Editor’s note: AI usage has become widespread across the enterprise landscape but significant gaps remain when it comes to governance, risk management and securing return on investment.The new CMMI Artificial Intelligence Maturity (CMMI AIM™) model provides a structured path to integrate AI responsibly and effectively. Learn more about CMMI AIM with answers to frequently asked questions below.
ISACA Now: Why was CMMI Artificial Intelligence Maturity (CMMI AIM™) created?
Organizations that outperform competitors don’t just adopt artificial intelligence faster; they operationalize it better. While many organizations have defined AI principles, few have translated them into their daily operations. This lack of operational readiness creates significant exposures and introduces real risk. CMMI AIM closes this gap by integrating AI into the core of how each business operates, linking governance, processes and performance into a single, scalable systematic approach. CMMI AIM enables leadership to assess, benchmark, and improve AI maturity and performance outcomes using a proven, outcome-based model already trusted worldwide.
ISACA Now: How does CMMI AIM compare to other industry frameworks for AI?
Key aspects of CMMI AIM include:
- A maturity-based improvement path
- Organizational benchmarking
- A structured way to assess current AI adoption capability
- Guidance for institutionalizing AI practices across the enterprise
While other industry standards identify requirements and operational frameworks, CMMI AIM is the only industry standard that defines AI usage scenarios, which empower organizations to build and enhance their capabilities. These range from human-augmented AI, where people may use AI to assist with decision-making, to autonomous augmentation, where AI may perform activities with human oversight, and finally to fully autonomous AI, where the system performs activities independently. CMMI AIM applies to organizations building AI solutions and those acquiring, integrating or using AI within systems and services.
CMMI AIM includes the CMMI Crosswalk – AI Bundle that provides detailed mappings between CMMI Practice Areas and practices and ISO requirements from 42001, 23053, 23894 and 31000. This supports organizations’ complex environments where compliance to multiple standards is critical, providing a powerful aid to gap analysis activities and audits.
What are some of CMMI AIM’s key benefits?
A unified, enterprise-wide AI approach enables leadership teams to:
- Scale innovation with confidence and speed
- Reduce legal, financial and reputational exposure
- Convert undisciplined AI projects into a cohesive operational strategy aligned to business objectives
Additionally, CMMI AIM helps boards of directors solve:
Risk: Addresses security, data protection, ethics and regulatory exposure
Performance: Links AI use directly to measurable business outcomes
Consistency: Replaces fragmented AI activities with a unified model
Trust: Enables transparency and accountability in AI decision-making
What are the CMMI AIM domains and how do they fit together?
No matter how AI is adopted within an organization, the CMMI AIM view can help provide industry best practices through any type of implementation. For CMMI AIM Appraisals, there are three required domains: Data, Security and Development and/or Services. Organizations can also include any of the remaining CMMI domains that are deemed relevant to achieving their business objectives and aligned to how they are leveraging AI – for example, are they using or building a solution? The CMMI AIM view contains AI-related context-specific information across all eight domains and all 31 Practice Areas.
The CMMI AIM Model includes these eight domains:
- Data
- Development
- People
- Safety
- Security
- Services
- Suppliers
- Virtual
Can organizations that have newly adopted AI benefit from the CMMI AIM?
Yes, the CMMI AIM content is designed to cover a variety of industry domains and is applicable to a variety of organizations regardless of their current AI capability. The best practice guidance can help organizations new to AI adoption understand where to go and how to increase their maturity.
What is the best way for organizations to get started with CMMI AIM?
To get started with CMMI AIM, it is recommended that organizations review the CMMI Adoption Guidance, and follow the accompanying steps:
- Learn – Learn about CMMI AIM. Take CMMI courses, including Building Organizational Capability and Building AI Maturity.
- Establish Objectives – Develop and communicate business and performance improvement objectives that incorporate the organization’s AI specific goals.
- Analyze – Analyze current organizational processes and performance as compared to CMMI AIM. Understand the process and performance gaps that exist.
- Develop Action Plan – Define an action plan that addresses resolving the process and performance gaps.
- Deploy Improvements – Pilot and deploy new processes. Measure performance and make adjustments.
- Assess Capability – Assess processes and process assets, and adjust the improvement plan.
