AI Capability Maturity Assessment · Part II. The eight domains

Domain 2 · Foundations layerGovernance and operating model

20 minute read · Version 1.0.0 · five criteria

In this chapter

Defines who is accountable, who decides and how AI use is overseen: owners, the governance committee, the register, the lines of assurance and decision rights.

What this domain covers
The domain at each level
Risks when it is weak
The five criteria
2.1 Accountable owners
2.2 AI governance committee
2.3 Use-case register
2.4 Three lines of assurance
2.5 Decision rights and escalation
In Governing Intelligence

What this domain covers

Defines who is accountable, who decides and how AI use is overseen: owners, the governance committee, the register, the lines of assurance and decision rights.

Governance turns strategy into decisions that stick. Named owners, a committee that decides rather than discusses, and a register that reflects reality are the minimum needed to answer the questions every auditor asks: what AI do you use, who is accountable for each use, and who decided it could proceed. Without them, controls exist on paper and nobody runs them.

Initiatives for this domain are run through the Governance and assurance and Operating model playbooks.

The domain at each level

A summary of what the domain looks like at each level. Each criterion below has its own descriptors and pass tests: score the criteria, not this summary. The domain score is calculated from them (see domain aggregation).

Level	What it looks like
1Initial	No accountable owners, register or governance forum. Nobody can list the AI in use or say who approved it. Decisions are made in projects or by email and cannot be traced.
2Repeatable	Some owners are named and an informal list of AI projects exists. A working group meets but discusses rather than decides. Embedded vendor AI and staff use of general-purpose tools are missing from the list. Assurance happens when someone asks for it.
3Defined	Every in-scope use case has a named accountable owner. A committee with terms of reference and decision rights meets at least monthly and keeps a decision log. The register is complete after a discovery sweep, including embedded AI. Three lines of assurance are assigned, and decision rights and escalation are written down.
4Managed	The committee decides at gates on evidence, including refusals and conditions tracked to closure. The register is fed by intake and procurement, reconciled regularly and audited. Internal audit has completed an AI audit. Owners present their own submissions and attest annually.
5Optimising	Governance is built into how work runs: decision rights are encoded in tooling, the register is a live system of record, standard decisions are delegated by rule, and the committee spends its time on exceptions and trends. Governance evidence feeds strategy and appetite.

Risks when it is weak

AI in use that nobody knows about, so it is never assessed
Use cases with no accountable owner when something goes wrong
A committee that becomes a talking shop and gates that become theatre
Decisions that stall because two roles think they are accountable, or neither does
Controls that exist technically but are never reviewed

The five criteria

No.	Criterion	Importance	Scope
2.1	Accountable owners	Foundation	Enterprise arrangement, applied locally
2.2	AI governance committee	Foundation	Enterprise-level
2.3	Use-case register	Foundation	Enterprise arrangement, applied locally
2.4	Three lines of assurance	Enabling	Enterprise-level
2.5	Decision rights and escalation	Core	Enterprise arrangement, applied locally

Criterion 2.1

Accountable owners

Accountability for AI is assigned to named people: an accountable executive or official for the AI program, and a single accountable owner for each AI use case, recorded centrally and kept current.

Why it matters

Accountability that belongs to a team, a vendor or a committee belongs to nobody. A single named owner per use case is the person who answers for its outcomes, makes sure its controls run, and decides when it should change or stop.

The five levels

Level	What it looks like	To score this level
1Initial	Nobody is recorded as accountable for AI use cases. Asked who owns one, interviewees name a team, a vendor or ‘IT’.	The starting point: no test.
2Repeatable	Owners are named for some prominent use cases, often the project manager rather than a business executive. Ownership is not recorded centrally and lapses when people move.	At least one AI use case has a named owner on record.
3Defined	Every in-scope use case on the register names one accountable owner of appropriate seniority. Owners have been briefed and have acknowledged the role in writing, and changes of owner are recorded within 30 days.	Every in-scope register entry names one owner, and written acknowledgements exist for a sample of five owners.
4Managed	Owners perform the role: they present their own gate submissions, sign off reviews and attest annually. Ownership gaps (for example when an owner leaves) are detected and fixed within a defined time.	Owners presented their own gate submissions in the last 12 months, annual attestations are complete, and the process for detecting ownership gaps has been used.
5Optimising	Ownership is written into position descriptions and performance agreements for business leaders, and owners retire or reshape their use cases on monitoring evidence without being prompted.	Owner accountabilities appear in position descriptions, and at least one owner-initiated retirement or reshape is recorded.

