Three forces converged in 2025 to make a rated AI governance standard both necessary and commercially viable.
AMIVADIS measures AI maturity across nine dimensions, covering the full scope of an organisation's AI program — from board-level strategy and governance to execution depth, cultural embeddedness, and financial accountability. Governance & Risk carries the highest weight (15%) because EU AI Act obligations create the legal floor; removing this dimension collapses regulatory defensibility. Financial Impact carries the lowest (9%) because early-stage organisations should not be penalised for an AI program that is still building toward measurable returns.
| # | Dimension | Weight | Primary Regulatory Anchor | Core Question |
|---|---|---|---|---|
| D1 | AI Strategy | Board ownership, investment mandate, competitive narrative | Does the board own and fund AI as a strategic priority? | |
| D2 | Governance & Risk | EU AI Act Art. 9 (RMS) · Art. 13 (transparency) · Art. 14 (oversight) · Art. 17 (QMS) | Is AI governed, risk-classified, and documented? | |
| D3 | Data & Infrastructure | EU AI Act Art. 10 (data governance) · ISO/IEC 42001 Clause 8 | Is AI data governed, lineaged, and bias-monitored? | |
| D4 | Execution & Human Oversight | EU AI Act Art. 14 (human oversight) · Art. 15 (accuracy, robustness) · Art. 26 (deployer obligations) | Are AI deployments tested, monitored, and human-overseen? | |
| D5 | Org Maturity & AI Literacy | EU AI Act Art. 4 (AI literacy — in force Feb 2025) | Does the organisation have the AI competency it legally requires? | |
| D6 | Deployment Breadth | Production pipeline maturity · use case register | How widely and systematically is AI deployed across the business? | |
| D7 | Culture & Leadership | Executive AI ownership · board agenda discipline · OKR integration | Is AI embedded in how leaders lead and how the board governs? | |
| D8 | Foresight & Defensibility | EU AI Act Art. 72 (post-market monitoring) · AI IP protection · competitive intelligence | Can the organisation monitor, protect, and extend its AI advantage? | |
| D9 | Financial Impact | AI investment tracking · EBITDA attribution · investor reporting | Is AI creating measurable, board-reportable financial value? |
A composite score alone can be gamed through selective excellence in easy dimensions while neglecting governance fundamentals. AMIVADIS applies minimum dimension score requirements to gate higher rating bands. A company must achieve D2 (Governance & Risk) ≥ 25 and D3 (Data & Infrastructure) ≥ 20 to qualify for Silver, regardless of composite score. Gold and Platinum apply progressively stricter minimums across D1–D4. A company failing a floor rule is rated one band below its composite score. This ensures that a Gold or Platinum AMIVADIS rating always reflects genuine governance depth, not a selective performance across favourable dimensions.
AMIVADIS scores are calculated in three stages: per-question scoring on a 0–4 Likert scale, P-A-R evidence weighting applied per question, and weighted composition across dimensions to produce the composite AMI Score.
| Score | Label | What it means |
|---|---|---|
| 0 | Not Started | No activity; topic not yet addressed |
| 1 | Initial | Ad-hoc activity; no documentation or ownership |
| 2 | Developing | Partially implemented; inconsistent application |
| 3 | Defined | Fully documented and implemented; consistently applied |
| 4 | Optimized | Verified, audited, and reported; continuously improved |
Standard maturity assessments treat all questions equally, which means a company with comprehensive policies but no execution scores the same as one with verified, measurable results. AMIVADIS corrects this by categorising each question by the type of evidence it requires — Policy, Action, or Results — and applying a differential multiplier. Words are easy; proof is not.
The P-A-R structure means an organisation that scores 4/4/4 across all question types will always outperform one that scores 4/4/0. A mature AI governance program must be evidenced, not merely declared.
Each dimension's score (0–100) is computed as the P-A-R-weighted sum of its question scores divided by the P-A-R-weighted maximum, multiplied by 100. The composite AMI Score is the sum of each dimension score multiplied by its weight.
