# AI Governance Maturity Assessment: Score Your Controls Before an Auditor Does > Source: https://netray.co/tools/ai-governance-maturity-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Score your AI governance across policy, inventory, risk classification, data handling, monitoring, and executive oversight, and get a banded improvement roadmap. ## Category ai-automation ## Tool **Kind:** assessment **Questions:** #### Do you have a written, approved AI use policy? **Options:** ##### Approved policy, communicated to all staff, reviewed at least annually **Score:** 3 ##### Policy exists and is approved but communication has been patchy **Score:** 2 ##### A draft is circulating but has not been approved **Score:** 1 ##### No policy; guidance is informal or verbal **Score:** 0 #### Do you maintain an inventory of AI systems in use across the business? **Help:** Shadow AI usage through personal accounts is the most commonly missed category in a first inventory. **Options:** ##### Complete inventory including embedded vendor AI features, reviewed quarterly **Score:** 3 ##### Inventory of company-deployed systems only **Score:** 2 ##### An informal list someone maintains in a spreadsheet **Score:** 1 ##### No inventory; nobody could list what is in use **Score:** 0 #### Is there an approval process before a new AI use case goes live? **Options:** ##### Documented intake with defined approvers, criteria, and turnaround times **Score:** 3 ##### Approval required but criteria vary by reviewer **Score:** 2 ##### Ad hoc sign-off from whoever is available **Score:** 1 ##### Teams deploy AI without any approval step **Score:** 0 #### Do you classify AI use cases by risk level? **Help:** Risk tiering lets you apply proportionate controls instead of blocking everything or nothing. **Options:** ##### Formal tiering aligned to a recognized framework, with controls mapped per tier **Score:** 3 ##### Internal risk tiering exists but is not mapped to a published framework **Score:** 2 ##### Risk is discussed case by case with no defined tiers **Score:** 1 ##### No risk classification of any kind **Score:** 0 #### Are there enforced rules about what data may be sent to AI systems? **Options:** ##### Classification-based rules enforced by technical controls, not just policy text **Score:** 3 ##### Clear written rules relying on user compliance **Score:** 2 ##### General guidance such as do not share confidential information **Score:** 1 ##### No rules; users decide what to paste in **Score:** 0 #### How do you conduct due diligence on AI vendors and models? **Options:** ##### Standard assessment covering data use, training rights, residency, subprocessors, and security **Score:** 3 ##### Security review only, without AI-specific data and training questions **Score:** 2 ##### We rely on the vendor's marketing claims and certifications **Score:** 1 ##### No vendor diligence specific to AI **Score:** 0 #### Is AI output quality evaluated before release and monitored afterwards? **Options:** ##### Pre-release evaluation on a golden set plus ongoing monitoring with alert thresholds **Score:** 3 ##### Pre-release testing but no ongoing monitoring **Score:** 2 ##### Informal review during build only **Score:** 1 ##### No structured evaluation at any point **Score:** 0 #### Are AI incidents defined, reportable, and rehearsed? **Help:** An AI incident includes wrong output that caused a business decision, not only a security breach. **Options:** ##### Defined categories, a reporting path, and rehearsed response runbooks **Score:** 3 ##### AI incidents fold into the general IT incident process **Score:** 2 ##### Handled informally when someone escalates **Score:** 1 ##### No definition or process exists **Score:** 0 #### How well aligned are you to applicable regulation and standards? **Help:** Consider NIST AI RMF, ISO 42001, EU AI Act obligations, and sector rules such as ITAR, EAR, or CMMC. **Options:** ##### Mapped to the applicable frameworks with documented evidence per control **Score:** 3 ##### Requirements identified and a gap plan is in progress **Score:** 2 ##### Aware of the requirements but no gap analysis done **Score:** 1 ##### We have not assessed which obligations apply to us **Score:** 0 #### Does leadership receive regular reporting on AI risk and value? **Options:** ##### Standing executive or board reporting covering both realized value and open risks **Score:** 3 ##### Periodic updates on projects, with limited risk content **Score:** 2 ##### Reporting happens only when something goes wrong **Score:** 1 ##### No leadership visibility into AI activity **Score:** 0 **Bands:** #### Ungoverned: exposure is accumulating quietly **Min:** 0 **Max:** 39 **Verdict:** AI is