AI Capability Maturity Assessment · Part V. Reference
Responsible AI overlay and standards mapping
In this chapter
The responsible AI overlay on every criterion, and the standards mapping: five responsible AI dimensions, Australia’s eight AI Ethics Principles, ISO/IEC 42001, the EU AI Act and the NIST AI Risk Management Framework, each traced to the criteria that cover it.
What the overlay does
Read the 40 criteria through a responsible AI lens without adding questions. Each criterion has one primary responsible AI dimension and maps to Australia’s AI Ethics Principles, ISO/IEC 42001 clauses and Annex A control objectives, the EU AI Act and the NIST AI RMF functions.
- Five dimensions only. Too many dimensions make a maturity model hard to apply; five keeps the overlay readable on one page.
- No separate rating. Each dimension score is computed from the criteria mapped to it with the same capped-mean rule as domains, so it inherits the crisp, evidence-based pass tests.
- Crosswalks are references for planning and audit preparation, not legal conclusions.
Five responsible AI dimensions
| Dimension | What it covers | Criteria | Which |
|---|---|---|---|
| Governance and accountability | Direction, ownership, decision rights and oversight of AI. | 13 | 1.1, 1.3, 1.4, 1.5, 2.1, 2.2, 2.3, 2.4, 2.5, 7.1, 7.2, 7.3, 7.4 |
| Impact and risk | Understanding and managing effects on people, the organisation and society, including fairness and incidents. | 4 | 1.2, 3.1, 3.2, 3.5 |
| Development and operation | Data, platform, security, design, testing and monitoring of AI systems. | 15 | 3.3, 4.1, 4.2, 4.3, 5.1, 5.2, 5.3, 5.4, 5.5, 6.1, 6.2, 6.3, 6.4, 6.5, 7.5 |
| Transparency and records | Disclosure, explanation, contestability and the records that make them possible. | 3 | 3.4, 4.4, 4.5 |
| People and culture | Literacy, capability, acceptable use, adoption and a culture of reporting. | 5 | 8.1, 8.2, 8.3, 8.4, 8.5 |
Australia’s AI Ethics Principles
The eight voluntary principles published by the Australian Government in 2019. Each criterion names the principles it puts into practice; see the principles in the references.
| Principle | Criteria | Which |
|---|---|---|
| Human, societal and environmental wellbeing | 9 | 1.1, 1.2, 3.1, 3.2, 6.5, 7.1, 7.3, 7.4, 8.4 |
| Human-centred values | 6 | 3.1, 3.4, 6.2, 8.1, 8.4, 8.5 |
| Fairness | 4 | 1.2, 3.1, 4.1, 6.3 |
| Privacy protection and security | 8 | 3.1, 4.3, 4.5, 5.1, 5.2, 5.3, 5.4, 8.3 |
| Reliability and safety | 14 | 3.3, 3.5, 4.1, 4.2, 5.1, 5.2, 5.5, 6.1, 6.3, 6.4, 6.5, 7.5, 8.1, 8.2 |
| Transparency and explainability | 7 | 1.5, 2.3, 3.4, 4.2, 4.4, 5.4, 6.4 |
| Contestability | 4 | 3.4, 4.4, 6.2, 8.5 |
| Accountability | 26 | 1.1, 1.2, 1.3, 1.4, 1.5, 2.1, 2.2, 2.3, 2.4, 2.5, 3.2, 3.3, 3.5, 4.4, 4.5, 5.3, 5.4, 5.5, 6.1, 6.2, 7.1, 7.2, 7.3, 8.2, 8.3, 8.5 |
ISO/IEC 42001
The international management system standard for AI. Clause numbers refer to the requirements of the standard; Annex A references refer to its control objectives. See ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management system.
| ISO/IEC 42001 | Criteria |
|---|---|
| Clause 5.1 | 1.3, 2.2 |
| Clause 5.2 | 1.1 |
| Clause 5.3 | 1.3, 2.1, 2.2, 2.5 |
| Clause 6.1.2 | 1.2, 3.2 |
| Clause 6.1.3 | 1.2 |
| Clause 6.1.4 | 3.1 |
| Clause 6.2 | 1.1, 1.4, 7.1, 7.4 |
| Clause 7.1 | 1.4 |
| Clause 7.2 | 8.1, 8.2 |
| Clause 7.3 | 8.1, 8.4 |
| Clause 7.4 | 8.4, 8.5 |
| Clause 7.5 | 4.5 |
| Clause 8.2 | 3.2 |
| Clause 8.4 | 3.1 |
| Clause 9.1 | 5.5, 7.4 |
| Clause 9.2 | 2.4 |
| Clause 9.3 | 1.5 |
| Clause 10.1 | 8.5 |
| Clause 10.2 | 3.5 |
| Annex A.2 | 5.3, 8.3 |
| Annex A.3 | 2.1, 2.2, 2.5 |
| Annex A.4 | 2.3, 5.1, 7.5, 8.2 |
| Annex A.5 | 3.1, 7.1 |
| Annex A.6 | 2.3, 3.3, 4.4, 5.2, 5.5, 6.1, 6.3, 6.4, 6.5, 7.2, 7.3 |
| Annex A.7 | 4.1, 4.2, 4.3 |
| Annex A.8 | 3.4 |
| Annex A.9 | 5.3, 6.2, 8.3 |
| Annex A.10 | 5.4 |
EU AI Act
The European Union’s AI regulation, which reaches Australian organisations that place AI on the EU market or whose AI output is used in the EU. See Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI).
