CMMI AIM Through the Pattern AI Lens
From AI process maturity to pattern-aware organisational capability
Executive summary
CMMI Artificial Intelligence Maturity (CMMI AIM) is a new enterprise maturity framework from the CMMI Institute, an ISACA enterprise. Published in April 2026 and formally launched in July 2026, it is intended to help organisations build, assess, benchmark and continuously improve their ability to develop, acquire, integrate and use AI.
CMMI AIM is particularly strong at converting fragmented AI initiatives into repeatable, measurable and independently appraisable organisational practices. It extends AI-related guidance across all 31 CMMI Practice Areas and provides an AI-focused view covering eight domains:
Data, Development, People, Safety, Security, Services, Suppliers and Virtual.
Viewed through the Pattern AI Lens—SEE → UNDERSTAND → LEVER → REIMAGINE → ACT → LEARN—CMMI AIM provides a powerful institutional foundation. However, its centre of gravity remains process maturity: whether the organisation performs AI-related practices consistently and effectively.
Pattern AI asks an additional question:
Is the organisation becoming better at seeing, understanding, using and reshaping the patterns through which AI creates decisions, actions, risks and value?
The strongest approach is therefore not to replace CMMI AIM, but to extend it:
CMMI AIM establishes organisational discipline. Pattern AI establishes pattern intelligence.
1. What is CMMI AIM?
CMMI AIM is an AI-specific extension of the established CMMI performance-improvement system. It integrates governance, repeatable processes, measurement, training and appraisal into a structured path for improving enterprise AI capability.
According to CMMI Institute, it is designed to move organisations from:
Chaos and risk → Structure and cohesion → Validation and trust → Value and growth
The model:
includes AI-related content across all 31 CMMI Practice Areas;
adds AI-specific context to nearly 50% of CMMI practices;
covers organisations that build AI as well as those that acquire, integrate or use it;
supports formal appraisal and organisational benchmarking;
provides crosswalks to ISO 42001, ISO 23053, ISO 23894 and ISO 31000;
distinguishes human-augmented, autonomously augmented and fully autonomous AI usage scenarios.
These characteristics are documented in the CMMI AIM Executive Summary and the official CMMI AIM overview.
An important clarification: CMMI AIM’s eight domains are not eight maturity levels. They are interconnected organisational capability areas examined through an AI context. AIM introduces a new benchmark view while using established CMMI appraisal methods adapted to AI.
2. The eight CMMI AIM domains
| Domain | Official organisational focus | Pattern AI interpretation |
|---|---|---|
| Data | Data infrastructure, governance, quality and lineage | What patterns are present in the data, and which patterns are missing, distorted or overrepresented? |
| Development | Designing and using quality AI solutions aligned with customer needs | How are patterns converted into models, outputs, decisions and products? |
| People | Workforce capability, adoption, development and retention | How do human behavioural, skill and authority patterns change around AI? |
| Safety | Reducing the likelihood and severity of AI-related harm | Which recurring conditions create harm, and how can they be detected earlier? |
| Security | Secure use of AI platforms, tools and systems | What attack, misuse, leakage and manipulation patterns must be anticipated? |
| Services | Quality delivery through AI-enabled services and AI-as-a-Service | How does AI change service patterns, customer experience and accountability? |
| Suppliers | Managing the AI partner and supplier ecosystem | Where do dependency, concentration and inherited-risk patterns emerge? |
| Virtual | Infrastructure and practices for effective virtual collaboration | How do humans and AI systems coordinate across distributed environments? |
The official domain descriptions are available in the CMMI Institute launch announcement.
3. CMMI AIM through the Pattern AI Lens
Lens 1 — SEE
Make the organisation’s real AI patterns visible
CMMI AIM begins with organisational visibility: understanding how AI is being developed, acquired, used, governed and measured across functions.
This is one of its greatest strengths. Many organisations do not have one AI system; they have a scattered collection of:
licensed AI applications;
employee-created workflows;
embedded vendor models;
automated decisions;
experimental copilots;
AI-generated content;
unsanctioned or “shadow AI” usage.
CMMI AIM can help reveal whether consistent processes, responsibilities and controls exist across these activities.
The Pattern AI Lens goes further by asking organisations to see four different pattern layers:
Data patterns — what the AI learns from.
Model patterns — what the system recognises or generates.
Usage patterns — how people actually use or bypass the system.
Impact patterns — who repeatedly benefits, fails, waits, pays or carries risk.
A conventional inventory may record an AI system’s owner, vendor and purpose. A pattern-aware inventory should also record:
recurring inputs and outputs;
affected stakeholder groups;
frequency and context of use;
level of autonomy;
common failure modes;
human override patterns;
dependencies on external models and data;
intended and unintended consequences.
Pattern AI judgment
CMMI AIM creates visibility into organisational practices. Pattern AI should ensure that visibility extends to the behaviour and consequences of the AI itself.