Evidence to request

Documents

Designation or appointment records
Owner role description and briefing material

Records of it operating

Register owner field
Owner acknowledgements
Annual owner attestations
Owner change log

In systems

Link between the leaver process and the register (optional)

In the evidence request: ER-2-01.

Interview probes

Use-case owner or business leadDid you know you are the accountable owner for this use case? What does that require of you?
Executive sponsor or Chief AI OfficerWho is accountable for AI overall, and who would answer to an inquiry about a specific use?
Risk, compliance and internal auditWhat happens to ownership of a use case when its owner leaves?

Staff survey items: S04 I know who to ask for a decision about using AI in my work.

Red flags

The owner on record is a vendor or a committee
Owners are unaware that they are owners
One person owns most of the use cases

Standards crosswalk

ISO/IEC 42001: Clause 5.3Annex A.3
EU AI Act: Article 26
NIST AI RMF: GOVERN 2

Government and organisation editions

Australian Government edition

In this edition the criterion readsAccountable officials for implementing the Policy are designated and the DTA is told of changes, and each in-scope AI use case has a single accountable use-case owner, recorded on the register and kept current.

Under Policy v2.0, accountable officials answer for implementing the policy and sit in the strategic layer. By 15 December 2026, each in-scope use case needs an accountable use-case owner.

Dated obligations

15 December 2026Accountable use-case owner for each in-scope use case (Policy v2.0)Met at level 3 (Defined) or higher

References

Policy for the responsible use of AI in government, version 2.0Accountable officials; accountable use-case owner for each in-scope use case by 15 December 2026

Organisation edition

ISO/IEC 42001 requires roles and responsibilities for AI to be defined and allocated. The Guidance for AI Adoption starts with deciding who is accountable. Under the EU AI Act, deployers of high-risk systems must assign human oversight to people with the necessary competence and authority.

References

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClause 5.3; Annex A.3
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN 2
Guidance for AI AdoptionDecide who is accountable
Voluntary AI Safety StandardGuardrail 1
Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)Article 26, deployers of high-risk systems

In Governing Intelligence

6.2Accountable officials and decision rights

In the AI governance assessment: Our accountable officials and Chief AI Officer are named, empowered and known to the DTA, and each in-scope use case has an accountable owner.

Initiatives that lift it

I-201 Name an accountable owner for every AI use case (level 1 to 3)
I-210 Run annual owner attestation and close ownership gaps (level 3 to 4)

Rate 2.1 in the assessment Back to top

Criterion 2.2

AI governance committee

ImportanceFoundation ScopeEnterprise-level Responsible AIGovernance and accountability AI Ethics PrinciplesAccountability

A governance body with terms of reference, cross-functional membership and decision rights decides on AI use cases, risk tiers, gates, approved tools and exceptions, and keeps a decision log.

Why it matters

Cross-functional decisions need a forum that can make them. Without one, security, privacy, legal and business views are collected one by one, conflicts are never resolved, and decisions are made by whoever is most persistent.

The five levels

Level	What it looks like	To score this level
1Initial	No forum governs AI. Decisions about AI use are made within project teams, by individual managers or by email.	The starting point: no test.
2Repeatable	A working group or community of practice meets, but it discusses rather than decides: no terms of reference with decision rights, irregular attendance and no decision log.	Agendas or notes from at least two meetings of an AI working group in the last six months.
3Defined	A committee operates under endorsed terms of reference with named decision rights, membership that includes security, privacy, legal, data, risk and business areas, a quorum rule, at least a monthly cadence and a decision log.	Endorsed terms of reference with decision rights, minutes of at least three meetings in the last six months, and a decision log.
4Managed	The decision log shows the committee deciding at gates on evidence, including conditional approvals and refusals. Conditions are tracked to closure, and attendance and decision turnaround are measured.	The decision log includes conditional approvals or refusals that reference evidence, conditions are tracked to closure, and decision turnaround is measured.
5Optimising	Standard decisions are delegated by clear rules, so the committee spends most of its time on exceptions and trends. It reviews its own effectiveness each year and changes how it works as a result.	A documented annual effectiveness review with changes made, and written delegation rules for standard decisions.

