AI Capability Maturity Assessment · Part IV. From findings to roadmap
Roadmap method
In this chapter
How gaps become a sequenced, owned roadmap across four horizons from 90 days to 24 months: selecting initiatives, classing and prioritising them, respecting dependencies and capacity, governing the plan, and re-assessing to keep it honest.
Turn the gaps between current and target levels into a sequenced, owned roadmap: obligations and foundations first, dependencies respected, quick wins in the first 90 days, and no horizon loaded beyond the organisation’s capacity.
Four horizons
H1 · 0 to 90 days
Mobilise
Must-dos, foundations and quick wins: owners, committee, register, appetite, acceptable use, incident runbook, the obligations falling due.
H2 · 3 to 6 months
Establish
Make the core practices operate: lifecycle and gates, assessments, transparency, approved platform work, training at scale.
H3 · 6 to 12 months
Embed
Defined practice everywhere and the first measured and enforced controls; the reference use case governed end to end.
H4 · 12 to 24 months
Scale
Managed practice where risk is greatest; supervised autonomy on evidence; re-assessment against the baseline.
An obligation’s horizon is the first horizon whose end day is on or after the number of days from the assessment date to the due date; an overdue obligation maps to H1.
Selecting initiatives
- For each criterion with a gap, start at its current whole level (the whole part of its score; a ‘not known’ criterion starts at 1).
- Find the library initiatives that lift that criterion and whose ‘from’ level is at or below the current level and whose ‘to’ level is above it. Choose the one with the lowest effort; break ties by the higher ‘to’ level, then by initiative id.
- Treat the criterion as raised to that initiative’s ‘to’ level and repeat until the target is reached or no initiative applies. If none applies, record ‘no library initiative: tailor one’ against the criterion.
- Add initiatives whose ‘includeWhen’ conditions are met (for example the centre of excellence for organisations of 250 staff or more without a working committee).
- Add every prerequisite of a selected initiative, repeatedly, unless the prerequisite is already satisfied (every criterion it lifts is already at or above its ‘to’ level).
Classes and priority
- Class A, must-do: the initiative was selected for the step that takes a criterion from below the minimum level of an applicable edition obligation that is overdue or due within 12 months of the assessment date. Later steps on the same criterion (for example Level 3 to 4) are not must-dos.
- Class B, foundation: the initiative lifts a foundation-importance criterion.
- Class C, value: all others.
- A prerequisite takes the highest class of the initiatives that depend on it.
Priority: Initiative priority = sum over its lifts of (levels of gap it closes on that criterion, counted from the current level up to the lower of its ‘to’ level and the criterion target) x the criterion’s importance weight, then multiplied by the initiative’s feasibility (3, 2 or 1, from the feasibility rules in scoring.prioritisation).
Capacity
Each horizon has a capacity in effort points for initiatives starting in it, set by organisation size and roughly proportional to the horizon’s length (H1 and H2 are three months, H3 six, H4 twelve). Leaders adjust it in the target-state workshop to match the resourcing they fund. No owner role carries more than three initiatives starting in the same horizon.
| Organisation size | H1 points | H2 points | H3 points | H4 points |
|---|---|---|---|---|
| Fewer than 250 staff | 8 | 9 | 16 | 26 |
| 250 to 999 staff | 12 | 14 | 24 | 40 |
| 1,000 to 4,999 staff | 16 | 20 | 34 | 56 |
| 5,000 staff or more | 20 | 26 | 44 | 72 |
- Effort S (1 points)
- Small: up to about 6 weeks for a small team, mostly decisions and documents.
- Effort M (3 points)
- Medium: 2 to 3 months of focused work, or a change touching several teams.
- Effort L (8 points)
- Large: 3 to 9 months, a program with dedicated resourcing or platform build.
Sequencing
- Order initiatives by class (A, B, C), then priority (highest first), then effort points (lowest first), then id.
- An initiative is never placed before all its selected prerequisites. Earliest horizon: H1, or later where a prerequisite requires it. A prerequisite of effort S allows the dependant to start in the same horizon; a prerequisite of effort M or L pushes the dependant to the following horizon.
