AI Governance · Whitepaper

Appendix B · Appendices

Appendix B: AI Governance Maturity Model

Appendix B from "AI Governance"

Author Conceived and directed by Gunnar Nordqvist; text written by AI agents under his direction.
Published 1 November 2026
Build number 2026.11
eu-ai-act governance-as-code agentic-architecture digital-sovereignty
Figure B.1: The maturity staircase. Each step names the enabler that most often unlocks the next level; the eight dimensions are assessed at every level and are set out in the model below.
Figure B.1: The maturity staircase. Each step names the enabler that most often unlocks the next level; the eight dimensions are assessed at every level and are set out in the model below.

This appendix gives an organisation a way to judge how far it has come in adopting the practices in this book, and what to do next. The model has five levels (Exploring, Piloting, Industrialising, Governing, Optimising) and eight dimensions (data, platform, model lifecycle, governance, security, evaluation, organisation, sustainability). For each dimension and level it names observable indicators, and it closes with a self-assessment template in YAML, so that the assessment is itself a version-controlled artefact. The model extends the maturity model in Appendix E of Architecture as Code (66, Nordqvist, 2025).

Assess each dimension separately. A bank may be Governing in security and Piloting in sustainability. The profile shows where the next investment belongs.

An organisation is at a level in a dimension when it meets the indicators for that level and every level below it. Where a single overall level is needed, use the lowest dimension. Assess twice a year with the same assessors and store the result as the YAML record below; the diff between two assessments is the progress report.

Primary topics explored

  1. How to use the model
  2. The five levels
  3. The eight dimensions
  4. Moving up
  5. Relationship to national readiness assessments
  6. Self-assessment template

About AI Governance

AI Governance is Book 2 of The Transformed Architecture. It shows how large European enterprises and public authorities decide what artificial intelligence is used for, classify and manage its risks, meet the obligations of the EU AI Act and its neighbours, choose and contract their suppliers, organise the forums that take decisions, and produce the evidence that shows it is all true.

It builds on the conclusions of Architecture as Code.

Who should read this

Chief risk and compliance officers, AI governance boards, CIOs and chief architects, and senior officials in public authorities.

Portrait of Gunnar Nordqvist

Gunnar Nordqvist

Conceived, directed and published the books of The Transformed Architecture.

Continue with the full chapter

Read the full chapter online

Appendix B: Appendix B: AI Governance Maturity Model in AI Governance gives the detailed explanations, practical examples and implementation patterns behind this summary.

This whitepaper belongs to “Appendices” and is one of 32 drawn from the manuscript.