AI Capability Maturity Assessment · Part II. The eight domains

Domain 1 · Foundations layerStrategy and leadership

21 minute read · Version 1.0.0 · five criteria

In this chapter

Sets the direction for AI: why the organisation uses it, how far and how fast, where it will not go, and who at the top answers for it.

What this domain covers
The domain at each level
Risks when it is weak
The five criteria
1.1 Endorsed AI strategy
1.2 Risk appetite and tiers
1.3 Executive ownership
1.4 Investment discipline
1.5 Executive evidence rhythm
In Governing Intelligence

What this domain covers

Sets the direction for AI: why the organisation uses it, how far and how fast, where it will not go, and who at the top answers for it.

Every other domain depends on decisions only leaders can make: the ambition, the risk appetite, the investment and the authority to say no. Without them, AI use is shaped by vendors and enthusiasts, investment scatters across pilots that never scale, and boundaries are discovered through incidents rather than decided in advance. Auditors and regulators now look for an endorsed strategy with implementation arrangements, and boards are expected to oversee AI risk as they oversee other enterprise risks.

Initiatives for this domain are run through the Operating model and Strategy and leadership playbooks.

The domain at each level

A summary of what the domain looks like at each level. Each criterion below has its own descriptors and pass tests: score the criteria, not this summary. The domain score is calculated from them (see domain aggregation).

Level	What it looks like
1Initial	No AI strategy or risk appetite. AI use emerges from individual teams and vendors. No executive owns AI outcomes, and leaders learn about AI use when something goes wrong.
2Repeatable	An ambition has been stated in a draft or a speech but is not endorsed or tied to priorities, boundaries or risk appetite. An AI lead is named but holds no delegated authority or budget. AI reaches executive agendas occasionally, as project updates.
3Defined	An endorsed strategy states purpose, priorities and boundaries, supported by an endorsed risk appetite with defined tiers. A Chief AI Officer or executive sponsor holds written authority, including to pause AI use. Investment is managed as a portfolio with gates, and the executive reviews a defined AI dashboard at least quarterly.
4Managed	Strategy drives a measured portfolio: every funded initiative maps to a priority, funding is released at gates on evidence, and pilots are stopped when the evidence says so. The executive governs from a dashboard generated from systems of record, and minutes show decisions taken because of it.
5Optimising	AI is part of corporate strategy rather than a separate plan. Evidence from operation (benefits, incidents, overrides, re-assessment) drives annual refreshes of strategy and appetite. Leaders can answer any external question about the organisation’s AI from evidence already held.

Risks when it is weak

Pilot sprawl: money and goodwill spent on pilots that never reach a decision
Shadow AI filling the gap left by an absent direction
Nobody with the authority to stop a harmful or unlawful use
Leaders exposed when an auditor, regulator or journalist asks what AI is used for and why
Risk appetite set implicitly by whoever approves the next purchase

The five criteria

No.	Criterion	Importance	Scope
1.1	Endorsed AI strategy	Foundation	Enterprise-level
1.2	Risk appetite and tiers	Foundation	Enterprise-level
1.3	Executive ownership	Foundation	Enterprise-level
1.4	Investment discipline	Enabling	Enterprise arrangement, applied locally
1.5	Executive evidence rhythm	Core	Enterprise-level

Criterion 1.1

Endorsed AI strategy

The organisation has an AI strategy that states purpose, ambition, priority areas and boundaries (what AI will not be used for), endorsed by the board or accountable authority and communicated to all staff.

Why it matters

Without an endorsed direction, AI use is set by whoever buys or experiments first. Investment scatters, boundaries are discovered through incidents, and nobody can say whether a proposed use fits what the organisation is trying to do.