| EU AI Act | Criteria |
|---|---|
| Annex III | 1.2, 3.2 |
| Article 4 | 8.1, 8.3 |
| Article 6 | 1.2, 3.2 |
| Article 9 | 3.3, 6.3 |
| Article 10 | 4.1 |
| Article 11 | 6.1 |
| Article 12 | 4.4, 4.5 |
| Article 14 | 5.5, 6.2 |
| Article 15 | 5.1, 5.2, 6.3, 6.5 |
| Article 17 | 3.3 |
| Article 25 | 5.4 |
| Article 26 | 2.1, 4.4, 4.5, 5.3, 5.4, 6.2, 8.2 |
| Article 27 | 3.1 |
| Article 49 | 2.3 |
| Article 50 | 3.4, 6.4 |
| Article 72 | 5.5 |
| Article 73 | 3.5 |
| Article 86 | 3.4 |
No direct mapping: 1.1, 1.3, 1.4, 1.5, 2.2, 2.4, 2.5, 4.2, 4.3, 7.1, 7.2, 7.3, 7.4, 7.5, 8.4, 8.5.
NIST AI RMF
The voluntary AI Risk Management Framework from the US National Institute of Standards and Technology, organised into four functions: Govern, Map, Measure and Manage. See Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1.
| NIST AI RMF | Criteria |
|---|---|
| GOVERN | 1.1, 1.2, 1.3, 1.5, 2.1, 2.2, 2.3, 2.4, 2.5, 3.4, 4.4, 5.3, 5.4, 8.1, 8.2, 8.3, 8.5 |
| MANAGE | 1.4, 3.3, 3.5, 4.3, 5.1, 5.4, 5.5, 6.2, 6.5, 7.2, 7.3, 7.4 |
| MAP | 1.2, 3.1, 3.2, 4.1, 4.2, 4.3, 6.1, 6.2, 6.5, 7.1 |
| MEASURE | 3.4, 4.1, 4.4, 5.2, 6.3, 6.4 |
No direct mapping: 4.5, 7.5, 8.4.
Certification readiness
Every criterion at a glance
| No. | Criterion | Dimension | AI Ethics Principles | ISO/IEC 42001 | EU AI Act | NIST AI RMF |
|---|---|---|---|---|---|---|
| 1.1 | Endorsed AI strategy | Governance and accountability | Human, societal and environmental wellbeing; Accountability | Clause 5.2, Clause 6.2 | GOVERN 1 | |
| 1.2 | Risk appetite and tiers | Impact and risk | Human, societal and environmental wellbeing; Fairness; Accountability | Clause 6.1.2, Clause 6.1.3 | Article 6, Annex III | GOVERN 1, MAP 1 |
| 1.3 | Executive ownership | Governance and accountability | Accountability | Clause 5.1, Clause 5.3 | GOVERN 2 | |
| 1.4 | Investment discipline | Governance and accountability | Accountability | Clause 6.2, Clause 7.1 | MANAGE 1 | |
| 1.5 | Executive evidence rhythm | Governance and accountability | Accountability; Transparency and explainability | Clause 9.3 | GOVERN 1 | |
| 2.1 | Accountable owners | Governance and accountability | Accountability | Clause 5.3, Annex A.3 | Article 26 | GOVERN 2 |
| 2.2 | AI governance committee | Governance and accountability | Accountability | Clause 5.1, Clause 5.3, Annex A.3 | GOVERN 2 | |
| 2.3 | Use-case register | Governance and accountability | Accountability; Transparency and explainability | Annex A.4, Annex A.6 | Article 49 | GOVERN 1 |
| 2.4 | Three lines of assurance | Governance and accountability | Accountability | Clause 9.2 | GOVERN 1, GOVERN 4 | |
| 2.5 | Decision rights and escalation | Governance and accountability | Accountability | Clause 5.3, Annex A.3 | GOVERN 2 | |
| 3.1 | Impact assessments | Impact and risk | Human, societal and environmental wellbeing; Human-centred values; Fairness; Privacy protection and security | Clause 6.1.4, Clause 8.4, Annex A.5 | Article 27 | MAP 5 |
| 3.2 | Risk tiering in practice | Impact and risk | Human, societal and environmental wellbeing; Accountability | Clause 6.1.2, Clause 8.2 | Article 6, Annex III | MAP 1, MAP 4 |
| 3.3 | Lifecycle and gates | Development and operation | Reliability and safety; Accountability | Annex A.6 | Article 9, Article 17 | MANAGE 1 |
| 3.4 | Transparency and contestability | Transparency and records | Transparency and explainability; Contestability; Human-centred values | Annex A.8 | Article 50, Article 86 | GOVERN 4, MEASURE 2 |
| 3.5 | Incident and near-miss management | Impact and risk | Reliability and safety; Accountability | Clause 10.2 | Article 73 | MANAGE 4 |
| 4.1 | Data quality for AI | Development and operation | Reliability and safety; Fairness | Annex A.7 | Article 10 | MAP 2, MEASURE 2 |
