AI Capability Maturity Assessment · Part II. The eight domains
Domain 8 · Foundations layerPeople, capability and culture
In this chapter
Covers the people side of AI: foundational literacy, role-based capability, acceptable use, adoption and change, and a culture in which people report problems and keep meaningful control.
What this domain covers
Covers the people side of AI: foundational literacy, role-based capability, acceptable use, adoption and change, and a culture in which people report problems and keep meaningful control.
People decide whether AI is used well. Staff without training over-trust or avoid AI; staff without clear rules use whatever tools they find; reviewers without the skills approve what they do not understand. A culture that punishes reporting hides the near misses that would prevent the next incident. AI literacy is now an explicit obligation for Australian Government staff and, under the EU AI Act, for organisations that provide or deploy AI in the EU.
Initiatives for this domain are run through the Operating model and People and adoption playbooks.
The domain at each level
A summary of what the domain looks like at each level. Each criterion below has its own descriptors and pass tests: score the criteria, not this summary. The domain score is calculated from them (see domain aggregation).
| Level | What it looks like |
|---|---|
| 1Initial | No AI training or acceptable-use rules. AI capability depends on a few enthusiasts or a vendor. Staff either distrust AI or rely on it without checking, and problems go unreported. |
| 2Repeatable | Training is available but optional and completion is low. Rules sit inside a long ICT policy. Champions help informally. Adoption is measured by licence counts. Some staff report problems, but nothing visible happens. |
| 3Defined | Foundational training is mandatory and at least 80 percent complete. A short acceptable-use policy is published and known by most staff. Capability needs are mapped with a sourcing plan and role-based learning. A resourced champion network covers every major area, and a visible channel exists for raising AI concerns, with every report answered. |
| 4Managed | Training completion is above 95 percent and its effectiveness is measured. Acceptable use is monitored and awareness is above 85 percent. Capability is measured against the map and approvers are trained before they act. Adoption is measured by meaningful use. Near-miss reporting is healthy and reports lead to visible changes. |
| 5Optimising | Learning and speaking up about AI are part of the culture. Rules are embedded in tools at the point of use. Staff help redesign work around AI and take part in evaluation. The organisation develops and shares AI capability beyond its own walls. |
Risks when it is weak
- Sensitive information entered into public AI tools
- Over-reliance on unverified outputs, or rejection of useful tools
- Approvers and reviewers who cannot judge what they approve
- Key-person dependency on one or two experts or a vendor
- Near misses hidden until they become incidents
The five criteria
| No. | Criterion | Importance | Scope |
|---|---|---|---|
| 8.1 | Foundational AI literacy | Foundation | Enterprise arrangement, applied locally |
| 8.2 | Role-based capability | Enabling | Enterprise arrangement, applied locally |
| 8.3 | Acceptable use | Foundation | Enterprise arrangement, applied locally |
| 8.4 | Adoption and change | Enabling | Local practice |
| 8.5 | Reporting culture and calibrated trust | Core | Enterprise arrangement, applied locally |
Criterion 8.1
Foundational AI literacy
All staff complete foundational training on using AI responsibly (what it can and cannot do, information rules, checking outputs and reporting problems), completion is tracked, and it is required before access to AI tools.
Why it matters
Untrained staff over-trust AI or avoid it. Foundational literacy is the cheapest control available, and it is now required for Australian Government staff and expected of organisations that provide or deploy AI in the EU.
The five levels
| Level | What it looks like | To score this level |
|---|---|---|
| 1Initial | No AI training is offered. Staff learn how to use AI, and what to avoid, from vendors, colleagues or the internet. | The starting point: no test. |
| 2Repeatable | Training is available but optional, completion is untracked or below half of staff, and the content is tool how-to rather than responsible use. | An AI training module is available to staff. |
| 3Defined | Foundational training is mandatory for all staff and covers responsible use, information handling, verification and reporting. Completion is tracked by business area and is at least 80 percent, and new staff complete it before receiving access to approved tools. | A completion report by business area showing at least 80 percent overall, content covering the required topics, and evidence that tool access follows completion for new staff. |
| 4Managed | Completion is above 95 percent and sustained. Training effectiveness is measured (assessment results, survey confidence, error rates), and content is updated at least yearly from incidents and new tools. | Completion above 95 percent, effectiveness measures, and a content update in the last 12 months. |
| 5Optimising | Literacy is built into role onboarding and performance, staff help shape the content, and measured behaviour (for example correct handling of sensitive information) improves year on year. | Two years of behaviour measures showing improvement. |
Evidence to request
Documents
- Training curriculum and content
- Policy linking tool access to completion
Records of it operating
- Completion reports by business area
- Assessment results
- Content update history
In systems
- Learning system records; access provisioning linked to completion
In the evidence request: ER-8-01.