The five levels

Level	What it looks like	To score this level
1Initial	No AI strategy or statement of intent exists. AI use is decided by individual teams or vendors, and no executive can state what the organisation will and will not use AI for.	The starting point: no test.
2Repeatable	A draft strategy, discussion paper or slide deck states an ambition, but it has not been endorsed, names no boundaries or priority areas, and most staff interviewed have not seen it.	A written statement of AI ambition exists, in any form, and can be produced.
3Defined	An endorsed strategy states purpose, ambition, three to six priority areas, explicit boundaries and the risk appetite it relies on. The endorsement is minuted and the strategy has been communicated to all staff.	An endorsed strategy document containing purpose, priority areas and boundaries can be produced, the endorsement is minuted, and at least one all-staff communication of it can be produced.
4Managed	Every funded AI initiative traces to a priority area in the strategy. The strategy has been reviewed against measured results within the last 12 months, and the review is minuted with the changes made.	A minuted review against measured results took place in the last 12 months, and every currently funded AI initiative maps to a priority area in the strategy.
5Optimising	Strategy refreshes are driven by evidence from operation (benefits, incidents, overrides, maturity re-assessment). The strategy records decisions not to proceed, and AI is integrated into the corporate plan rather than held as a separate document.	Two consecutive strategy reviews show changes made because of operating evidence, and AI priorities appear in the corporate plan.

Evidence to request

Documents

AI strategy or statement of intent, with version history
Endorsement minute or decision record
All-staff communication of the strategy

Records of it operating

Minute of the most recent strategy review
Mapping of funded AI initiatives to priority areas

In systems

Intranet page or acknowledgement records showing staff reach (optional)

In the evidence request: ER-1-01, ER-1-02.

Interview probes

Executive sponsor or Chief AI OfficerWhat has the organisation decided not to use AI for, and where is that written down?
Use-case owner or business leadWhich priority area in the AI strategy does your use case serve, and how did you learn about it?
Frontline staffIf a new colleague asked what the organisation’s position on AI is, what would you tell them?

Staff survey items: S01 I know what our organisation wants to achieve with AI.; S02 I know what our organisation has decided not to use AI for.

Red flags

The ‘strategy’ is a vendor roadmap or a technology plan with no boundaries
Endorsement is claimed but no minute or decision record exists
The strategy is more than 18 months old and has not been reviewed while AI use has grown

Standards crosswalk

ISO/IEC 42001: Clause 5.2Clause 6.2
EU AI Act: No direct mapping
NIST AI RMF: GOVERN 1

Government and organisation editions

Australian Government edition

Policy v2.0 requires a strategic approach to AI adoption set by leadership. The strategic position on AI adoption, communicated to staff, was due by 15 June 2026. The ANAO’s AI governance audits look for a strategy with implementation arrangements. Align the strategy with the National AI Plan and the APS AI Plan.

Dated obligations

15 June 2026Strategic position on AI adoption communicated to staff (Policy v2.0)Met at level 3 (Defined) or higher

References

Policy for the responsible use of AI in government, version 2.0Strategic approach; strategic position communicated to staff by 15 June 2026
AI Plan for the Australian Public Service 2025
National AI Plan
Auditor-General Report No. 26 2024-25: Governance of Artificial Intelligence at the Australian Taxation OfficeAudit criterion: an AI strategy with implementation arrangements

Organisation edition

ISO/IEC 42001 requires top management to set an AI policy and AI objectives. Directors’ guidance in Australia treats AI strategy and its risks as a board oversight matter rather than a technology decision.

References

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClause 5.2 AI policy; clause 6.2 AI objectives
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN function
A Director’s Guide to AI Governance (Version 2)

In Governing Intelligence

In the AI governance assessment: An endorsed AI strategy states our purpose, ambition, focus and boundaries.

Initiatives that lift it

I-101 Write and endorse the AI strategy (level 1 to 3)
I-108 Refresh strategy and appetite from operating evidence (level 3 to 5)

Rate 1.1 in the assessment Back to top

Criterion 1.2

Risk appetite and tiers

ImportanceFoundation ScopeEnterprise-level Responsible AIImpact and risk AI Ethics PrinciplesHuman, societal and environmental wellbeing; Fairness; Accountability

A written AI risk-appetite statement, endorsed by the board or accountable authority, sets tolerance across harm to people, legal exposure, privacy, security and reputation, defines risk tiers with criteria, and names who decides at each tier.