almost certainly already in use across your business through personal accounts and embedded vendor features, and nobody can currently list where. That combination creates data leakage and compliance exposure that grows with every month of inaction. The fix is fast and unglamorous: find out what is in use, then publish rules people can actually follow. **Recommendations:** - Run a two-week discovery to inventory AI in use, including personal accounts and vendor-embedded features. - Publish a short, readable AI use policy that states clearly what data may never be entered into external tools. - Stand up a lightweight intake form so new use cases become visible before they go live. - Add AI-specific questions on data use, training rights, and residency to your vendor assessment template. - Brief the executive team on current exposure so governance investment is a decision rather than an accident. #### Emerging: policy exists, enforcement does not **Min:** 40 **Max:** 64 **Verdict:** You have the paperwork and are missing the mechanisms. Policies that depend entirely on user compliance fail predictably under deadline pressure, and an inventory that is not refreshed goes stale within a quarter. Focus this year on converting written rules into technical controls and repeatable review cadences. **Recommendations:** - Back your data handling rules with technical enforcement such as tenant controls, DLP, or an approved gateway. - Introduce risk tiering so low-risk use cases move fast and high-risk ones get proper scrutiny. - Define AI incident categories and add at least one AI scenario to your next response rehearsal. - Set a quarterly cadence to refresh the AI inventory and retire systems nobody uses. - Complete a gap analysis against NIST AI RMF or ISO 42001 to sequence the next twelve months. #### Managed: solid foundation, uneven depth **Min:** 65 **Max:** 84 **Verdict:** Your governance holds up for the use cases you know about. The usual weak points in this band are ongoing output monitoring and evidence quality: controls exist but you would struggle to prove they operated consistently. Closing that gap is what separates a program that passes an audit from one that merely expects to. **Recommendations:** - Add post-release output monitoring with alert thresholds, not just pre-release testing. - Map every control to documented evidence so an assessment does not become an archaeology exercise. - Extend risk tiering to agentic use cases where the system takes actions rather than producing text. - Formalize executive reporting to cover realized value alongside open risks and incidents. - Test the governance process against a real high-risk use case to find where it is slower than the business tolerates. #### Optimized: govern for speed, not just safety **Min:** 85 **Max:** 100 **Verdict:** Your controls are mature and evidenced. The risk in this band flips: over-governance that pushes teams back into shadow AI because the approved path is too slow. Measure governance by how quickly a low-risk use case reaches production as well as by how reliably a high-risk one is caught. **Recommendations:** - Publish service levels for AI intake and approval so teams can plan around the process. - Create a pre-approved fast lane for low-risk patterns using vetted platform components. - Automate evidence collection from your platform so audits draw on live data rather than manual attestations. - Extend governance to third parties and suppliers who use AI on your data or deliverables. - Review the framework annually against regulatory change, especially EU AI Act phase-in and sector requirements. ## Content **Intro:** This free AI governance maturity assessment scores your organization across the ten controls that regulators, auditors, and enterprise customers now ask about. It is built for CIOs, compliance leaders, and risk officers at manufacturers and defense contractors where AI is spreading faster than the policy covering it. Ten questions examine policy, system inventory, use case approval, risk tiering, data handling enforcement, vendor diligence, output evaluation, incident response, regulatory alignment, and executive reporting. You get a percentage score, a maturity band, and five prioritized recommendations. The most common finding is not weak policy but policy with no enforcement mechanism behind it. **Sections:** #### How maturity is scored **Body:** Each question offers four options worth zero to three points across ten questions, giving a maximum of thirty. The percentage places you in one of four bands: ungoverned below 40%, emerging from 40 to 64%, managed from 65 to 84%, and optimized at 85% and above. Questions are weighted equally on purpose. In practice the