Interview probes
- Frontline staffWhat did your AI training teach you to check before relying on an output?
- Executive sponsor or Chief AI OfficerWhat percentage of staff have completed AI training, and how do you know?
- CISO or security leadIs access to AI tools tied to completing the training?
Staff survey items: S11 The AI training I have received prepared me to use AI tools safely.
; S12 I check AI outputs for accuracy before I rely on them or pass them on.
; S13 I can recognise when an AI tool should not be used for a task.
Red flags
- Completion counted as enrolment
- Training is a vendor product demonstration
- Executives exempt themselves
Standards crosswalk
- ISO/IEC 42001
- Clause 7.2Clause 7.3
- EU AI Act
- Article 4
- NIST AI RMF
- GOVERN 2
Government and organisation editions
Australian Government edition
Policy v2.0 requires mandatory training for all staff on responsible AI use by 15 December 2026, and the APS AI Plan makes foundational AI literacy training mandatory. The DTA’s AI fundamentals training module can be used as provided or adapted.
Dated obligations
- 15 December 2026Mandatory responsible-AI training for all staff (Policy v2.0)Met at level 3 (Defined) or higher
References
- Policy for the responsible use of AI in government, version 2.0Mandatory staff training by 15 December 2026
- AI Plan for the Australian Public Service 2025Mandatory foundational AI literacy training
Organisation edition
Under the EU AI Act as amended by Regulation (EU) 2026/1744, providers and deployers of AI systems must take measures to support the development of AI literacy; no specific level is required of any individual. ISO/IEC 42001 requires competence and awareness for people doing work that affects AI performance.
Dated obligations
- 2 February 2025Measures to support AI literacy for providers and deployers (EU AI Act Article 4)Met at level 3 (Defined) or higherApplies where the EU AI Act reaches you
References
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)Article 4 AI literacy, as amended in 2026
- ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClauses 7.2 and 7.3
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN 2
- Guidance for AI Adoption
In Governing Intelligence
In the AI governance assessment: Each of the six AI governance capabilities has an accountable home, and mandatory staff AI training is on schedule.
Initiatives that lift it
Criterion 8.2
Role-based capability
The capabilities AI work requires (AI product ownership, evaluation, data stewardship, AI risk and assurance, AI security, agent design) are mapped to accountable homes, sourced, and developed through role-based learning.
Why it matters
Governance and delivery need specialist skills that most organisations lack. Without a capability map, the organisation depends on one or two people or a vendor, and owners, approvers and reviewers act in roles they were never prepared for.
The five levels
| Level | What it looks like | To score this level |
|---|---|---|
| 1Initial | There is no view of AI capability needs. The organisation relies on one or two enthusiasts or a vendor. | The starting point: no test. |
| 2Repeatable | Some specialist roles exist or are contracted, but needs are not mapped and key-person dependency is high. | At least one specialist AI role exists or is contracted. |
| 3Defined | A capability map identifies the roles and skills needed, where each sits, current gaps and a sourcing plan (build, buy or borrow). Role-based learning paths exist for owners, reviewers and builders. | A capability map with gaps and a sourcing plan, and role-based learning paths for owners, reviewers and builders. |
| 4Managed | Capability is measured against the map (roles filled, skills certified, reliance on contractors) and reported. Key-person risks have mitigations, and reviewers and approvers are trained for their role before they act. | A capability report against the map, key-person risk mitigations, and training records for every approver and reviewer of high-tier systems. |
| 5Optimising | AI capability is developed and retained systematically through career paths and communities of practice with measured output, and the organisation contributes capability to partners or its sector. | An AI career path in place, and a documented contribution of capability to a partner or sector body. |
Evidence to request
Documents
- AI capability map
- Gap analysis and sourcing plan
- Role-based learning paths
Records of it operating
- Capability reports
- Training records for owners, approvers and reviewers
- Key-person risk register entries
In the evidence request: ER-8-02.