Lens 2 — UNDERSTAND
Move from documenting AI to understanding what produces its behaviour
CMMI AIM emphasises defined objectives, governance, infrastructure, data quality, skilled personnel and measurable success criteria. It also recognises different autonomy scenarios—from human-assisted use to fully autonomous operation.
This is important because the risk created by an AI system depends not only on the technology, but also on:
its purpose;
operating environment;
data;
users;
affected people;
decision authority;
degree of autonomy;
possible consequences.
The Pattern AI Lens asks organisations to understand the causal structure behind AI outcomes:
Which data, instructions, incentives, interfaces, human assumptions and environmental conditions repeatedly produce this result?
For example, if an AI recruitment system disadvantages a group, the organisation must look beyond whether the prescribed review process was followed. It must understand the underlying pattern:
historical representation in the training data;
proxy variables;
selection criteria;
feedback effects;
recruiter reliance;
override behaviour;
the way success was defined.
This aligns with the broader risk-management principle that AI risks should be mapped, measured and managed in context. The NIST AI Risk Management Framework similarly operationalises AI risk through Govern, Map, Measure and Manage.
Pattern AI judgment
Process conformity is necessary, but it does not automatically produce causal understanding. A mature organisation must understand why an AI-enabled pattern exists—not merely confirm that a documented process was followed.
Lens 3 — LEVER
Turn mature AI practices into measurable organisational value
CMMI AIM explicitly connects AI maturity with business performance, cost reduction, innovation, operational consistency and return on AI investment. This performance orientation distinguishes it from frameworks focused primarily on principles or risk requirements.
Through the Pattern AI Lens, leverage means identifying repeatable patterns that AI can:
accelerate;
augment;
personalise;
predict;
automate;
scale;
redesign.
However, scale should not be confused with value.
An organisation can efficiently scale an AI process that:
addresses a low-value problem;
creates excessive review work;
transfers costs to customers;
reduces trust;
produces outputs nobody uses;
automates a flawed inherited workflow.
Therefore, every AI initiative should connect capability maturity to an explicit value pattern:
Current pattern → AI intervention → changed pattern → measurable value → verified impact
Useful measures include:
cycle time reduced;
error or rework avoided;
human capacity released;
decision quality improved;
customer effort reduced;
risk exposure lowered;
revenue or reach increased;
stakeholder trust preserved.
Pattern AI judgment
CMMI AIM is strongest when maturity evidence is connected to outcome evidence. The objective should not be to become mature at using AI. It should be to become reliably capable of creating verified value with AI.
Lens 4 — REIMAGINE
Avoid using AI only to strengthen yesterday’s processes
Maturity models naturally emphasise control, repeatability and institutionalisation. These are essential for dependable performance—but they can also encourage organisations to formalise existing processes without questioning whether those processes should continue to exist.
Pattern AI asks:
If AI changes what can be recognised, generated, predicted or coordinated, what organisational pattern can now be redesigned?
For example:
Do not merely accelerate document approval; reconsider why every document follows the same approval path.
Do not merely automate customer responses; redesign when customers need to ask for assistance at all.
Do not merely generate reports faster; create a continuously updated decision environment.
Do not merely add AI to employee training; build work systems that learn from performance continuously.
This is where Pattern AI most clearly extends CMMI AIM.
CMMI AIM helps an organisation develop AI responsibly and consistently. Pattern AI challenges the organisation to question inherited assumptions before stabilising them as mature processes.
Pattern AI judgment
Maturity without reimagination can create highly governed incrementalism. Mature AI organisations must improve existing patterns and discover entirely new ones.
Lens 5 — ACT
Convert maturity findings into ownership, evidence and controlled action
CMMI AIM recommends a practical improvement cycle:
Learn about AIM.
establish AI-related business and performance objectives;
analyse current practices and gaps;
develop an action plan;
pilot and deploy improvements;
measure performance and assess capability.
For formal AIM appraisals, ISACA states that three areas are required:
Data;
Security;
either Development or Services.
Other domains may be added according to the organisation’s objectives and AI use. This allows the appraisal scope to reflect whether the organisation is primarily building, buying, integrating or operating AI. ISACA explains the appraisal scope and adoption sequence here.
Pattern AI strengthens execution through a clearer unit of action: the pattern intervention.
Each improvement should specify:
| Element | Required question |
|---|---|
| Current pattern | What happens repeatedly today? |
| Desired pattern | What should happen instead? |
| AI role | What will AI recognise, generate, recommend or execute? |
| Human role | Who frames, approves, intervenes and remains accountable? |
| Guardrails | What must the system never do or exceed? |
| Evidence | How will improvement and harm be measured? |
| Review trigger | What change will cause reassessment or suspension? |
Pattern AI judgment
A maturity gap should not end as a recommendation. It should become a testable intervention with ownership, evidence, thresholds and review conditions.
