A five-stage AI governance maturity model for enterprises, progressing from Unmanaged (no inventory) through Documented, Controlled, Evidenced, and Continuous. Each stage is defined by a concrete test — what you could show a regulator today — rather than by intent or policy. Key insights: most organizations sit at stage two, the AI system inventory is the gate to stage three, and stage four (full audit traceability to field-level data) is where audits stop being painful. Includes a self-assessment checklist and guidance on advancing stages without skipping, with a note that buying governance tooling before completing the inventory is the most common expensive mistake.
Table of contents
Key TakeawaysWhat an AI Governance Maturity Model Is ForStage 1: UnmanagedStage 2: DocumentedStage 3: ControlledStage 4: EvidencedStage 5: ContinuousThe Five Stages at a GlanceThe Self AssessmentThe AI Model Inventory, and Why It Gates EverythingWhat an AI Audit Trail Has to ContainGoverning Language Models SpecificallyHow to Advance a StageWhere Decube FitsFrequently Asked QuestionsQuestions this post answers
What are the five stages of an AI governance maturity model?
The five stages are: Unmanaged (AI in use with no inventory or ownership), Documented (policy and partial inventory exist but nothing is enforced), Controlled (registration is a deployment gate, every system has an owner, classification, and data scope), Evidenced (outputs can be traced back to field-level data and approvals), and Continuous (registration and review happen automatically without human prompting). Teams navigating AI compliance audits track frameworks like this on daily.dev.
What should an AI audit trail contain to satisfy regulatory requirements?
An AI audit trail must include: the input data at field level (not just dataset name), the model or agent version that was live at the time, the action the system took, the authorisation that permitted it to operate in that scope, and a retention period long enough to outlast supervisory questions — which frequently arrive more than a year after the event. Developers building audit-ready AI systems find the latest governance standards on daily.dev.
Why do most enterprise AI governance programs stall at stage two?
Most programs stall at stage two because their inventory omits purchased tools and internally built agents. A policy document and a partial spreadsheet exist, but systems can still reach production without being registered. The fix is making registration a hard deployment gate rather than a voluntary request — until deployment depends on it, the register decays faster than it is maintained. Engineers responsible for AI compliance keep up with governance practices on daily.dev.