Skip to main content
Bureau of AI

AI Governance Benchmark Report

How Does Your AI Governance Program Stack Up Against Peers?

Benchmark maturity across AI impact assessment, risk tiering, FRIA, and controls, with numbers you can take to the board.

Get the benchmark report

The problem

You need quotable data, not another opinion

AI governance frameworks are maturing on paper, but tooling, rigor, and cross-functional accountability have not kept pace. When you go to the board to justify governance investment or report program maturity, general principles do not land.

This report gives you objective, peer-referenced figures from structured assessments of enterprise programs, so you can show exactly where your program sits and what it will take to close the gap.

Free download

Get instant access to the benchmark report

Benchmark data you can quote in your next governance review.
  • 21-page report across 9 sections
  • Six governance domains, benchmarked
  • Self-assessment maturity rubric included
The State of AI Impact Assessment

Download the report

Instant access. No cost.

Verifying you're human...

Key benchmarks

The numbers you can quote internally

17%
of organizations apply a documented risk tiering methodology consistently across all AI use cases.
41/22%
map internal tiers to EU AI Act categories in some form, but only 22% have formally harmonized with Annex III high-risk classifications.
19%
report any automation in their risk tiering process; manual tiering remains the norm.
11%
have fully integrated Fundamental Rights Impact Assessment into their AI governance workflow.
47/28%
still run AI impact assessment work in spreadsheets or shared documents, while 28% use dedicated software.

Inside the report

What is inside the 21-page report

Maturity signals and primary gaps across all six governance domains, side by side
Respondent profile by industry, organization size, and role, so you can find your comparison group
FRIA adoption rates and which sectors lead versus lag
Tooling profile and 12-month buying intent across spreadsheets, dedicated software, and GRC platforms
The four-level Ad Hoc to Optimized scoring rubric to self-assess your program
A sequenced maturity roadmap with priority actions at each level, from Foundational to Optimizing

The payoff

What you can do once you have read it

Place your program on a defined maturity scale

Score intake, tiering, assessment rigor, FRIA, control mapping, and tooling against the same rubric used across the respondent base.

Find your true comparison group

Filter the benchmarks to peers of your industry and size instead of comparing against a generic average.

Justify governance investment with hard figures

Walk into a board or executive review with peer data that frames your gaps and priorities in concrete terms.

Sequence your next moves correctly

Use the roadmap to stabilize intake before tiering and map controls to tiers, avoiding the ordering mistakes that create audit gaps.

Methodology

How the benchmarks were built

62-item questionnaire

Maturity scored on a 62-item structured AI risk questionnaire plus artifact review of policy documents, risk registers, and intake logs.

Rubric from recognized standards

Scoring rubric adapted from NIST AI RMF function tiers and ISO/IEC 42001 control domains.

Enterprise respondent base

34% financial services, 21% healthcare and life sciences, with 58% large enterprises of 10,000 or more employees.

Senior roles represented

CRO/CCO or equivalent (28%), model risk leads and validators (24%), and AI/ML governance professionals (22%).

Mapped to named frameworks

Findings mapped to the EU AI Act (including Annex III and Article 27), NIST AI RMF, SR 11-7, ISO/IEC 42001, and GDPR Article 35.

Stated limitations

Self-report optimism bias mitigated through artifact validation; findings reflect a point-in-time snapshot.

FAQ

Questions before you download

It is benchmark data from structured assessments, scored on a defined rubric and tied to named frameworks including the EU AI Act, SR 11-7, NIST AI RMF, and ISO/IEC 42001, not general commentary.

Get the benchmark report

See exactly where your program stands

Benchmark data you can quote in your next governance review.