AI governance maturity model: what it measures and how to use it

How prepared is your company to govern AI? A maturity model sorts the answer into levels. This guide explains how a model published by Microsoft is built and how to use it well.

A note: the only model we describe is Microsoft’s Responsible AI Maturity Model (report MSR-TR-2023-26, version 1 of May 17, 2023), read on its Microsoft Research page and in its document (cited at the end, consulted in November 2026). It measures maturity in responsible AI, a topic close to governance but not identical. In our search, the other “AI governance maturity” models were from consultancies and vendors and we found no single official standard; we did not use them. What is Cyrrus’s judgment, we say so.

What is a maturity model?

Microsoft presents its model as a framework to help organizations identify their current and desired levels of responsible AI maturity, and describes it as a map of a complex, evolving territory, not as a measure. In general (Cyrrus’s judgment), a maturity model sorts practices into levels to decide where to go next.

Where does your company’s AI governance stand today?

We design your organization’s AI Governance framework: what can be automated, what needs human oversight, and who is accountable for each decision.

• Risk map by use case, not a generic policy
• Defined roles between business, IT, and legal

Learn about AI Governance

How Microsoft’s model is built

It has 24 dimensions derived empirically from interviews and focus groups with more than 90 responsible AI specialists and AI practitioners. Each dimension has five levels, from 1 to 5: Latent, Emerging, Developing, Realizing and Leading. The dimensions are grouped into three categories.

Per the document, organizational foundations are the base of the other two categories, and the dimensions depend on each other: progress on one can depend on the maturity of others.

Usage rules the document itself gives

Microsoft recommends using the model as a map for guidance and not as a measurement tool for punitive purposes; not calculating an overall score or averaging across dimensions, because some weigh more than others (a level 5 in tooling does not have the same impact as a level 5 in culture and leadership); using it to supplement, not replace, other AI, security and privacy maturity models; and having both senior leaders and team members respond, treating differences in perception as a signal of room to improve.

It also warns that progress between levels is not linear: moving out of levels 1 and 2 can require creating new processes, which is resource-intensive, while moving out of levels 3 and 4 may just be formalizing or integrating what already exists. It adds that level 5 may not be applicable or desirable for every organization and that all criteria of one level should be met before moving to the next.

Turn the assessment into a plan

We help your leadership team decide what to delegate, what to supervise, and what to never automate — before adoption outruns control.

• Governance committee with business, IT, legal, and security
• Clear criteria for approving new AI use cases

Schedule a conversation about AI Governance

What it does not solve

The document is from May 2023, before the EU AI Act entered into force (August 1, 2024), and describes itself as a living artifact that will continue to evolve. We did not see in it a mapping to that regulation or to ISO/IEC 42001; any mapping would be our own judgment. We include no benchmark figures across companies because we have no primary source to back them.

What leadership needs to decide

Three decisions, from Cyrrus’s judgment. First, which dimensions to address first; the document places organizational foundations (leadership, governance, policy) as the base for the others. Second, who answers for each dimension. Third, how often to repeat the assessment and who reviews it. Use it as the starting point for a conversation, not as a grade.

To see the frameworks that accompany a maturity model and how to evaluate tools, read what AI governance is and which frameworks to use and how to evaluate governance tools.