Product

Product overview Agents Automations Apps Code (Beta) Integrations Governed Runtime Security

Where Renly runs

Windows app Android app Inside other AI apps

Solutions

Finance Sales Operations People and HR Marketing Enterprise

Resources

Pricing Docs Academy Blog Compare Support

AI governance and capability

AI governance framework AI governance assessment AI capability maturity AI maturity assessment
Book a demo Sign in

AI Capability Maturity Assessment · Part IV. From findings to roadmap

Roadmap method

7 minute read · Version 1.0.0

In this chapter

How gaps become a sequenced, owned roadmap across four horizons from 90 days to 24 months: selecting initiatives, classing and prioritising them, respecting dependencies and capacity, governing the plan, and re-assessing to keep it honest.

  1. Four horizons
  2. Selecting initiatives
  3. Classes and priority
  4. Capacity
  5. Sequencing
  6. Governing the roadmap
  7. Re-assessment and realignment

Turn the gaps between current and target levels into a sequenced, owned roadmap: obligations and foundations first, dependencies respected, quick wins in the first 90 days, and no horizon loaded beyond the organisation’s capacity.

Four horizons

H1 · 0 to 90 days

Mobilise

Must-dos, foundations and quick wins: owners, committee, register, appetite, acceptable use, incident runbook, the obligations falling due.

H2 · 3 to 6 months

Establish

Make the core practices operate: lifecycle and gates, assessments, transparency, approved platform work, training at scale.

H3 · 6 to 12 months

Embed

Defined practice everywhere and the first measured and enforced controls; the reference use case governed end to end.

H4 · 12 to 24 months

Scale

Managed practice where risk is greatest; supervised autonomy on evidence; re-assessment against the baseline.

An obligation’s horizon is the first horizon whose end day is on or after the number of days from the assessment date to the due date; an overdue obligation maps to H1.

Selecting initiatives

  1. For each criterion with a gap, start at its current whole level (the whole part of its score; a ‘not known’ criterion starts at 1).
  2. Find the library initiatives that lift that criterion and whose ‘from’ level is at or below the current level and whose ‘to’ level is above it. Choose the one with the lowest effort; break ties by the higher ‘to’ level, then by initiative id.
  3. Treat the criterion as raised to that initiative’s ‘to’ level and repeat until the target is reached or no initiative applies. If none applies, record ‘no library initiative: tailor one’ against the criterion.
  4. Add initiatives whose ‘includeWhen’ conditions are met (for example the centre of excellence for organisations of 250 staff or more without a working committee).
  5. Add every prerequisite of a selected initiative, repeatedly, unless the prerequisite is already satisfied (every criterion it lifts is already at or above its ‘to’ level).

Classes and priority

  1. Class A, must-do: the initiative was selected for the step that takes a criterion from below the minimum level of an applicable edition obligation that is overdue or due within 12 months of the assessment date. Later steps on the same criterion (for example Level 3 to 4) are not must-dos.
  2. Class B, foundation: the initiative lifts a foundation-importance criterion.
  3. Class C, value: all others.
  4. A prerequisite takes the highest class of the initiatives that depend on it.

Priority: Initiative priority = sum over its lifts of (levels of gap it closes on that criterion, counted from the current level up to the lower of its ‘to’ level and the criterion target) x the criterion’s importance weight, then multiplied by the initiative’s feasibility (3, 2 or 1, from the feasibility rules in scoring.prioritisation).

Capacity

Each horizon has a capacity in effort points for initiatives starting in it, set by organisation size and roughly proportional to the horizon’s length (H1 and H2 are three months, H3 six, H4 twelve). Leaders adjust it in the target-state workshop to match the resourcing they fund. No owner role carries more than three initiatives starting in the same horizon.

Organisation sizeH1 pointsH2 pointsH3 pointsH4 points
Fewer than 250 staff891626
250 to 999 staff12142440
1,000 to 4,999 staff16203456
5,000 staff or more20264472
Effort S (1 points)
Small: up to about 6 weeks for a small team, mostly decisions and documents.
Effort M (3 points)
Medium: 2 to 3 months of focused work, or a change touching several teams.
Effort L (8 points)
Large: 3 to 9 months, a program with dedicated resourcing or platform build.

