AI Capability Maturity Assessment · Part I. Understanding the model
How to use the model
In this chapter
What the model measures, how its domains, criteria and levels fit together, how to read a criterion, and the choices to make before you start: the mode, the scope, the edition and the targets. It ends with how the model fits alongside Governing Intelligence.
What the model is
The AI Capability Maturity Assessment measures how well an organisation can use AI safely, lawfully and to good effect. It rates 40 criteria across eight domains against five levels of maturity, on evidence rather than opinion, and turns the gaps into findings, a strategy and roadmap, and recommendations for governance and the operating model.
How it is structured
The eight domains sit in three layers. The layers set the order of work: foundations come first, because every other domain depends on decisions only leaders can make.
| Layer | What it holds | Domains | Sequencing rule |
|---|---|---|---|
| Foundations | Direction, accountability and people: the decisions and rules every other domain depends on. | 1. Strategy and leadership 2. Governance and operating model 8. People, capability and culture | Foundation gaps are closed first. No domain target in another layer may exceed the lower of the D1 and D2 targets by more than one level. |
| Ways of working | How use cases are assessed, governed and delivered day to day. | 3. Risk, assurance and transparency 7. Use-case delivery and value | Lifecycle, assessment and portfolio practices follow once owners, the committee and the register exist. |
| Practice | The data, platform and engineering disciplines that make AI safe to run and to extend. | 4. Data, knowledge and semantics 5. Platform, architecture and security 6. Design and engineering practice | Practice initiatives that raise a criterion to Level 4 wait until the related Level 3 ways-of-working are in place. |
Each domain has five criteria, and every criterion is rated on the same five levels: 1 Initial, 2 Repeatable, 3 Defined, 4 Managed and 5 Optimising.
Reading a criterion
Every criterion is written the same way, so an assessor can rate it and a reader can check the rating:
- Statement
- What good looks like, in one or two sentences.
- Why it matters
- The harm or waste that follows when it is weak.
- Five level descriptors
- What the criterion looks like at each level, from Initial to Optimising.
- Pass tests
- What must be true, and producible, to score levels 2 to 5. A level counts only when its pass test, and every lower one, is met.
- Evidence to request
- Documents, records of the practice operating, and what systems show.
- Interview probes
- Questions by role that test whether practice matches the documents.
- Red flags
- Signs that a claimed level is not real.
- Standards crosswalk
- Where the criterion meets ISO/IEC 42001, the EU AI Act and the NIST AI RMF.
- Edition notes
- What the criterion means for Australian Government and for other organisations, with dated obligations.
- Importance, scope and overlay
- Whether it is a foundation, core or enabling criterion, how it behaves in a function-scoped assessment, and its responsible AI dimension and AI Ethics Principles.
Three ways to run it
The same model serves three uses. The criteria and levels do not change; the evidence behind each score and the labelling of the results do.
| Mode | How it works | Scale | How results are labelled |
|---|---|---|---|
| Self-assessment renly.ai public web assessment | One respondent chooses, for each criterion, the level descriptor that best matches the organisation and states their confidence. No assessor sees evidence. | Whole levels 1 to 5. | Every output is labelled ‘Self-assessed and not validated’. Generated text uses ‘you reported’ rather than ‘the assessment found’. |
| Team assessment Renly in-app team assessment | Several people in the organisation answer independently. Evidence can be attached or linked to a criterion in the app. Answers are consolidated per criterion and disagreements are surfaced for discussion.
| Whole levels 1 to 5 for each respondent; the consolidated score may be a half level. | Outputs are labelled ‘Team-assessed’ with the number of respondents and the share of criteria with confirmed evidence. |
| Assessor-led assessment UHS Logic consulting pack | Two trained assessors gather evidence, interview, run the survey and workshops, score independently and moderate, following the validation rules below. | Levels 1 to 5 in half-level steps. | Outputs state the assessment period, the assessors, the evidence count and the validation steps completed. |
This site carries the self-assessment: the free assessment runs in your browser, and also takes assessor-led scores with half levels and staff survey results. Running an assessment sets out the full assessor-led process.
Enterprise or one function
An assessment covers either the whole enterprise or one business function. The criteria are the same in both; what changes is the evidence sampled and who owns the resulting initiatives.