Why it matters

The appetite is what makes risk decisions consistent. Without it, every approval is a negotiation, similar uses get different answers, and the organisation discovers its real tolerance only after an incident.

The five levels

Level	What it looks like	To score this level
1Initial	There is no AI-specific risk appetite. AI risk, where considered at all, is judged case by case by whoever is approving, with no shared tiers.	The starting point: no test.
2Repeatable	The enterprise risk appetite is assumed to cover AI, or a draft AI appetite exists. Tiers are informal (for example ‘low risk’ used in emails) and not defined in writing.	A draft AI appetite exists, or the enterprise appetite explicitly mentions AI.
3Defined	An endorsed AI appetite statement defines at least three tiers with written criteria (such as decisions about people, data sensitivity, reversibility and autonomy), names the decision-maker for each tier, and states what is outside appetite.	The endorsed appetite statement and written tier criteria can be produced, and they name a decision-maker for each tier.
4Managed	Every use case on the register has a tier assigned against the written criteria with a recorded rationale. Breaches of appetite and approved exceptions are logged and reported to the executive or board at least quarterly.	A sample of five register entries each shows a tier, the criteria applied and a rationale, and an exceptions log or quarterly appetite report exists.
5Optimising	The appetite is recalibrated at least annually from incident, near-miss and override data. Tier criteria have been revised at least once on evidence, and the board can show where the appetite changed an investment or stopped a use case.	A documented recalibration of the appetite or tier criteria in the last 12 months cites incident, near-miss or override data.

Evidence to request

Documents

AI risk-appetite statement
Tier criteria and decision-maker per tier
Endorsement minute

Records of it operating

Register extract showing tier and rationale per use case
Exceptions or breach log
Quarterly risk report to the executive or board

In the evidence request: ER-1-03.

Interview probes

Executive sponsor or Chief AI OfficerDescribe a use of AI the organisation would refuse today. Who would make that call, and on what basis?
Risk, compliance and internal auditHow does the AI appetite connect to the enterprise risk framework, and where are AI risks reported?
Use-case owner or business leadWhat tier is your use case, and which criteria put it there?

Staff survey items: S02 I know what our organisation has decided not to use AI for.

Red flags

Every use case is tiered low
Tiers exist but no decision-maker is named for any of them
The appetite says only ‘we have a low appetite for AI risk’, with no criteria

Standards crosswalk

ISO/IEC 42001: Clause 6.1.2Clause 6.1.3
EU AI Act: Article 6Annex III
NIST AI RMF: GOVERN 1MAP 1

Government and organisation editions

Australian Government edition

The National framework for the assurance of AI in government makes a risk-based approach one of its five cornerstones. Policy v2.0 requires high-risk use cases to be governed through a board or senior executive, reported to the DTA once deployment is decided, and reviewed at least every 12 months, so the tier definitions must identify high-risk uses clearly.

References

National framework for the assurance of artificial intelligence in governmentCornerstone: a risk-based approach
Policy for the responsible use of AI in government, version 2.0High-risk use cases
AI impact assessment tool

Organisation edition

ISO/IEC 42001 requires a defined AI risk assessment and treatment process; ISO/IEC 23894 gives guidance on AI risk management. Organisations that place AI on the EU market or use it there should test their tier criteria against the EU AI Act’s high-risk categories.

References

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClauses 6.1.2 and 6.1.3
ISO/IEC 23894:2023 Information technology - Artificial intelligence - Guidance on risk management
Guidance for AI AdoptionMeasure and manage risks
Voluntary AI Safety StandardGuardrail 2
Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)Article 6 and Annex III, where the organisation operates in the EU

In Governing Intelligence

In the AI governance assessment: A written risk-appetite statement names our risk tiers and who decides.