Interview probes
- Executive sponsor or Chief AI OfficerIf your two most AI-capable people left tomorrow, what would stop?
- Use-case owner or business leadWhat preparation did you receive for the owner role?
- Engineering or architecture leadWho evaluates AI systems here, and how did they learn to?
Staff survey items: S23 I understand how AI is changing my role, and I have had a say in how it is used in my team.
; S24 I have the skills I need for the AI-related parts of my role.
Red flags
- A vendor holds all the knowledge
- Approvers of high-tier systems have no training for the role
- No evaluation skills in-house
Standards crosswalk
- ISO/IEC 42001
- Clause 7.2Annex A.4
- EU AI Act
- Article 26
- NIST AI RMF
- GOVERN 2GOVERN 3
Government and organisation editions
Australian Government edition
The APS AI Plan’s people pillar includes senior leader capability support and Chief AI Officer communities of practice. Policy v2.0 expects owners of high-risk use cases to be able to identify and manage risks and emerging issues.
References
- AI Plan for the Australian Public Service 2025People pillar
- Policy for the responsible use of AI in government, version 2.0Accountable use-case owners of high-risk use cases
Organisation edition
ISO/IEC 42001 requires the competence of people whose work affects AI to be determined and ensured. Deployers of high-risk systems in the EU must assign oversight to people with the necessary competence, training and authority.
References
- ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClause 7.2; Annex A.4
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN 2
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)Article 26, deployers of high-risk systems
In Governing Intelligence
In the AI governance assessment: Each of the six AI governance capabilities has an accountable home, and mandatory staff AI training is on schedule.
Initiatives that lift it
Criterion 8.3
Acceptable use
A short, clear acceptable-use policy tells staff which AI tools they may use, what information they may enter, that they own what they send, and when to disclose AI assistance, and it is known and followed.
Why it matters
Most AI harm in everyday work comes from ordinary use: the wrong information in the wrong tool, an unchecked draft sent as fact. A short policy that staff actually know is the first line of control.
The five levels
| Level | What it looks like | To score this level |
|---|---|---|
| 1Initial | There are no acceptable-use rules. Staff assume either that everything is allowed or that nothing is. | The starting point: no test. |
| 2Repeatable | Rules exist inside a long ICT policy or a one-off email. Staff awareness is low, and the rules lag the tools in use. | Written rules about AI use exist in some policy. |
| 3Defined | A standalone acceptable-use policy of one or two pages is published, references the approved tool list and ceilings, is acknowledged by staff, and survey results show at least 70 percent of staff know its main rules. | A standalone policy of no more than two pages, acknowledgement records, and survey awareness of at least 70 percent. |
| 4Managed | Compliance is monitored (detection of unapproved tools, sensitive information entry, sampled outputs), breaches are handled consistently, awareness is above 85 percent, and the policy is updated whenever tools or rules change. | A monitoring report from the last quarter, consistent breach handling records, survey awareness above 85 percent, and an update record. |
| 5Optimising | The policy is built into tools (prompts, warnings and blocks at the point of use) so the right behaviour is the easy one, and breaches are rare and declining. | Point-of-use controls configured in AI tools, and a declining breach trend over 12 months. |
Evidence to request
Documents
- Acceptable-use policy
- Communications to staff
Records of it operating
- Acknowledgement records
- Survey awareness results
- Monitoring and breach handling records
In systems
- Point-of-use warnings or blocks in AI tools (optional)
In the evidence request: ER-8-03.
Interview probes
- Frontline staffWhat are you not allowed to put into an AI tool?
- CISO or security leadHow many acceptable-use breaches were detected last quarter, and what happened to each?
- Legal, privacy and records leadWhen must staff disclose that AI contributed to a piece of work?
Staff survey items: S06 I know which AI tools I am allowed to use for work.
; S09 I know what information I must not enter into AI tools.
; S25 I know where to find guidance on using AI at work.