AMIVADIS is directly anchored in the EU AI Act (Regulation 2024/1689) and cross-validated against ISO/IEC 42001:2023 and NIST AI RMF 1.0. This section provides the traceability map for each dimension and positions AMIVADIS relative to other established standards.
| Dimension | EU AI Act | ISO/IEC 42001 | NIST AI RMF |
|---|---|---|---|
| D1 AI Strategy | Art. 5 prohibited uses Art. 6–7 risk classification | Clause 4 context Clause 6 planning | GOVERN 1 MAP 1 |
| D2 Governance & Risk | Art. 9 risk management Art. 13 transparency Art. 14 oversight Art. 17 QMS | Clause 6 risk Clause 8 operation Clause 9 evaluation | GOVERN 2–6 MAP 2–5 |
| D3 Data & Infrastructure | Art. 10 data governance | Clause 8.4 data | MAP 3 MEASURE 2 |
| D4 Execution & Oversight | Art. 14 human oversight Art. 15 accuracy & robustness Art. 26 deployer obligations | Clause 8.5 lifecycle Clause 8.6 testing | MANAGE 1–4 MEASURE 3–4 |
| D5 Org Maturity & Literacy | Art. 4 AI literacy ★ in force Feb 2025 | Clause 7.2 competence Clause 7.3 awareness | GOVERN 5–6 |
| D6 Deployment Breadth | Operational scope — no direct article | Clause 8.3 AI use case | MAP 5 MANAGE 2 |
| D7 Culture & Leadership | Art. 4 organisational culture | Clause 5 leadership | GOVERN 1 |
| D8 Foresight & Defensibility | Art. 72 post-market monitoring Art. 27 FRIA for deployers | Clause 9.1 monitoring Clause 10 improvement | MEASURE 4 MANAGE 4 |
| D9 Financial Impact | Financial governance — no direct article | Clause 7.1 resources | GOVERN 4 |
| AMIVADIS | ISO/IEC 42001:2023 | NIST AI RMF 1.0 | |
|---|---|---|---|
| Primary output | 0–100 score + rated band | Certification (pass / fail) | Framework compliance profile |
| Target audience | Board, PE investors, procurement | Technical / compliance teams | Risk / technical teams |
| Time to complete | ~20 minutes | 3–12 months (certification process) | Months (full implementation) |
| Peer benchmarking | Planned — cohort database | Not designed for comparison | Not designed for comparison |
| EU AI Act direct mapping | Yes — article-level | Aligned (not article-mapped) | Referenced (not article-mapped) |
| Can certifications be used as evidence? | Yes — accepted as R-tier evidence | — (is the certification) | — (is the framework) |
| Relationship to AMIVADIS | — | ISO 42001 certification scores as a 4 on relevant questions | NIST implementation evidence scores as A/R evidence |
AMIVADIS is not a replacement for ISO 42001 certification or NIST AI RMF implementation. It is the measurement and rating layer on top of them — translating implementation depth into a single comparable score in the language boards and investors understand. A company that holds ISO 42001 certification will score very highly on the dimensions that certification covers.
AMIVADIS is designed to grow in trust alongside the AI governance rating market. Three distinct assurance tiers provide a clear progression from rapid self-assessment to independently audited certification. Each tier carries a distinct badge, ensuring that recipients of a score can immediately identify its assurance level.
Acceptable: Board-approved documents (max 3 years old) · KPI trend data (minimum 2 reporting periods) · ISO 42001 / SOC 2 certificates (max 18 months old, AI scope confirmed) · LMS completion records · Management accounts with AI investment line · Board pack excerpts with AI reporting · Penetration test reports (AI systems in scope).
Not acceptable: Undated documents · Draft policies without board approval · Expired certifications · Point-in-time snapshots without trend · Self-declared completion without system record · Projections presented as actuals.
The AMIVADIS score is designed to be used in four primary contexts. In each case, the score functions as a structured starting point for a governance conversation — not an endpoint.
Reading the score in board context: A score below 40 (Foundation or Bronze) indicates that AI governance obligations — including those now legally binding under EU AI Act Art. 4 — are not being met systematically. A score between 40–59 (Silver) indicates the governance infrastructure is in place but is not yet consistently executed or measured. Scores of 60 and above (Gold) indicate a program that is board-governed, executed, and delivering measurable value. Platinum (80+) indicates a program suitable for external benchmarking and investor-level disclosure.