Governance scoring anchored in standards and evidence

What we were testing ?

Governance assessments often compress a large amount of qualitative information into maturity scores and, for that matter, LLMs can accelerate interpretation while introducing an immediate credibility problem:

What exactly is the score based on?

Our experiment focused on using AI inside a governance assessment anchored in recognized standards, regulatory references and observable organizational evidence.

The reference set brought together perspectives from sources such as NIST, ISO, GDPR...

The objective was not to ask an LLM to invent a governance model, but to use the model to interpret evidence against an explicit one.

What we observed ?

A useful score needs three things to remain separate:

Reference framework
+
Evidence from the organisation
+
Explicit scoring method

The model operates on these inputs, but does not replace them.

This became particularly important when we started applying the model to real data, as a theoretically neat scoring structure quickly had to deal with incomplete information, intermediate values and different kinds of evidence.

What we changed

1 - The four-level score became continuous

The initial model used four integer maturity levels:

1
2
3
4

Once scores started being computed from actual ratios, the underlying data naturally produced intermediate values, so the implementation also moved to a continuous 1.0 - 4.0 scale.

Values such as 1.9, 2.6 or 3.4 became legitimate outputs because the underlying evidence itself did not naturally collapse into four discrete categories.

2 - Generic maturity labels were replaced

The initial labels came from more traditional process-maturity language:

Initial
Developing
Defined
Managed

Since they did not adequately describe AI governance maturity, we replaced them with:

1.0 - 1.4  Unaware
1.5 - 2.4  Emerging
2.5 - 3.0  Developing
3.0 - 3.5  Established
3.5 - 4.0  Embedded

The numerical backbone remained, but the interpretation became governance-specific.

3 - The scoring methodology was made visible

A governance score should not appear as an unexplained number produced by AI, since the reader should be able to inspect the method behind it.

4 - Governance maturity was connected to use-case feasibility

A feasibility matrix was added to relate the governance position to different levels of AI-use-case complexity.

This provided a more practical interpretation than maturity alone.

5 - Missing information was kept missing

One of the most useful rules was to prevent the system from smoothing over gaps simply because it could generate a plausible value.

1. Unknown cost

unknown cost
→ remains unknown
→ becomes a governance finding

2. Declared value

declared value
→ remains declared value

3. Qualitative value

qualitative value
→ remains qualitative

This changed missing information from an inconvenience into part of the assessment.

Lack of visibility can itself indicate a governance weakness.

What we retained ?

The credibility of an AI-assisted governance score comes from the traceability of the chain behind it:

Standards and regulatory references
↓
Observed organisational evidence
↓
Explicit scoring logic
↓
Model interpretation
↓
Inspectable result

Using several models may help challenge an interpretation, but it does not create evidence : If three models agree on an unsupported assumption, the assumption remains unsupported.

The scoring architecture therefore needs to keep the authority outside the LLM:

• standards define the reference;
• organizational evidence defines the facts;
• scoring logic defines how those facts are interpreted;
• AI helps apply and challenge that interpretation.

Takeaway

AI can contribute significantly to governance scoring, with an emphasis on interpreting evidence against an explicit framework.

The credibility of the score however comes from what it is anchored to and whether that chain can be inspected, not from how confidently the model produces the result.