Red flags
- A policy longer than ten pages
- No acknowledgement by staff
- Senior leaders seen ignoring the rules
Standards crosswalk
- ISO/IEC 42001
- Annex A.2Annex A.9
- EU AI Act
- Article 4
- NIST AI RMF
- GOVERN 1
Government and organisation editions
Australian Government edition
Since December 2025 the ISM has required a general-purpose AI usage policy. Policy v2.0 requires staff to be told about Australia’s AI Ethics Principles as part of responsible AI practices.
References
- Information Security ManualGeneral-purpose AI usage policy (December 2025)
- Policy for the responsible use of AI in government, version 2.0Responsible AI practices
- AI Plan for the Australian Public Service 2025
Organisation edition
ISO/IEC 42001 requires an AI policy and controls on the use of AI systems. The OAIC’s guidance on commercially available AI products recommends clear internal rules on what information staff may enter.
References
- ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemAnnex A.2 and A.9
- Guidance on privacy and the use of commercially available AI products
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)Article 4, where it applies
In Governing Intelligence
Initiatives that lift it
Criterion 8.4
Adoption and change
Adoption of approved AI is led deliberately: a change approach, a resourced champion network and tiered support exist, and adoption and its effects are measured by area.
Why it matters
Licences do not change work. Without change support, approved tools sit unused while staff keep using the unapproved ones they already know, and the value assumed in the business case never arrives.
The five levels
| Level | What it looks like | To score this level |
|---|---|---|
| 1Initial | AI tools are switched on with no change support, no help for staff, and nobody knows how much they are used. | The starting point: no test. |
| 2Repeatable | Launch communications and occasional sessions happen, a few informal champions help colleagues, and adoption is measured by licence counts only. | Launch communications or training sessions for an AI tool can be shown. |
| 3Defined | A change plan covers communication, training, support tiers and leadership role-modelling. A champion network covers every major business area with time allocated, and active use is tracked by area. | A change plan, a champion list covering every major area with time allocation, and active-use figures by area. |
| 4Managed | Adoption is measured by meaningful use (tasks, outcomes, quality) by area and role. Low-adoption areas receive targeted support, and champion feedback changes tools and guidance. | Meaningful-use measures by area, a targeted support record for a low-adoption area, and a change made because of champion feedback. |
| 5Optimising | Work is redesigned around AI where evidence supports it, with staff involved in the redesign, and adoption is sustained without campaigns. | A documented work redesign with staff involvement and measured results. |
Evidence to request
Documents
- Change plan
- Support model and tiers
Records of it operating
- Champion list and coverage
- Adoption measures by area
- Feedback log and resulting changes
In systems
- Usage analytics from AI tools
In the evidence request: ER-8-04.
Interview probes
- Frontline staffWho do you go to when you are stuck with an AI tool?
- Executive sponsor or Chief AI OfficerWhich areas are using AI least, and why?
- Use-case owner or business leadHow did people in your area learn to work with the new system?
Staff survey items: S03 Leaders in my area talk about AI use and its risks in a way that helps me.
; S21 There is someone I can go to for help with AI tools in my area.
; S23 I understand how AI is changing my role, and I have had a say in how it is used in my team.
; S25 I know where to find guidance on using AI at work.
Red flags
- Large numbers of unused licences
- Champions with no time allocated
- Change limited to launch emails
Standards crosswalk
- ISO/IEC 42001
- Clause 7.3Clause 7.4
- EU AI Act
- No direct mapping
- NIST AI RMF
- No direct mapping
Government and organisation editions
Australian Government edition
The APS AI Plan’s people pillar covers staff consultation and engagement on AI adoption, and its communications work stream supports agencies’ change effort.
References
- AI Plan for the Australian Public Service 2025People pillar; staff consultation and engagement
Organisation edition
ISO/IEC 42001 requires awareness and communication about the AI management system. Change management is otherwise a delivery practice rather than a compliance requirement.
References
In Governing Intelligence
Initiatives that lift it
Criterion 8.5
Reporting culture and calibrated trust
Staff, and the public where relevant, can raise AI concerns and report errors and near misses without fear of blame, trust in AI is calibrated (neither blind nor dismissive), and people are designed into AI work as participants with real authority.
