11The maturity journey and a roadmap

Adopting this framework is itself a journey, and it should be paced by readiness rather than ambition. This section sets out where most agencies start, the breakpoint that catches them, and a phased roadmap that aligns to the policy’s obligations.

11.1Where agencies start, and the breakpoint that catches them

Most agencies begin at maturity levels 1 to 2: assistive AI, human-decided, with governance that is partial and reactive. The temptation is to leap toward more autonomous, higher-value use cases. The AI Autonomy Ladder warns against it. The decisive obstacle is the threshold between rungs 2 and 3, the point at which an AI moves from drafting outputs a human approves to operating under supervision. Crossing it safely requires the architecture, design and governance that this framework builds; attempting it without them is why so many promising pilots cannot be scaled into production. The discipline is to cross this threshold deliberately, with the foundations in place, rather than stumble across it under delivery pressure.

11.2A phased roadmap

The framework recommends three horizons. The first is about mobilising and complying, and maps directly to the policy’s phased 2026 deadlines. The second operationalises the assurance lifecycle and hardens the foundation. The third scales with confidence across the supervision threshold. The roadmap is indicative; an agency should pace it to its own risk appetite and capacity.

Horizon 1 · 0 to 90 days

Mobilise and comply

• Name accountable officials
• Stand up the committee
• Open the register
• Adopt tiers and gates
• First impact assessment

Horizon 2 · 3 to 12 months

Operationalise and assure

• Embed the lifecycle and gates
• Harden the landing zone
• Publish transparency statements
• Provenance and monitoring
• Build capability

Horizon 3 · 12 to 24 months

Scale with confidence

• Cross the supervision threshold deliberately
• Introduce simulation
• Extend policy as code
• Mature the decision passport
• Independent assurance

11.3Measuring progress

Maturity should be evidenced, not asserted. Useful measures include the proportion of AI use cases on the register with a completed impact assessment; the proportion of in-scope decisions with provenance sufficient to support contestability; the share of high-risk systems that have passed simulation before deployment; mean time to detect and respond to drift; and the rate and resolution of human overrides. These measures also feed the governance-to-strategy loop in the five-forces model, surfacing where the agency should slow down, invest, or proceed.