Initiatives that lift it

I-102 Agree the AI risk appetite and tier criteria (level 1 to 3)
I-108 Refresh strategy and appetite from operating evidence (level 3 to 5)

Rate 1.2 in the assessment Back to top

Criterion 1.3

Executive ownership

ImportanceFoundation ScopeEnterprise-level Responsible AIGovernance and accountability AI Ethics PrinciplesAccountability

A named executive sponsor owns AI outcomes, and a Chief AI Officer or equivalent AI lead has the standing, budget and written authority to pause or stop AI use.

Why it matters

Someone senior must be able to say no and be obeyed. Where AI is owned by nobody, or by a role with no authority, risks are accepted by default and investments continue because nobody can stop them.

The five levels

Level	What it looks like	To score this level
1Initial	No executive owns AI. Responsibility is assumed to sit with IT or with whoever runs a pilot.	The starting point: no test.
2Repeatable	An executive or Chief AI Officer is named, but the role has no written delegations, budget or authority to stop a use case. In practice it advises rather than decides.	An appointment record or announcement names the executive sponsor or AI lead.
3Defined	Written delegations give the Chief AI Officer or AI lead authority over the register, gate decisions and the approved tool list, including authority to pause a use case. The role has a budget line and reports to the executive committee.	A delegation instrument names the role’s authorities, including authority to pause AI use, and a budget line for the role can be shown.
4Managed	The authority has been exercised and recorded (for example a pause, a refused tool or a conditional approval), and AI accountability appears in executive performance agreements.	At least one recorded exercise of the authority in the last 12 months, and AI accountability written into at least one executive performance agreement.
5Optimising	Each executive answers for AI in their own portfolio, and the AI lead has moved from gatekeeper to steward of an operating model that business owners run themselves.	AI accountabilities appear in the performance agreements of every executive whose portfolio runs AI, and business owners lead their own gate submissions.

Evidence to request

Documents

Appointment record
Delegation instrument
Position description
Executive performance agreements (relevant extract)

Records of it operating

Budget line for the AI lead or office
Record of a pause, refusal or conditional approval

In the evidence request: ER-1-04.

Interview probes

Executive sponsor or Chief AI OfficerWhen did the AI lead last say ‘no’ or ‘not yet’, and what happened next?
CIO or CTOIf you and the AI lead disagreed about a tool, who would decide?
Use-case owner or business leadWho can stop your AI system tomorrow, and would you comply?

Staff survey items: S03 Leaders in my area talk about AI use and its risks in a way that helps me.

Red flags

The AI lead is a part-time add-on with no time allocation
The role sits several levels below the executive with no direct line to it
Authority to pause exists only on a slide

Standards crosswalk

ISO/IEC 42001: Clause 5.1Clause 5.3
EU AI Act: No direct mapping
NIST AI RMF: GOVERN 2

Government and organisation editions

Australian Government edition

The APS AI Plan expects every agency to appoint a Chief AI Officer during 2026. Policy v2.0 requires accountable officials for implementing the policy, with the DTA told of changes. Since March 2026 the ISM has also carried a principle on executive accountability for AI.

Dated obligations

During 2026Chief AI Officer appointed (APS AI Plan)Met at level 3 (Defined) or higher

References

AI Plan for the Australian Public Service 2025All agencies expected to appoint a Chief AI Officer in 2026
Policy for the responsible use of AI in government, version 2.0Accountable officials for implementing the policy
Information Security ManualExecutive AI accountability principle (March 2026)

Organisation edition

ISO/IEC 42001 requires top management to demonstrate leadership of the AI management system and to assign roles, responsibilities and authorities. ASIC’s review of AI governance found that governance often lagged adoption.

References

In Governing Intelligence

In the AI governance assessment: Our accountable officials and Chief AI Officer are named, empowered and known to the DTA, and each in-scope use case has an accountable owner.