Why it matters
Near misses are free lessons. A culture where people report AI mistakes, including their own, is the one that catches the next failure before it reaches the public. An override rate of zero usually means rubber-stamping, not perfection.
The five levels
| Level | What it looks like | To score this level |
|---|---|---|
| 1Initial | Staff do not report AI problems. Errors are worked around or hidden, and trust in AI is either blind or absent. | The starting point: no test. |
| 2Repeatable | Some staff report problems through general channels, but there is no AI-specific channel, reports get no visible response, and the survey shows many problems go unreported. | A general reporting channel that staff can use for AI problems. |
| 3Defined | A visible channel exists for staff (and the public, where relevant) to raise AI concerns, and every report receives a response. The survey shows most staff who saw a problem reported it, and managers are briefed to respond without blame. | An AI concern channel (with a public pathway where relevant), response records for reports in the last 12 months, survey results showing at least 60 percent of staff who saw a problem reported it, and a manager briefing record. |
| 4Managed | Near-miss reporting is healthy and stable or rising. Reports lead to visible changes that are communicated back, and survey measures of verification habits and calibrated trust improve. | Near-miss reporting trend data over at least two quarters, communications of changes made, and improvement in trust-calibration survey items between two surveys. |
| 5Optimising | Speaking up about AI is part of the culture: concerns are raised early in design, staff take part in evaluation and design, and the organisation shares its lessons openly. | Staff participation in design or evaluation recorded for new systems, and lessons published or shared externally. |
Evidence to request
Documents
- AI concern channel description (staff and public)
- Manager briefing material
Records of it operating
- Concern and near-miss reports with responses
- Communications of resulting changes
- Survey results
In systems
- Reporting channel or in-tool reporting function
In the evidence request: ER-8-05.
Interview probes
- Frontline staffHave you seen an AI tool get something wrong at work? What did you do?
- Risk, compliance and internal auditHow many AI concerns were raised in the last year, and what changed as a result?
- Executive sponsor or Chief AI OfficerHow would you respond to the first person who reported an embarrassing AI mistake?
Staff survey items: S12 I check AI outputs for accuracy before I rely on them or pass them on.
; S14 I sometimes rely on AI outputs without checking them because there is not enough time.
; S15 If an AI tool produced something wrong, biased or unsafe, I know how to report it.
; S16 I would feel safe reporting an AI mistake, including one I made myself.
; S17 When problems with AI are reported here, something changes as a result.
Red flags
- No reports at all
- People who reported problems were blamed
- Attitudes of ‘AI is always right’ or ‘never use it’ common in interviews
Standards crosswalk
- ISO/IEC 42001
- Clause 7.4Clause 10.1
- EU AI Act
- No direct mapping
- NIST AI RMF
- GOVERN 4
Government and organisation editions
Australian Government edition
Policy v2.0 requires, by 15 December 2026, a pathway for staff to report AI safety concerns, including AI incidents, and pathways for the public to report AI safety concerns appropriate to the agency’s AI use.
Dated obligations
- 15 December 2026Staff and public pathways to report AI safety concerns (Policy v2.0)Met at level 3 (Defined) or higher
References
- Policy for the responsible use of AI in government, version 2.0Staff and public pathways to report AI safety concerns, by 15 December 2026
- Australia’s AI Ethics Principles
Organisation edition
The NIST AI RMF GOVERN function covers organisational practices that enable incident identification and information sharing. The Voluntary AI Safety Standard asks organisations to engage stakeholders and evaluate their needs.
References
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN 4
- ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClauses 7.4 and 10.1
- Voluntary AI Safety StandardGuardrail 10
- Guidance for AI AdoptionMaintain human control
In Governing Intelligence
In the AI governance assessment: Incidents and near misses are reported, reviewed and fed back into policy.
Initiatives that lift it
In Governing Intelligence
The framework chapters that describe the practice this domain measures, and the governance assessment questions that test it at a higher level.
- 6.5Capability and the new professions
- 6.6Culture: from gatekeepers to participants
- 12.6Leading people through the change
- 13.3Govern the everyday assistants
In the AI governance assessment: Each of the six AI governance capabilities has an accountable home, and mandatory staff AI training is on schedule.
Incidents and near misses are reported, reviewed and fed back into policy.
This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.