AI governance maturity models expose the gap between policy and control

At a glance

What this is: AI governance maturity models show whether AI controls are merely documented or actually enforced across the full lifecycle of employee, model, application, and agent activity.

Why it matters: For IAM teams, the maturity gap matters because governance that cannot see Shadow AI, assign accountability, or prove control over AI actions will not hold across NHI, autonomous, or human identity programmes.

By the numbers:

• 81% remain in the first two stages of responsible AI maturity.
• Only 18% of organisations have established AI governance councils.

👉 Read WitnessAI's analysis of AI governance maturity models and control gaps

Context

AI governance maturity is the difference between saying you have control and being able to prove it. In practice, many organisations have policy documents, but they still cannot show which AI systems are in use, who owns them, or whether guardrails work when employees, applications, models, and agents interact.

That gap matters because AI governance now spans human use, NHI-style runtime activity, and agentic behaviour. Once AI shifts from chat interactions to autonomous actions, governance has to cover visibility, accountability, auditability, and enforcement together rather than as separate workstreams.

Key questions

Q: How should organisations assess AI governance maturity in practice?

A: Assess maturity by asking whether your programme can prove control, not just describe it. A useful assessment checks inventory completeness, ownership, auditability, risk classification, runtime enforcement, and incident handling. If evidence must be assembled after the fact, the programme is still operating below mature control levels.

Q: Why does Shadow AI undermine AI governance maturity scores?

A: Shadow AI undermines maturity because you cannot govern what you cannot see. If unsanctioned tools, hidden integrations, or unmanaged agents are outside the inventory, risk assessments, policy enforcement, and audit trails are all incomplete. Mature programmes start with observed usage, then build controls around the real AI estate.

Q: When should organisations move from policy review to runtime AI controls?

A: Move to runtime controls as soon as AI systems can make decisions or trigger actions that affect data, workflows, or external systems. At that point, manual review cycles are too slow to contain harm. Continuous enforcement, logging, and blocking logic become necessary to make governance operational.

Q: What is the difference between AI governance maturity and AI compliance?

A: Compliance asks whether required obligations are met, while maturity asks whether governance works consistently across the full operating model. A compliant-looking policy can still fail if controls are manual, incomplete, or unenforced. Mature governance proves that the organisation can sustain control, evidence, and escalation over time.

Technical breakdown

AI governance maturity and operational enforcement

A credible maturity model separates written governance from enforceable control. Foundational and emerging stages usually have policies, committees, or mapped principles, but they lack runtime enforcement, complete inventories, and evidence that controls work under live conditions. Operational maturity adds classification, monitoring, and audit trails, while embedded maturity pushes those controls into technical systems that can react continuously. The practical question is whether governance is a document or a control plane. If the answer depends on manual review, the organisation is not yet operating at mature AI governance.

Practical implication: measure maturity by whether controls are enforced in runtime, not by whether policies exist on paper.

Shadow AI, inventory, and AI visibility

Shadow AI is any AI use that exists outside formal governance, including unsanctioned apps, hidden integrations, and unmanaged agent activity. A maturity model cannot be accurate without a complete inventory of what is actually running, because risk tiering and compliance mapping depend on knowing the population first. Network-level visibility matters because it captures real usage rather than declared usage, and that is what separates a paper programme from an operational one. Once visibility is incomplete, every downstream assessment becomes partial and every assurance statement becomes fragile.

Practical implication: build an inventory from observed AI activity, not from procurement records or self-reported system lists.

Runtime defense for agents and applications

As AI systems begin taking actions, governance has to move beyond pre-deployment review and into runtime defense. That means inspecting prompts, outputs, tool calls, and policy decisions as they happen, then blocking or redacting harmful actions before they propagate. This is especially relevant where agent behaviour can trigger APIs, move data, or chain actions across systems without a human pause. In maturity terms, embedded governance is the point where oversight becomes technical, continuous, and auditable rather than periodic and manual.

Practical implication: add runtime policy enforcement and logging for agent actions before you rely on any maturity score.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI governance maturity is not a policy problem, it is a control problem. Organisations often score themselves on documents, committees, and stated principles, but those artefacts do not prove governance is working. The meaningful divide is between declared governance and operational enforcement, because only the latter can show whether AI behaviour is constrained in live environments. Practitioners should treat maturity as evidence of control execution, not evidence of intent.