Initiatives that lift it

I-103 Appoint the Chief AI Officer with written authority (level 1 to 3)
I-109 Write AI accountability into executive performance agreements (level 3 to 4)

Rate 1.3 in the assessment Back to top

Criterion 1.4

Investment discipline

ImportanceEnabling ScopeEnterprise arrangement, applied locally Responsible AIGovernance and accountability AI Ethics PrinciplesAccountability

AI investment is managed as a portfolio, tied to readiness gates and whole-of-life cost (including operation, monitoring, assurance and retirement), so that pilots are funded to a decision rather than left to drift.

Why it matters

Pilot sprawl wastes money and erodes confidence. Whole-of-life costing reveals that operating and assuring AI often costs more than building it, and gated funding forces a decision on evidence.

The five levels

Level	What it looks like	To score this level
1Initial	AI spend is untracked. Pilots are funded from team budgets or vendor credits, and nobody can state the total spend or the number of pilots.	The starting point: no test.
2Repeatable	Spend is visible for major projects, but business cases ignore operating and assurance costs, and pilots have no end date or decision point.	Spend on at least the largest AI initiatives can be identified.
3Defined	A portfolio view lists every funded AI initiative with cost, stage and owner. Business cases include whole-of-life cost, and funding is released in tranches at defined gates.	A portfolio register with cost, stage and owner, current within the last quarter, and a business case template that includes operating and assurance costs.
4Managed	Funding decisions are recorded at gates with the evidence considered. At least one pilot has been stopped or reshaped on evidence, and actual against planned cost and benefit is reported quarterly.	Recorded gate funding decisions, at least one evidence-based stop or reshape in the last 12 months, and quarterly actual-against-plan reporting.
5Optimising	Investment is rebalanced across the portfolio on value and risk evidence each cycle. Reuse of shared platforms and patterns is a funding condition, and cost per outcome is tracked for scaled services.	A documented portfolio rebalancing in the last cycle with the value and risk evidence that drove it.

Evidence to request

Documents

Business case template with whole-of-life fields
Funding policy or gate funding rules

Records of it operating

Portfolio register
Gate funding decisions
Quarterly portfolio report
Record of a stopped or reshaped pilot

In systems

Finance system cost codes for AI initiatives (optional)

In the evidence request: ER-1-05.

Interview probes

Executive sponsor or Chief AI OfficerHow many AI pilots are running now, and which of them will be stopped this year?
CIO or CTOWho pays for monitoring, assurance and retirement once a pilot goes into production?
Use-case owner or business leadWhat decision point is your initiative funded to, and what evidence will that decision need?

Red flags

Nobody knows how many pilots are running
Licences bought ahead of any defined use case
Business cases list benefits but no operating cost
No pilot has ever been stopped

Standards crosswalk

ISO/IEC 42001: Clause 6.2Clause 7.1
EU AI Act: No direct mapping
NIST AI RMF: MANAGE 1

Government and organisation editions

Australian Government edition

The ANAO’s audit criteria look for implementation arrangements behind the AI strategy. Gate-based funding also supports the accountable authority’s duties under the PGPA Act to use resources properly.

References

Organisation edition

ISO/IEC 42001 requires resources for the AI management system to be determined and provided. The NIST AI RMF expects a documented decision on whether an AI system should proceed, based on whether it meets its intended purpose.

References

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClause 7.1 resources
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1MANAGE 1

In Governing Intelligence

12.5Investing with discipline

Initiatives that lift it

I-104 Manage AI investment as a gated portfolio (level 1 to 3)
I-107 Gate funding on evidence and act on it (level 3 to 4)

Rate 1.4 in the assessment Back to top

Criterion 1.5

Executive evidence rhythm

ImportanceCore ScopeEnterprise-level Responsible AIGovernance and accountability AI Ethics PrinciplesAccountability; Transparency and explainability

The executive and board review AI evidence (register coverage, gate decisions, incidents and near misses, overrides, benefits) on a fixed cadence and act on it.