Evidence to request

Documents

Terms of reference
Membership list
Delegation rules for standard decisions

Records of it operating

Agendas, papers and minutes for the last six months
Decision log
Conditions tracker
Effectiveness review

In the evidence request: ER-2-02.

Interview probes

Executive sponsor or Chief AI OfficerWhat has the committee refused or approved with conditions, and why?
Legal, privacy and records leadDo you attend, and do you receive papers early enough to give real advice?
Use-case owner or business leadHow long did it take to get a decision on your use case, and was the decision clear?

Red flags

The committee has never refused or conditioned anything
Terms of reference exist but contain no decision rights
Quorum is rarely met, or decisions appear in minutes but not in the log

Standards crosswalk

ISO/IEC 42001: Clause 5.1Clause 5.3Annex A.3
EU AI Act: No direct mapping
NIST AI RMF: GOVERN 2

Government and organisation editions

Australian Government edition

Policy v2.0 expects AI incident processes to be overseen by a governance body by 15 December 2026 and high-risk use cases to be governed through a board or senior executive; the committee is the natural home for both. The ANAO’s criteria look for enterprise-wide accountabilities.

References

Policy for the responsible use of AI in government, version 2.0AI incident processes overseen by a governance body; high-risk use cases
Auditor-General Report No. 26 2024-25: Governance of Artificial Intelligence at the Australian Taxation OfficeEnterprise-wide accountabilities

Organisation edition

ISO/IEC 42001 requires leadership commitment and assigned authorities for the AI management system; a committee with decision rights is the usual way to provide both.

References

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClauses 5.1 and 5.3; Annex A.3
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN 2
A Director’s Guide to AI Governance (Version 2)

In Governing Intelligence

In the AI governance assessment: Our AI Governance Committee meets, and its minutes show decisions.

Initiatives that lift it

I-202 Establish the AI governance committee with decision rights (level 1 to 3)
I-208 Delegate standard decisions and route approvals through tooling (level 3 to 4)
I-209 Stand up the AI centre of excellence (level 2 to 3)

Rate 2.2 in the assessment Back to top

Criterion 2.3

Use-case register

ImportanceFoundation ScopeEnterprise arrangement, applied locally Responsible AIGovernance and accountability AI Ethics PrinciplesAccountability; Transparency and explainability

A register records every AI use case, including AI embedded in purchased products and staff use of general-purpose tools, with owner, purpose, tier, lifecycle stage and assessment status, and periodic discovery keeps it current.

Why it matters

Nothing can be governed that is not known about. Obligations attach to AI use however it was acquired, and an auditor will not distinguish between AI the organisation chose and AI it absorbed through a product update.

The five levels

Level	What it looks like	To score this level
1Initial	There is no register of AI use. Nobody in the organisation can produce a list of the AI currently in use.	The starting point: no test.
2Repeatable	A list exists, often a spreadsheet of projects, covering deliberate projects only. Embedded vendor AI and staff use of general-purpose tools are absent, and fields and currency vary.	A list of AI projects or tools can be produced.
3Defined	A register with defined fields (owner, purpose, tier, stage, assessment status, data used, vendor) covers deliberate and embedded AI. A discovery sweep of procurement, software features, analytics teams and staff use has been run in the last 12 months and its findings added.	The register can be exported with all defined fields populated for at least 90 percent of entries, and a discovery sweep record from the last 12 months shows embedded AI was searched for.
4Managed	Intake and procurement processes create register entries, so new AI cannot be adopted without one. Discovery runs at least twice a year, the register is reconciled with procurement records and the approved tool list, and variances are resolved.	Evidence that intake or procurement creates register entries, and a reconciliation in the last six months with its variances resolved.
5Optimising	The register is a live system of record linked to runtime telemetry: agents and automations register themselves, inactive entries are flagged, and the register produces the transparency statement and review schedule without manual compilation.	Register entries are created and updated from runtime systems, and the transparency statement or review schedule is generated from the register.

Evidence to request

Documents

Register field definitions
Discovery sweep method

Records of it operating

Register export
Discovery sweep results
Reconciliation records against procurement and the approved tool list

In systems

Intake or procurement workflow that creates register entries
Runtime registration of agents and automations

In the evidence request: ER-2-03.

Interview probes

CIO or CTOIf a vendor switched on an AI feature inside a product you already use, how would it get onto the register?
Chief Data Officer or data ownerWhich analytics or machine learning models are in operational use, and are they all on the register?
Frontline staffWhich AI tools do you use for work, including features built into other software?