binding constraint is rarely the sophistication of your best control; it is the weakest link that an auditor or an incident finds first. An organization with an excellent policy and no system inventory has no idea what its policy applies to, which is functionally the same as having no policy. #### The frameworks these questions map to **Body:** The ten controls are drawn from the frameworks that enterprise buyers, auditors, and regulators actually reference, translated into plain questions you can answer without a compliance dictionary open beside you. If you need formal mapping for a customer questionnaire or an internal audit, each area corresponds to recognizable control families in the published standards below. **Bullets:** - NIST AI Risk Management Framework: the govern, map, measure, and manage functions underpin questions one through eight. - ISO/IEC 42001: AI management system requirements align to policy, inventory, and leadership reporting. - EU AI Act: risk classification and post-market monitoring obligations map to the tiering and monitoring questions. - CMMC, ITAR, and EAR: data handling enforcement and vendor residency diligence carry extra weight for defense suppliers. #### Interpreting your band without over-correcting **Body:** The failure mode at low maturity is exposure; the failure mode at high maturity is friction. If you score in the lower bands, resist the instinct to ban AI outright, because blanket bans reliably push usage into personal accounts where you have no visibility at all. Publish a clear rule about what data may never leave the boundary, provide a sanctioned tool that is genuinely good, and make the approved path the easy path. If you score in the upper bands, start measuring how long your own approval process takes. A governance program that adds six weeks to every low-risk request will be routed around, and you will be back to shadow AI with better paperwork. #### How Netray builds governance that survives contact with delivery **Body:** Netray implements AI governance for manufacturers and defense contractors as part of delivering working systems, not as a separate documentation exercise. We build the inventory, define proportionate risk tiers, and wire enforcement into the platform so data classification rules are technical controls rather than reminders. For clients under ITAR, EAR, or CMMC, we deploy models on-prem or air-gapped so the governance question about data residency has a simple structural answer. We also automate evidence collection from the platform itself, which means your next audit draws on logs your systems already produce instead of a scramble for screenshots. **Cta:** Get an evidenced AI governance gap analysis from Netray, mapped to the frameworks your customers and auditors actually cite. **Faq:** #### Where should an organization with no AI governance start? **Answer:** Start with discovery, not policy. Spend two weeks finding what AI is already in use, including personal accounts and features quietly embedded in software you already own. Almost every organization is surprised. Then publish one short readable rule about what data may never be entered into external tools, and provide a sanctioned alternative that is actually good. Inventory plus a usable sanctioned path removes more risk in a month than a comprehensive policy document does in a year. #### Does the EU AI Act apply to a US manufacturer? **Answer:** It can. The obligations follow where the output is used, so a US manufacturer whose AI-assisted products or services reach the EU market may fall in scope, as may one supplying an EU customer who is in scope. The practical response is the same either way: classify your use cases by risk, document the high-risk ones, and keep post-market monitoring records. That work also satisfies most of NIST AI RMF and ISO 42001, so it is rarely wasted effort. #### How is governing AI agents different from governing chatbots? **Answer:** Agents take actions, so governance must cover consequences rather than just content. That means action-level authorization, spend and quantity limits, human confirmation for high-impact operations, and audit logs tying every tool call to an initiating user. Risk tiering also needs an extra dimension: a low-risk topic becomes high risk the moment the system can write to your ERP. Most governance frameworks written for generative text need explicit extension before they cover agentic deployments. ## Search terms AI governance maturity assessment, AI governance framework enterprise, NIST AI RMF assessment, EU AI Act readiness, responsible AI governance checklist, AI risk management maturity, AI policy for manufacturers --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json