| 4.2 | Shared vocabulary and curated knowledge | Development and operation | Reliability and safety; Transparency and explainability | Annex A.7 | MAP 2 | |
| 4.3 | Classification and handling | Development and operation | Privacy protection and security | Annex A.7 | MAP 4, MANAGE 2 | |
| 4.4 | Provenance and decision records | Transparency and records | Transparency and explainability; Contestability; Accountability | Annex A.6 | Article 12, Article 26 | GOVERN 1, MEASURE 2 |
| 4.5 | Records and retention of AI content | Transparency and records | Accountability; Privacy protection and security | Clause 7.5 | Article 12, Article 26 | |
| 5.1 | Assessed AI platform | Development and operation | Privacy protection and security; Reliability and safety | Annex A.4 | Article 15 | MANAGE 2 |
| 5.2 | AI security controls | Development and operation | Privacy protection and security; Reliability and safety | Annex A.6 | Article 15 | MEASURE 2 |
| 5.3 | Approved tools and model access | Development and operation | Privacy protection and security; Accountability | Annex A.2, Annex A.9 | Article 26 | GOVERN 6 |
| 5.4 | Third-party and embedded AI | Development and operation | Privacy protection and security; Accountability; Transparency and explainability | Annex A.10 | Article 25, Article 26 | GOVERN 6, MANAGE 3 |
| 5.5 | Observability, halt and rollback | Development and operation | Reliability and safety; Accountability | Clause 9.1, Annex A.6 | Article 14, Article 72 | MANAGE 2, MANAGE 4 |
| 6.1 | Specification before build | Development and operation | Reliability and safety; Accountability | Annex A.6 | Article 11 | MAP 1, MAP 3 |
| 6.2 | Autonomy and human oversight design | Development and operation | Human-centred values; Accountability; Contestability | Annex A.9 | Article 14, Article 26 | MAP 3, MANAGE 2 |
| 6.3 | Testing, evaluation and simulation | Development and operation | Reliability and safety; Fairness | Annex A.6 | Article 9, Article 15 | MEASURE 1, MEASURE 2 |
| 6.4 | AI-generated code and content assurance | Development and operation | Reliability and safety; Transparency and explainability | Annex A.6 | Article 50 | MEASURE 2 |
| 6.5 | Secure and safe by design | Development and operation | Reliability and safety; Human, societal and environmental wellbeing | Annex A.6 | Article 15 | MAP 5, MANAGE 2 |
| 7.1 | Portfolio and intake | Governance and accountability | Human, societal and environmental wellbeing; Accountability | Clause 6.2, Annex A.5 | MAP 1 | |
| 7.2 | Lifecycle execution | Governance and accountability | Accountability | Annex A.6 | MANAGE 1, MANAGE 4 | |
| 7.3 | Pilot to scale | Governance and accountability | Human, societal and environmental wellbeing; Accountability | Annex A.6 | MANAGE 1 | |
| 7.4 | Benefits realisation | Governance and accountability | Human, societal and environmental wellbeing | Clause 6.2, Clause 9.1 | MANAGE 1 | |
| 7.5 | Reuse and patterns | Development and operation | Reliability and safety | Annex A.4 | ||
| 8.1 | Foundational AI literacy | People and culture | Human-centred values; Reliability and safety | Clause 7.2, Clause 7.3 | Article 4 | GOVERN 2 |
| 8.2 | Role-based capability | People and culture | Accountability; Reliability and safety | Clause 7.2, Annex A.4 | Article 26 | GOVERN 2, GOVERN 3 |
| 8.3 | Acceptable use | People and culture | Privacy protection and security; Accountability | Annex A.2, Annex A.9 | Article 4 | GOVERN 1 |
| 8.4 | Adoption and change | People and culture | Human-centred values; Human, societal and environmental wellbeing | Clause 7.3, Clause 7.4 | ||
| 8.5 | Reporting culture and calibrated trust | People and culture | Human-centred values; Accountability; Contestability | Clause 7.4, Clause 10.1 | GOVERN 4 |
This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.