Red flags

The register count is far below the tool use staff report in the survey
There are no entries for AI embedded in purchased products
The register has not been updated for more than six months

Standards crosswalk

ISO/IEC 42001: Annex A.4Annex A.6
EU AI Act: Article 49
NIST AI RMF: GOVERN 1

Government and organisation editions

Australian Government edition

Policy v2.0 requires an internal register of in-scope AI use cases, owners, assessments and mitigations by 15 December 2026, shared with the DTA every six months. The ISM added controls for an AI agent register in September 2026.

Dated obligations

15 December 2026Internal register of in-scope AI use cases (Policy v2.0)Met at level 3 (Defined) or higher

References

Policy for the responsible use of AI in government, version 2.0Internal register of in-scope use cases, shared with the DTA every six months
Information Security ManualAI agent register (September 2026)

Organisation edition

The NIST AI RMF expects mechanisms to inventory AI systems. ISO/IEC 42001 requires AI system resources and life cycles to be documented. Providers and certain deployers of high-risk systems in the EU must register them in the EU database.

References

Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN 1 (inventory of AI systems)
ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemAnnex A.4 and A.6
Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)Article 49 registration, high-risk systems only

In Governing Intelligence

13.2Find the AI you already have

In the AI governance assessment: Our register is complete, including discovered and embedded AI.

Initiatives that lift it

I-203 Open the register and run the first discovery sweep (level 1 to 3)
I-204 Feed the register from intake and procurement, and reconcile it (level 3 to 4)

Rate 2.3 in the assessment Back to top

Criterion 2.4

Three lines of assurance

ImportanceEnabling ScopeEnterprise-level Responsible AIGovernance and accountability AI Ethics PrinciplesAccountability

Three lines of assurance are assigned for AI: business owners operate the controls, risk, privacy and security functions oversee them, and internal audit assures them independently.

Why it matters

Controls that are never independently tested drift into controls that exist only on paper. Clear lines also stop oversight functions from doing first-line work, which leaves nobody independent.

The five levels

Level	What it looks like	To score this level
1Initial	Nobody is assigned to assure AI use, no oversight function reviews it, and internal audit has not considered it.	The starting point: no test.
2Repeatable	Second-line functions review some AI projects on request. Internal audit has noted AI as an emerging risk but has no planned AI work.	At least one second-line review of an AI project can be produced.
3Defined	An assurance map assigns AI responsibilities to each line with named functions. Second-line review is built into the lifecycle, and AI appears in the internal audit plan within the next 18 months.	An assurance map naming the function for each line, and an internal audit plan that includes AI within 18 months.
4Managed	Internal audit has completed at least one AI audit with findings tracked to closure, and second-line functions test that first-line controls operate, not just that they exist.	A completed internal AI audit report with findings tracked to closure, and at least one second-line control test record.
5Optimising	Assurance is continuous: second-line monitoring uses runtime evidence, combined assurance reports go to the audit and risk committee, and audit findings change the framework itself.	A combined assurance report using runtime evidence, and a framework change traced to an audit finding.

Evidence to request

Documents

AI assurance map
Internal audit plan

Records of it operating

AI audit report and findings tracker
Second-line control test records
Audit and risk committee papers on AI

In the evidence request: ER-2-04.

Interview probes

Risk, compliance and internal auditWhen will internal audit next look at AI, and against what criteria?
CISO or security leadWhich AI controls do you test yourselves, and which do you rely on the owner for?
Executive sponsor or Chief AI OfficerWhat has the audit and risk committee asked about AI in the last year?

Red flags

The second line does the first line’s work, so nobody is independent
The internal audit plan is silent on AI
Audit reviewed the policy but never tested whether controls operate

Standards crosswalk

ISO/IEC 42001: Clause 9.2
EU AI Act: No direct mapping
NIST AI RMF: GOVERN 1GOVERN 4

Government and organisation editions

Australian Government edition

The ANAO now audits AI governance directly. Its audit of the ATO found arrangements only partly effective; its audit of IP Australia found a largely effective agency and still recommended stronger AI cyber-security governance and risk-based monitoring. Internal audit should test against the same criteria first.

References

Organisation edition

ISO/IEC 42001 requires internal audits of the AI management system. Prudentially regulated entities should align AI assurance with their operational risk obligations.

