Stage 1 — Ad-hoc
No central inventory of AI usage. Individual teams adopt tools independently; security finds out after incidents. DLP, audit, and cost controls do not apply to AI traffic. The organization cannot answer "who is using what, with what data."
Stage 2 — Discovered
A complete inventory exists — every AI tool, model, agent, and user is known. Shadow AI is mapped; consumer-grade usage is visible; spend is roughly attributable. No enforcement yet, but the data plane for governance is in place. This is where most enterprises that have invested in AI governance currently sit.
Stage 3 — Controlled
Policies are enforced inline. DLP redacts or blocks sensitive data before it leaves the network. Per-agent identities and rate limits prevent runaway use. Audit trails are complete and queryable. The organization can answer regulators with evidence, not promises.
Stage 4 — Optimized
Cost optimization is active: prompt-cache reuse, request compression, model routing by task complexity. Per-team and per-agent budgets prevent surprise bills. The organization no longer pays for inefficient AI usage; it actively measures and improves cost-per-outcome.
Stage 5 — Attested
Continuous compliance: EU AI Act risk classifications are wired in, SOC 2 audit pulls evidence automatically, model cards and provider attestations are tracked, and incident response playbooks for AI-specific events (prompt injection, data exfiltration via tool calls, model poisoning) are exercised. The organization can prove its AI posture, not just describe it.
Frequently Asked Questions
Can an organization skip stages?
Not effectively. Each stage produces the data plane that the next stage acts on. You cannot enforce controls on agents you have not discovered, and you cannot attest to controls you do not enforce.
How long does it take to move from stage 1 to stage 3?
With a transparent proxy and egress-capture-based discovery, organizations typically reach stage 3 within four to eight weeks. The bottleneck is rarely tooling — it is reaching organizational agreement on the policy set.