Sequencing

  1. Order initiatives by class (A, B, C), then priority (highest first), then effort points (lowest first), then id.
  2. An initiative is never placed before all its selected prerequisites. Earliest horizon: H1, or later where a prerequisite requires it. A prerequisite of effort S allows the dependant to start in the same horizon; a prerequisite of effort M or L pushes the dependant to the following horizon.
  3. Phase 1, must-dos: place class A initiatives (and the prerequisites that inherit class A) in their earliest horizon even if that exceeds capacity or the owner limit, flagged ‘over capacity’. Flag ‘obligation overdue’ where the obligation date has passed, and ‘deadline at risk’ where the horizon ends after the obligation’s due date.
  4. Phase 2, quick wins: place quick wins whose prerequisites are already placed and whose earliest horizon is H1 into H1, in order, while H1 capacity and the owner limit allow.
  5. Phase 3, everything else: place each remaining initiative, in order, in the earliest horizon at or after its earliest horizon that has enough remaining capacity and fewer than three initiatives owned by the same role.
  6. Initiatives that do not fit in H1 to H4 are listed as ‘beyond 24 months’. A long list there means the targets or the capacity need revisiting in the target-state workshop, not that the work can be ignored.

What the roadmap shows

  • Initiatives per horizon with owner, effort, class, priority, the criteria lifted and flags
  • Capacity used against capacity per horizon
  • Criteria with no library initiative
  • Obligations at risk
  • Enterprise-action dependencies (function scope)

Governing the roadmap

CadenceForumWhat
MonthlyAI governance committeeInitiative status, blockers, decisions needed, risks; horizon progress against capacity.
QuarterlyExecutive committeeProgress check against planned uplift, dashboard, realignment triggers, next horizon confirmed and funded.
Six-monthlyExecutive committee and boardLight re-score of targeted criteria; board report on progress and exposure.
AnnuallyExecutive committee and boardFull re-assessment, strategy and appetite refresh, new roadmap baseline.

Re-assessment and realignment

Maturity is measured over time, not once. Re-assessment shows whether the roadmap is working and triggers a strategy realignment when progress stalls or the context changes.

CheckWhatOwner
Quarterly progress checkRe-score only the criteria targeted by initiatives due in the quarter, using the same pass tests and confidence rules (team or self mode is acceptable). Report planned against achieved uplift.AI lead or AI centre of excellence
Six-monthly light re-scoreRe-score all criteria with in-flight initiatives or open flags, and re-run the four survey items most relevant to them.AI lead or AI centre of excellence
Annual full re-assessmentAll 40 criteria, the full survey and moderation. Assessor-led for the government edition and wherever the result is reported externally.Executive sponsor or Chief AI Officer

Comparing results over time

  • Compare like with like: same scope, same edition and the same model version, or the published crosswalk between model versions.
  • Only evidenced changes count as progress. An increase supported only by assertion is reported as ‘claimed, not yet evidenced’.
  • Every decrease is explained: a control lapsed, evidence went out of date, scope changed or the earlier score was over-generous.
  • Report deltas per criterion, per domain and overall, and the velocity of improvement (levels gained per quarter) per domain.

Realignment triggers

TriggerRule
Progress stalledA domain achieves less than half of its planned uplift at two consecutive quarterly checks, or a foundation criterion is unchanged at two consecutive checks.
RegressionAny domain score falls by 0.5 or more, or any criterion falls by a whole level or more, between checks.
Obligation changeA new or amended law, policy or standard in the edition’s anchor instruments changes a date or minimum level.
Serious incidentAn AI incident of severity 1 or 2, or an external finding (audit, regulator, court) about AI.
Change in AI useThe first AI use at a higher autonomy rung, the first AI contribution to decisions about people, adoption of agents that act on systems of record, or a major platform or provider change.
Organisation changeMerger, restructure, a new executive sponsor or a material change in funding.
Target reached earlyA domain reaches its target three months or more ahead of plan.

Responding to a trigger

  1. The governance committee holds a realignment review within 30 days of a trigger.
  2. The review may reset targets, re-sequence or replace initiatives, change capacity, or escalate to the executive.
  3. If two or more domains trigger at once, or a trigger changes the ambition or risk appetite, the AI strategy is refreshed rather than the roadmap alone.
  4. Every realignment is recorded with the trigger, the evidence and the decision, and is reported at the next executive review.

Show the overall and domain scores across every assessment as a line chart, list criteria improved and regressed since the last assessment, and show planned against achieved uplift per domain.

This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.