Shadow AI visibility is the named gap that most maturity models understate. A programme cannot mature if it cannot see the systems it is supposed to govern, and that applies across employee use, applications, models, and agents. This is where governance assumptions fail in practice: policies presume a bounded AI estate, while real usage spreads through unmanaged tools and hidden integrations. Practitioners need to treat unseen AI activity as a governance failure, not a discovery inconvenience.

Runtime governance becomes mandatory once AI actions cross into agentic behaviour. At that point, static review cycles stop being enough because the system can make decisions and trigger actions between human checks. The governance challenge is no longer just classification or approval, but continuous control over action, data movement, and escalation. Practitioners should read maturity as a test of whether they can govern autonomous execution, not just model access.

AI governance maturity should map across human, NHI, and autonomous identity surfaces. The strongest programmes do not treat AI as a side category; they connect workforce use, service-like runtime activity, and agent behaviour under one governance model. That is where IAM, NHI governance, and AI risk management converge. Practitioners should use maturity scoring to expose where each identity surface is controlled differently, then close the gaps with shared governance ownership.

Anthropic, OpenAI, or any single platform is not the governance story; the operating model is. Organisations that stop at vendor features usually miss the harder work of ownership, auditability, and incident handling. Mature programmes ask whether controls survive real usage patterns, third-party AI adoption, and agentic execution across environments. Practitioners should evaluate the operating model first and the tooling second.

From our research:

• Only 18% of organisations have established AI governance councils, according to The State of Non-Human Identity Security.
• 1 in 4 organisations are already investing in dedicated NHI security capabilities, showing that governance gaps are beginning to drive programme spend.
• That forward shift matters because Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs is where ownership, rotation, and offboarding become operational rather than aspirational.

What this signals

AI governance maturity will increasingly be judged by whether organisations can govern Shadow AI and agentic behaviour in the same operating model. That means inventory, policy enforcement, and auditability have to span human use, non-human runtime activity, and autonomous execution. Mature programmes will be the ones that can show control boundaries instead of merely describing them.

The next programme pressure point is evidence. Boards, regulators, and auditors will care less about maturity labels and more about whether teams can produce decision traces, access logs, escalation records, and ownership documentation when asked.

Zero Trust thinking will matter more for AI governance as execution becomes more distributed. Once agents and applications can act across systems, the organisation needs explicit boundaries, continuous verification, and narrow privilege at runtime rather than broad trust at approval time.

For practitioners

• Assess governance against operational evidence Score your programme on whether it can produce inventories, audit trails, risk classifications, and incident records on demand. If the answer depends on manual reconstruction, the maturity level is overstated.
• Build a complete AI use-case inventory Catalog sanctioned, pilot, and Shadow AI across employees, applications, models, and agents. Use observed network activity and platform telemetry, not only procurement or self-reporting, to establish the baseline.
• Assign clear governance ownership Name an accountable executive and create a cross-functional committee that includes security, legal, compliance, HR, and AI or data science leaders. Document decision rights so accountability does not dissolve between functions.
• Add runtime controls for agent activity Inspect prompts, outputs, and tool calls before they can trigger harmful actions or data movement. Extend logging and policy enforcement into runtime so agent behaviour is governed continuously, not just assessed before launch.

Key takeaways

• AI governance maturity is a test of whether controls work in live environments, not whether policies are documented.
• The scale of the gap is still large, with most organisations remaining in early maturity stages and many lacking governance councils.
• Practitioners need inventories, ownership, visibility, and runtime enforcement before maturity scores can be trusted.

Key terms

• AI Governance Maturity: AI governance maturity is the degree to which an organisation can identify, control, monitor, and prove oversight of AI usage. It measures whether governance exists only as policy or is embedded in operational controls, audit trails, accountability, and continuous enforcement across the full AI estate.
• Shadow AI: Shadow AI is AI usage that sits outside formal governance, inventory, or approved workflows. It includes unsanctioned applications, hidden integrations, and unmanaged agent behaviour, all of which create blind spots that make risk classification, compliance, and runtime control incomplete.
• Runtime Defense: Runtime defense is the set of controls that inspect, constrain, or block AI behaviour while it is happening. It goes beyond pre-deployment review by enforcing policy on prompts, outputs, tool calls, and actions before harmful results can spread through connected systems.

Deepen your knowledge

AI governance maturity, visibility, and runtime enforcement are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building governance for AI, Shadow AI, and agentic systems from a similar starting point, it is worth exploring.

This post draws on content published by WitnessAI: AI governance maturity determines whether an organization can see its AI activity clearly, govern it consistently, and prove that governance when someone asks. Read the original.