References

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClause 9.2 internal audit
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN function
Beware the gap: Governance arrangements in the face of AI innovation (ASIC Report 798)
Prudential Standard CPS 230 Operational Risk ManagementOperational risk management, for APRA-regulated entities

In Governing Intelligence

6.4Three lines of assurance

In the AI governance assessment: The three lines of assurance are assigned for AI.

Initiatives that lift it

I-205 Map the lines of assurance and put AI in the audit plan (level 1 to 3)
I-206 Complete the first internal audit of AI governance (level 3 to 4)

Rate 2.4 in the assessment Back to top

Criterion 2.5

Decision rights and escalation

ImportanceCore ScopeEnterprise arrangement, applied locally Responsible AIGovernance and accountability AI Ethics PrinciplesAccountability

Decision rights for AI are written down (who approves a use case, a tool, a model change or an exception), follow a single-owner rule, and an escalation path is defined and used.

Why it matters

Unclear decision rights produce two failures: decisions stall because nobody knows who decides, or they are made by the wrong person because nobody stopped them. Both are common in AI, where decisions cut across technology, risk and business lines.

The five levels

Level	What it looks like	To score this level
1Initial	Nobody can say who approves a new AI use or tool. Decisions are made by whoever holds the budget.	The starting point: no test.
2Repeatable	Some decisions are clear (for example IT approves software), but AI-specific decisions such as tiering, model changes and exceptions have no owner, so they stall or bypass review.	At least some AI decisions have a documented approver.
3Defined	A RACI covers the main AI decisions with one accountable role each. Decision categories (standard, use case, platform, strategic) are defined with who decides and indicative turnaround, and the escalation path is documented.	A RACI with a single accountable role per decision, and documented decision categories with an escalation path.
4Managed	Escalations are logged with outcome and time taken. The RACI is tested against real cases at least annually, and standard decisions are delegated so the committee sees only what needs it.	An escalation log for the last 12 months (or a record that none occurred) and an annual test of the RACI against real cases.
5Optimising	Decision rights are encoded in tooling (approval routing, autonomy settings, policy checks) so the right person is asked automatically, and changes to decision rights follow a controlled process.	Approval routing or autonomy configuration in tooling that implements the RACI, with a change record.

Evidence to request

Documents

AI RACI
Decision categories and turnaround
Escalation path

Records of it operating

Escalation log
Worked examples or RACI test record

In systems

Approval routing configuration in workflow or agent platforms

In the evidence request: ER-2-05.

Interview probes

Use-case owner or business leadWho approved your use case, and who would approve a change to its model?
CIO or CTOWalk me through what happens when a vendor switches on a new AI feature.
Risk, compliance and internal auditShow me an escalation from the last six months and how it was resolved.

Staff survey items: S04 I know who to ask for a decision about using AI in my work.

Red flags

Two roles are accountable for the same decision
Escalation happens only through personal relationships
Exceptions are approved by the requester’s own manager

Standards crosswalk

ISO/IEC 42001: Clause 5.3Annex A.3
EU AI Act: No direct mapping
NIST AI RMF: GOVERN 2

Government and organisation editions

Australian Government edition

Clear decision rights are how an agency shows the ANAO enterprise-wide accountabilities, and how high-risk uses reach the board or senior executive that Policy v2.0 requires to govern them.

References

Policy for the responsible use of AI in government, version 2.0High-risk use cases
Auditor-General Report No. 26 2024-25: Governance of Artificial Intelligence at the Australian Taxation OfficeEnterprise-wide accountabilities

Organisation edition

ISO/IEC 42001 requires responsibilities and authorities for AI to be assigned and communicated.

References

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClause 5.3; Annex A.3
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN 2
Guidance for AI AdoptionDecide who is accountable

In Governing Intelligence

Initiatives that lift it

I-207 Write decision rights, a RACI and the escalation path (level 1 to 3)
I-208 Delegate standard decisions and route approvals through tooling (level 3 to 4)

Rate 2.5 in the assessment Back to top

In Governing Intelligence

The framework chapters that describe the practice this domain measures, and the governance assessment questions that test it at a higher level.

In the AI governance assessment: Our accountable officials and Chief AI Officer are named, empowered and known to the DTA, and each in-scope use case has an accountable owner. Our AI Governance Committee meets, and its minutes show decisions. Our register is complete, including discovered and embedded AI. The three lines of assurance are assigned for AI.

This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.