Assessment Criteria Overview
Structured summary of the governance criteria used in AIGC governance assessments.
Introduction
Governance assessments conducted by AI Governance Council Australia evaluate governance maturity against AIGC's published framework. The assessment examines the extent to which an organisation has established, documented, and maintained governance arrangements for its use of artificial intelligence.
The focus of assessment is on governance oversight mechanisms — accountability structures, risk management integration, policy frameworks, review processes, and transparency — rather than the technical performance of individual AI systems.
The Five Pillars of Governance Maturity
AIGC governance assessments evaluate governance maturity across five pillars. Each pillar examines a distinct dimension of organisational governance.
Pillar 1: Accountability and Ownership
Board visibility
Evidence that AI governance matters are reported to, and visible at, board or senior leadership level.
Defined responsibility
Clear designation of individuals or roles accountable for AI governance within the organisation.
Documented governance structure
A formal governance structure that defines reporting lines, decision-making authority, and escalation pathways for AI-related matters.
Pillar 2: Risk Identification and Register Integration
AI risk identification
A documented process for identifying risks associated with the development, deployment, or procurement of AI systems.
Integration with enterprise risk registers
Evidence that AI-specific risks are recorded within the organisation's broader enterprise risk management framework.
Documented risk monitoring
Ongoing monitoring arrangements for identified AI risks, including review frequency and responsibility.
Pillar 3: Policy and Control Structures
Formal policies
Documented policies governing the use, development, procurement, and oversight of AI systems within the organisation.
Control documentation
Defined controls that operationalise governance policies, including approval processes, access controls, and usage boundaries.
Governance procedures
Documented procedures that support the implementation and enforcement of AI governance policies across relevant business functions.
Pillar 4: Oversight and Review Mechanisms
Periodic review
Scheduled review of AI governance arrangements, including policies, risk assessments, and control effectiveness.
Monitoring processes
Mechanisms for ongoing monitoring of AI system behaviour, governance adherence, and emerging risks.
Escalation pathways
Defined processes for escalating governance concerns, incidents, or material changes in AI risk profiles to appropriate decision-makers.
Pillar 5: Independent Review and Transparency
Internal review
Evidence of internal review or audit of AI governance arrangements, conducted independently of the teams responsible for AI deployment.
External review processes
Arrangements for external review of governance practices where appropriate, including third-party assessments or independent evaluations.
Documentation and reporting discipline
Systematic documentation of governance activities, decisions, and review outcomes, maintained in a manner that supports accountability and transparency.
Maturity Levels
AIGC governance assessments recognise three levels of governance maturity. Each level reflects the degree to which an organisation has formalised and embedded its AI governance arrangements.
Level 1: Early Stage
The organisation has begun to recognise the need for AI governance. Initial steps may include informal discussions, preliminary risk identification, or early-stage policy drafting. Governance structures are not yet formalised or consistently applied.
Level 2: Developing
The organisation has established foundational governance elements. Policies and risk identification processes exist but may not be fully integrated across the organisation. Oversight mechanisms are emerging but may lack consistency or formal review cycles.
Level 3: Formalised
The organisation maintains a structured and documented AI governance framework. Policies, controls, and oversight mechanisms are formally established, consistently applied, and subject to periodic review. Governance responsibilities are clearly defined and governance activities are documented.
The maturity level awarded reflects governance maturity at the time of assessment. It does not represent a permanent status and is subject to the assessment period and conditions specified in AIGC's assessment procedures.
Evidence Requirements
Organisations seeking a governance assessment must provide documented evidence to support their governance claims across each pillar. Evidence may include, but is not limited to:
- Board papers, meeting minutes, or reports demonstrating governance visibility
- Risk registers incorporating AI-specific risks
- Published policies and documented procedures
- Records of periodic governance reviews or audits
- Organisational charts or governance structure documentation
The specific evidence required is determined by the scope of the assessment and the maturity level sought. Assessors evaluate evidence against AIGC's published criteria.
Important Clarification
An AIGC governance assessment does not constitute legal compliance approval or technical validation of AI systems. The assessment reflects an independent evaluation of governance maturity against AIGC's published framework at the time of assessment. It does not represent regulatory endorsement, statutory compliance, or a warranty regarding the performance, safety, or legality of any AI system.
Related information
Review AIGC's governance framework and assessment methodology.