.

Rate all 40 criteria with the evidence you hold and choose your ambition. The assessment applies the model’s rules: an overall and per-domain profile, a heat map of current against target, prioritised gaps, findings, and initiatives sequenced into four horizons with their dependencies. Nothing is sent to Renly; it all runs in your browser.

Start the assessment

AI Capability Maturity Assessment: Findings Report, in Word
AI Strategy and Roadmap, in Word
AI Governance and Operating Model: Recommendations, in Word
A Scoring Workbook in Excel, with live formulas

With Governing Intelligence

Governance asks if you are safe today. Maturity asks how capable you are.

Governance and maturity answer different questions. Governance asks whether the organisation’s AI is safe, lawful and accountable today: are the obligations met and can it prove it. Maturity asks how capable the organisation is at using AI well, and what to do next to improve. An organisation can be compliant and immature (controls in place, but slow, manual and dependent on a few people) or capable and exposed (strong delivery, weak governance). Leaders need both answers.

Every domain and criterion links to the Governing Intelligence chapters that describe the practice, and to the AI governance assessment questions that test it at a higher level.

How the two fit together

Governing IntelligenceThe framework: five domains, the Autonomy Ladder, gates and templates AI governance assessmentTwenty questions and a governance strategy in Word AI maturity assessment40 criteria, findings, a roadmap and a scoring workbook Where Renly helpsEach domain and initiative mapped to the product, truthfully

Read the model

20 chapters, every criterion in full.

Leaders can start with how to use the model and the five levels. Assessors will want the domain chapters, the scoring method and the toolkit. Strategy and transformation teams will find the initiative library, the roadmap method and the report blueprints in Part IV.

Part I. Understanding the model

How to use the modelWhat the model measures, how its domains, criteria and levels fit together, how to read a criterion, and the choices to make before you...The five levelsThe five levels, Initial, Repeatable, Defined, Managed and Optimising: what each looks like, the evidence that shows it, what moves you...

Part II. The eight domains

1Strategy and leadershipSets the direction for AI: why the organisation uses it, how far and how fast, where it will not go, and who at the top answers for it.2Governance and operating modelDefines who is accountable, who decides and how AI use is overseen: owners, the governance committee, the register, the lines of...3Risk, assurance and transparencyCovers how AI risk is assessed and managed for each use case: impact assessments, tiering, the lifecycle and its gates, transparency and...4Data, knowledge and semanticsCovers the data and knowledge AI depends on: quality, shared meaning, classification and handling, records of what AI did and why, and...5Platform, architecture and securityCovers where and how AI runs: the approved platform, AI-specific security controls, the approved tool and model list, third-party and...6Design and engineering practiceCovers how AI systems are designed, tested and released: specification before build, deliberate autonomy and human oversight, evaluation...7Use-case delivery and valueCovers how AI use cases are chosen, delivered, scaled and measured: intake and portfolio, lifecycle execution, pilot-to-scale...8People, capability and cultureCovers the people side of AI: foundational literacy, role-based capability, acceptable use, adoption and change, and a culture in which...

Part III. Running an assessment

Scoring methodHow a criterion is scored, how evidence confidence caps it, how criteria roll up to domain, layer and overall scores, and how targets,...Running an assessmentThe assessor-led process from kickoff to read-out: the timeline, who takes part, scope and edition, the four sources of evidence, the...Toolkit: survey, interviews, workshops and evidenceEverything an assessor needs to gather evidence: the staff survey (25 statements), interview guides for 9 roles, five workshops and the...

Part IV. From findings to roadmap

Initiative library and playbooks80 initiatives that close specific gaps, each with the criteria it lifts and by how much, prerequisites, effort, duration, owner and...Roadmap methodHow gaps become a sequenced, owned roadmap across four horizons from 90 days to 24 months: selecting initiatives, classing and...Findings, strategy and governance reportsThe three documents an assessment produces, the Findings Report, the AI Strategy and Roadmap, and the Governance and Operating Model...

Part V. Reference

Responsible AI overlay and standards mappingThe responsible AI overlay on every criterion, and the standards mapping: five responsible AI dimensions, Australia’s eight AI Ethics...Editions and obligationsThe Australian Government edition and Organisation edition: who each is for, the instruments each is anchored to, the criteria worded...Glossary111 terms and acronyms used in the model, its reports and its references, in plain English.References48 laws, policies, standards, frameworks and guidance cited by the model, each with its publisher, status, key dates and the date it was...

Questions, answered.

Who is the model for?

Leaders, risk and assurance teams, and transformation teams in any organisation that uses AI or plans to. The Australian Government edition and Organisation edition share the same criteria; the government edition adds the Commonwealth obligations and their dates.

Is it free to use?

Yes. Read the model online and run the assessment free, with no sign-in. Your answers stay in your browser: they are saved on your device, in a share link if you copy one, or in a file if you export them.

How long does an assessment take?

A first self-assessment of all 40 criteria takes about two hours with the right people in the room, and you can save your progress and come back. An assessor-led assessment with interviews, a staff survey and evidence review runs over about six weeks; the toolkit has everything it needs.

Is it a certification?

This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.

How does it relate to Governing Intelligence?

Governing Intelligence is our framework for governing and assuring AI. This model measures maturity across governance and the wider capability AI needs, and links every domain and criterion to the framework chapters that describe the practice. The AI governance assessment is the shorter, governance-only check.

How does Renly fit in?

Renly is a governed AI runtime, and some initiatives in the roadmap can be carried out with it. The model, the assessment and the reports stand on their own and recommend no product. Where Renly helps, and where it does not, is set out plainly in the docs.

Version 1.0.0. Authored by UHS Logic and Renly (XiPlatform Pty Ltd). The model generalises an assessment toolkit first built by the founder of Renly for an Australian Government department; nothing in it is specific to that department. Copyright 2026 Renly (XiPlatform Pty Ltd) and UHS Logic. All rights reserved. Licensed for use in Renly products and UHS Logic consulting engagements. Clients may reproduce outputs generated from this model for their own internal use. Do not republish the model itself without written permission. This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.