- Phase 1, must-dos: place class A initiatives (and the prerequisites that inherit class A) in their earliest horizon even if that exceeds capacity or the owner limit, flagged ‘over capacity’. Flag ‘obligation overdue’ where the obligation date has passed, and ‘deadline at risk’ where the horizon ends after the obligation’s due date.
- Phase 2, quick wins: place quick wins whose prerequisites are already placed and whose earliest horizon is H1 into H1, in order, while H1 capacity and the owner limit allow.
- Phase 3, everything else: place each remaining initiative, in order, in the earliest horizon at or after its earliest horizon that has enough remaining capacity and fewer than three initiatives owned by the same role.
- Initiatives that do not fit in H1 to H4 are listed as ‘beyond 24 months’. A long list there means the targets or the capacity need revisiting in the target-state workshop, not that the work can be ignored.
What the roadmap shows
- Initiatives per horizon with owner, effort, class, priority, the criteria lifted and flags
- Capacity used against capacity per horizon
- Criteria with no library initiative
- Obligations at risk
- Enterprise-action dependencies (function scope)
Governing the roadmap
| Cadence | Forum | What |
|---|---|---|
| Monthly | AI governance committee | Initiative status, blockers, decisions needed, risks; horizon progress against capacity. |
| Quarterly | Executive committee | Progress check against planned uplift, dashboard, realignment triggers, next horizon confirmed and funded. |
| Six-monthly | Executive committee and board | Light re-score of targeted criteria; board report on progress and exposure. |
| Annually | Executive committee and board | Full re-assessment, strategy and appetite refresh, new roadmap baseline. |
Re-assessment and realignment
Maturity is measured over time, not once. Re-assessment shows whether the roadmap is working and triggers a strategy realignment when progress stalls or the context changes.
| Check | What | Owner |
|---|---|---|
| Quarterly progress check | Re-score only the criteria targeted by initiatives due in the quarter, using the same pass tests and confidence rules (team or self mode is acceptable). Report planned against achieved uplift. | AI lead or AI centre of excellence |
| Six-monthly light re-score | Re-score all criteria with in-flight initiatives or open flags, and re-run the four survey items most relevant to them. | AI lead or AI centre of excellence |
| Annual full re-assessment | All 40 criteria, the full survey and moderation. Assessor-led for the government edition and wherever the result is reported externally. | Executive sponsor or Chief AI Officer |
Comparing results over time
- Compare like with like: same scope, same edition and the same model version, or the published crosswalk between model versions.
- Only evidenced changes count as progress. An increase supported only by assertion is reported as ‘claimed, not yet evidenced’.
- Every decrease is explained: a control lapsed, evidence went out of date, scope changed or the earlier score was over-generous.
- Report deltas per criterion, per domain and overall, and the velocity of improvement (levels gained per quarter) per domain.
Realignment triggers
| Trigger | Rule |
|---|---|
| Progress stalled | A domain achieves less than half of its planned uplift at two consecutive quarterly checks, or a foundation criterion is unchanged at two consecutive checks. |
| Regression | Any domain score falls by 0.5 or more, or any criterion falls by a whole level or more, between checks. |
| Obligation change | A new or amended law, policy or standard in the edition’s anchor instruments changes a date or minimum level. |
| Serious incident | An AI incident of severity 1 or 2, or an external finding (audit, regulator, court) about AI. |
| Change in AI use | The first AI use at a higher autonomy rung, the first AI contribution to decisions about people, adoption of agents that act on systems of record, or a major platform or provider change. |
| Organisation change | Merger, restructure, a new executive sponsor or a material change in funding. |
| Target reached early | A domain reaches its target three months or more ahead of plan. |
Responding to a trigger
- The governance committee holds a realignment review within 30 days of a trigger.
- The review may reset targets, re-sequence or replace initiatives, change capacity, or escalate to the executive.
- If two or more domains trigger at once, or a trigger changes the ambition or risk appetite, the AI strategy is refreshed rather than the roadmap alone.
- Every realignment is recorded with the trigger, the evidence and the decision, and is reported at the next executive review.
Show the overall and domain scores across every assessment as a line chart, list criteria improved and regressed since the last assessment, and show planned against achieved uplift per domain.
This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.