| Scope | When to use it |
|---|---|
| Whole enterprise | All business units, all AI however acquired. The default, and required for the government edition’s obligations view. |
| One business function | A named function such as finance, marketing, customer service, human resources or a program area. Use when a function is moving faster than the enterprise, or to pilot the assessment before an enterprise-wide run. |
In a function-scoped assessment each criterion behaves in one of three ways:
| Behaviour | Rule | Criteria |
|---|---|---|
| Enterprise-level | Assessed once for the enterprise. In a function-scoped assessment the enterprise score is inherited; if no enterprise score exists, assess the enterprise arrangement as it stands and label the score ‘enterprise, assessed from the function’. Initiatives that lift these criteria are flagged ‘enterprise action’ because the function cannot deliver them alone. | 1.1, 1.2, 1.3, 1.5, 2.2, 2.4, 5.1, 5.2 |
| Enterprise arrangement, applied locally | The arrangement is enterprise-wide but its application is local. In a function-scoped assessment, score how the arrangement operates within the function, using the function’s use cases, people and records. The function score may not exceed the enterprise score by more than one level where an enterprise score exists, because local practice cannot be more mature than the mechanism it depends on. | 1.4, 2.1, 2.3, 2.5, 3.1, 3.2, 3.3, 3.4, 3.5, 4.3, 4.5, 5.3, 5.4, 7.1, 7.5, 8.1, 8.2, 8.3, 8.5 |
| Local practice | Assessed on the use cases, data, systems and people within the scope. In an enterprise assessment, sample across business units and score the typical practice, naming the strongest and weakest areas in the finding. | 4.1, 4.2, 4.4, 5.5, 6.1, 6.2, 6.3, 6.4, 6.5, 7.2, 7.3, 7.4, 8.4 |
Two editions
| Edition | Applies to |
|---|---|
| Australian Government edition | Non-corporate Commonwealth entities and other Australian Government bodies that apply the Policy for the responsible use of AI in government. State and territory agencies can use it, noting that Commonwealth instruments may not bind them. |
| Organisation edition | Australian companies, not-for-profits and other organisations outside the Commonwealth policy framework, including suppliers to government and organisations that export to or operate in the European Union. |
The criteria, levels and scoring are the same in both. The editions differ in their notes, references and dated obligations, and in the wording of a few criteria; see Editions and obligations.
Choosing targets
- Level 3 is the realistic 12 to 24 month target for most organisations and is the level at which most current obligations are met by design.
- Level 4 is warranted where AI acts with supervised autonomy, makes or shapes decisions about people at scale, or handles sensitive information. The step from 3 to 4 is where assurance moves from reviewing outputs to governing systems at runtime.
- Level 5 is rarely the right target for every domain. Targets should follow the risk and ambition of the AI the organisation actually runs.
Targets are set per domain from an ambition preset and a time frame, then translated into criterion targets. The target-setting rules keep them realistic: a pace limit per year, foundations first, and obligation floors.
With Governing Intelligence
Governance and maturity answer different questions. Governance asks whether the organisation’s AI is safe, lawful and accountable today: are the obligations met and can it prove it. Maturity asks how capable the organisation is at using AI well, and what to do next to improve. An organisation can be compliant and immature (controls in place, but slow, manual and dependent on a few people) or capable and exposed (strong delivery, weak governance). Leaders need both answers.
- Governing Intelligence is the governance framework: five domains (Strategy, Operating Model, Architecture, Design, Governance) that say what good governance requires, with a free 20-question governance assessment that produces a draft strategy.
- This maturity assessment measures capability across eight domains and five levels with evidence, then turns the gaps into a prioritised roadmap. Its Level 3 pass tests are where most governance obligations are met by design.
- Every maturity domain and criterion links to the Governing Intelligence chapters that explain the underlying practice, and to the governance assessment questions that test the same thing at a higher level.
- Run the free governance assessment first for a fast read of exposure; run this maturity assessment to get an evidenced baseline, targets and a roadmap. Re-run both after each roadmap horizon.
Governance weak, maturity high
Capable delivery running ahead of its controls; the most dangerous combination.
Pause any increase in autonomy until assessments, gates, records and halt are in place for existing systems.
Governance strong, maturity high
Governed capability; ready for supervised autonomy where evidence supports it.
Scale with confidence: grant autonomy on measured performance and share practice externally.
Governance weak, maturity low
Exposed and not yet able to fix it quickly.
Mobilise: owners, committee, register, acceptable use and the obligations due first. Foundations before anything else.
Governance strong, maturity low
Compliant on paper, but practice is manual and fragile.
Embed: measure and enforce controls in systems, build the enabling team, reduce key-person dependency.
Where the two models meet
| Governing Intelligence domain | Maturity domains | What they share |
|---|---|---|
| Strategy | 1. Strategy and leadership 7. Use-case delivery and value | Direction, appetite and the use-case portfolio. |
| Operating Model | 2. Governance and operating model 8. People, capability and culture | Accountability, the committee, assurance lines, capability and culture. |
| Architecture | 4. Data, knowledge and semantics 5. Platform, architecture and security | Data, decision records, the secure platform and third-party containment. |
| Design | 6. Design and engineering practice | Specification, autonomy gates, human participation and safe design. |
| Governance | 3. Risk, assurance and transparency 2. Governance and operating model | Register, impact assessment, runtime controls and incidents. |
Read Governing Intelligence, take the AI governance assessment, or see how Renly maps to the framework.
Authorship and citation
Authored by UHS Logic and Renly (XiPlatform Pty Ltd). The model generalises an assessment toolkit first built by the founder of Renly for an Australian Government department; nothing in it is specific to that department.
How to cite: AI Capability Maturity Assessment, version 1.0.0, Renly (XiPlatform Pty Ltd) and UHS Logic, October 2026.
Copyright 2026 Renly (XiPlatform Pty Ltd) and UHS Logic. All rights reserved. Licensed for use in Renly products and UHS Logic consulting engagements. Clients may reproduce outputs generated from this model for their own internal use. Do not republish the model itself without written permission.
This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.