Why it matters

Leaders who see only project updates cannot govern risk or value. A standing evidence rhythm is how problems surface before they become incidents and how leaders answer external questions with confidence.

The five levels

Level	What it looks like	To score this level
1Initial	AI reaches the executive only as occasional project updates, or after something has already gone wrong.	The starting point: no test.
2Repeatable	AI is an occasional agenda item. Papers describe activity (pilots launched, licences bought) rather than evidence of control or value.	At least one executive paper on AI in the last 12 months.
3Defined	A standing AI item at the executive committee, at least quarterly, uses a defined dashboard covering register coverage, assessments, gate decisions, incidents and benefits. The board receives an AI report at least twice a year.	A standing AI item with a defined dashboard at the last two quarterly cycles (or every cycle since it began), and two board AI reports in the last 12 months.
4Managed	Dashboard figures are generated from systems of record (register, incident log, monitoring) rather than compiled by hand, and minutes show decisions taken because of the evidence, such as a pause, an investment or an added control.	Each dashboard figure traces to a named system of record, and at least two minuted decisions in the last 12 months were driven by dashboard evidence.
5Optimising	Leading indicators (override rates, drift alerts, near-miss trends) trigger escalation between meetings, and the executive can answer an external inquiry from the dashboard on the day it is received.	Documented automatic escalations between meetings, and an external inquiry answered from the dashboard.

Evidence to request

Documents

Dashboard definition (measures and sources)
Board AI reports

Records of it operating

Executive agendas, papers and minutes for the last 12 months
Decisions recorded as a result of dashboard evidence

In systems

Dashboard data lineage to the register, incident log and monitoring

In the evidence request: ER-1-06.

Interview probes

Executive sponsor or Chief AI OfficerWhat did the last AI dashboard tell you that you did not already know, and what did you do about it?
Risk, compliance and internal auditWhere do the dashboard numbers come from, and has anyone tested them?
CIO or CTOHow long does it take to produce the AI dashboard each quarter, and who produces it?

Red flags

The dashboard is a traffic-light status report with no numbers
Figures are compiled manually by one person
An override rate of zero or no near misses reported, accepted without question

Standards crosswalk

ISO/IEC 42001: Clause 9.3
EU AI Act: No direct mapping
NIST AI RMF: GOVERN 1

Government and organisation editions

Australian Government edition

Policy v2.0 requires high-risk use cases to be governed through a board or senior executive. The ANAO’s audits test structured monitoring of AI in production; the IP Australia audit recommended risk-based monitoring even for a largely effective agency.

References

Policy for the responsible use of AI in government, version 2.0High-risk use cases governed through a board or senior executive
Auditor-General Report No. 26 2024-25: Governance of Artificial Intelligence at the Australian Taxation OfficeStructured monitoring
Auditor-General Report No. 43 2025-26: Artificial Intelligence Use in IP Australia

Organisation edition

ISO/IEC 42001 requires periodic management review of the AI management system. Directors’ guidance expects boards to receive regular reporting on AI use and risk.

References

ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management systemClause 9.3 management review
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1GOVERN 1
A Director’s Guide to AI Governance (Version 2)

In Governing Intelligence

In the AI governance assessment: Evidence from our AI dashboard feeds an annual refresh of the strategy.

Initiatives that lift it

I-105 Stand up the quarterly executive AI review (level 1 to 3)
I-106 Generate the executive dashboard from systems of record (level 3 to 4)

Rate 1.5 in the assessment Back to top

In Governing Intelligence

The framework chapters that describe the practice this domain measures, and the governance assessment questions that test it at a higher level.

In the AI governance assessment: An endorsed AI strategy states our purpose, ambition, focus and boundaries. A written risk-appetite statement names our risk tiers and who decides. Our accountable officials and Chief AI Officer are named, empowered and known to the DTA, and each in-scope use case has an accountable owner. Evidence from our AI dashboard feeds an annual refresh of the strategy.

This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.