RESEARCH · VERSION 1.0 · OCTOBER 2026
HCAIG-1 Maturity Model
Governance maturity for intelligent estates: a five-level path for organisations to assess, benchmark and improve how they govern AI-enabled AV systems and intelligent buildings, from meeting rooms and lecture theatres to entire smart building estates.
As systems become more automated, governance maturity decides whether an estate stays secure, compliant and trusted. The model supports alignment with ISO/IEC 42001, the NIST AI RMF and the EU AI Act, and uses the six HCAIG-1 clauses as its assessment dimensions.
Scope: AV systems and intelligent buildings, matching HCAIG-1 version 1.0.
The model at a glance
| Level | Name | In one line |
|---|---|---|
| 1 | Awareness | Risks are recognised, but governance is informal and reactive. |
| 2 | Structured | Policies exist, but each team governs in its own silo. |
| 3 | Integrated | Shared policies, tools and accountability across the estate. |
| 4 | Managed | Risks are monitored continuously and controls are tested. |
| 5 | Auditable | Governance is evidenced continuously and ready for audit. |
What we assess
Maturity is assessed against the six HCAIG-1 clauses. Most organisations sit at different levels on different dimensions, and that profile shows where to focus first.
01 Environment Mapping
Do you know every AI-enabled system and who it affects?
02 Behaviour Assessment
Do you know what each system infers about people?
03 Human-in-the-Middle Controls
Can a named person understand, override and stop it?
04 Risk & Impact Alignment
Are impacts assessed before go-live and after change?
05 Continuous Governance & Assurance
Is there an owner, a record and regular review?
06 Regulatory Compliance & Conformity
Can you show evidence to clients and regulators?
The five levels
Each level builds on the one before. The HCAIG-1 focus shows which clauses to strengthen to reach the next level. Examples are illustrative.
Level 1 · Awareness
What it looks like: AI, cybersecurity and operational risks are recognised, but governance is informal, undocumented and reactive. There is no consistent inventory, incident logging or risk assessment.
The risk: AI features may be running unnoticed, and problems are fixed without anyone learning from them.
Next step: Build an inventory of AI-enabled systems, assign an accountable owner and start simple incident logging.
Example: an integrator fixes outages as they happen, with no record and no root-cause analysis.
HCAIG-1 focus: Environment Mapping · Continuous Governance & Assurance
Level 2 · Structured
What it looks like: Early policies exist. AV, IT, workplace and facilities teams each log incidents and control changes, but in silos with separate tools and workflows.
The risk: No one sees the whole estate, so AI-related risks fall between teams.
Next step: Standardise incident logging, change control and AI-risk reporting across departments.
Example: the AV team documents incidents while IT and facilities track theirs in separate systems.
HCAIG-1 focus: Behaviour Assessment · Continuous Governance & Assurance
Level 3 · Integrated
What it looks like: Shared policies, tools and accountability span AV, IT, workplace and smart building systems. Room systems, identity platforms and building gateways feed one governance structure.
The risk: Governance exists, but may not keep pace with automated or AI-driven change.
Next step: Form a cross-departmental governance group for AV, IT, workplace and facilities, assess impacts before new AI features go live, and start monitoring and testing controls.
Example: a multinational runs unified risk dashboards fed by AV, meeting-room, identity and building sensor data.
HCAIG-1 focus: Risk & Impact Alignment · Human-in-the-Middle Controls
Level 4 · Managed
What it looks like: Governance is actively managed. Risks are monitored continuously, human overrides are tested regularly, and escalation paths and audit trails cover every system, including any automated or AI-driven actions.
The risk: Monitoring produces more alerts than people can act on, and controls drift without anyone noticing.
Next step: Make evidence audit-ready: estate-wide audit trails, documented management reviews and a clear record of every override and decision.
Example: a university tests the human override in every AI-enabled lecture theatre each term, and AI-driven fixes in meeting rooms are logged and approved through a governance workflow.
HCAIG-1 focus: Human-in-the-Middle Controls · Continuous Governance & Assurance
Level 5 · Auditable
What it looks like: Governance is evidenced continuously. Systems keep complete audit logs, anomalies surface automatically, and compliance can be shown to clients, auditors and regulators on request. Human oversight and management review remain in place.
The risk: Certification becomes the goal, rather than good outcomes for the people in the space.
Next step: Automate compliance evidence, add predictive risk analytics and stay ready for ISO/IEC 42001 certification.
Example: an organisation certified to ISO/IEC 42001 with its smart building estate in scope.
HCAIG-1 focus: Regulatory Compliance & Conformity
Two-minute self-check
Answer yes or no for one space you manage, such as a meeting room, lecture theatre or floor.
- Do you have an up-to-date list of every AI-enabled system in the space, including features switched on by default? (Environment Mapping)
- Do you know what each system infers about people, such as presence, identity, attention or emotion? (Behaviour Assessment)
- Is there a named person who can override or switch off each system, and has that override been tested? (Human-in-the-Middle Controls)
- Do you assess the impact on people before new AI features go live? (Risk & Impact Alignment)
- Does every system have an owner, with decisions recorded and reviewed when things change? (Continuous Governance & Assurance)
- Could you show a client or regulator evidence of how you meet the EU AI Act and align with ISO/IEC 42001 today? (Regulatory Compliance & Conformity)
Reading your answers: each “no” points to the clause to work on first. Fewer than three “yes” answers usually means Level 1 or 2. Six confident “yes” answers, backed by evidence, suggests Level 4 or above.
A quick indicator only, not a formal assessment.
Benchmark your estate
Want a proper answer? Find out where your organisation sits on each dimension, and what to do next. Founding pilot organisations receive a free HCAIG-1 assessment of one meeting room, lecture theatre or floor in early 2027.
How to cite: Onodu, B. (2026). HCAIG-1 Maturity Model, version 1.0. The AV Governance Report.
Change log: 1.0 (October 2026), first public version, aligned to HCAIG-1.
The maturity model is an independent benchmarking tool. It is not a certification and does not confirm legal compliance.
© 2026 Benedict Onodu · The AV Governance Report · Contact