Lens 6 — LEARN
Treat AI maturity as a living capability, not a destination
CMMI AIM includes continuous improvement and measurement at its foundation. This is especially appropriate for AI because an AI system may change in practical effect even when its code does not.
Change may come from:
model or vendor updates;
data drift;
new user behaviour;
changing social conditions;
prompt or workflow modifications;
new attack techniques;
regulatory changes;
greater system autonomy;
expansion to new populations or decisions.
Pattern AI therefore treats learning as two connected loops.
Organisational learning loop
Practice → Measure → Appraise → Improve
This is the natural strength of CMMI AIM.
Pattern learning loop
Observe → Detect change → Interpret consequences → Adapt intervention → Verify again
This protects the organisation from assuming that a previously validated AI system remains effective or safe indefinitely.
Pattern AI judgment
An organisation is not mature because it achieved an appraisal result. It is mature when it can notice changing patterns early and respond before declining performance becomes harm.
4. Where CMMI AIM is particularly strong
1. It operationalises AI governance
Many AI frameworks state what responsible AI should achieve. CMMI AIM focuses on whether the required practices have become part of routine organisational performance.
2. It connects governance with business value
The framework places risk, performance, consistency, trust and return on investment within the same maturity structure.
3. It covers more than internally developed AI
It applies to organisations that build, acquire, integrate or use AI. This is important because many organisations depend more on third-party platforms and embedded models than on models developed internally.
4. It includes people and suppliers
AI capability is treated as an organisational and ecosystem capability—not merely a technical model-management problem.
5. It supports independent appraisal
Formal appraisal can provide stronger evidence than an unsupported organisational self-assessment.
6. It supports standards integration
Its crosswalks to ISO 42001, ISO 23053, ISO 23894 and ISO 31000 can help organisations reduce duplicated compliance and gap-analysis work. However, a crosswalk assists alignment; it should not be treated as automatic certification or proof of legal compliance.
5. Pattern AI concerns and limitations
1. Process maturity is not the same as AI outcome maturity
An organisation may have mature processes and still operate an inaccurate, discriminatory, insecure or low-value AI system.
Appraisal evidence must therefore include real performance and impact evidence, not only policies, procedures and records.
2. Maturity can become a compliance target
Teams may optimise their documentation for an appraisal rather than improve the actual behaviour of AI systems.
The remedy is to connect every practice to observable outcomes.
3. High maturity does not mean zero risk
AI risk is contextual and dynamic. A maturity rating indicates organisational capability; it cannot guarantee that every AI output is trustworthy or every use is appropriate.
4. Innovation may be underexplored
CMMI AIM strongly addresses disciplined adoption and operation. Organisations must also ask whether AI enables a fundamentally different product, service, decision or operating model.
5. The framework is new
CMMI AIM was published in April 2026 and publicly launched in July 2026. Its development included more than 25 working-group experts, review input from approximately 100 companies and pilots involving IBM Consulting, Infosys and GTSC. This is meaningful development evidence, but long-term, independent evidence across industries and countries is still necessarily limited because the model is new. CMMI Institute documents its development and pilot participants here.
6. Appraisal scope needs careful interpretation
Because only certain domains are mandatory in an AIM appraisal, organisations should disclose clearly:
which domains were assessed;
which AI systems and business units were included;
which were excluded;
the period covered;
the evidence examined;
the maturity or capability claim actually supported.
Otherwise, a limited appraisal could be communicated as if it covered the entire enterprise.
6. CMMI AIM + Pattern AI: an integrated approach
| CMMI AIM contribution | Pattern AI contribution | Combined result |
|---|---|---|
| Defines repeatable organisational practices | Identifies the patterns that matter | Relevant maturity |
| Establishes governance and accountability | Examines how authority moves between humans and AI | Accountable augmentation |
| Measures capability and performance | Connects interventions to pattern change | Evidence-based value |
| Manages safety and security practices | Detects evolving harm and misuse patterns | Adaptive protection |
| Supports appraisal and benchmarking | Challenges false confidence in ratings | Contextual assurance |
| Institutionalises continuous improvement | Enables continual pattern discovery | Learning organisation |
| Aligns AI with current objectives | Questions inherited objectives and processes | Responsible reimagination |
7. Recommended Pattern AI questions for an AIM assessment
SEE
Where is AI actually being used, including unsanctioned use?
What recurring data, decision, behaviour and impact patterns are visible?
Which people or groups remain invisible in present measurements?
UNDERSTAND
Why does each important pattern occur?
What assumptions and incentives sustain it?
How does AI autonomy change human authority and accountability?
LEVER
Which patterns can AI improve most meaningfully?
What measurable value should change?
Who receives the value, and who carries the risk or cost?
REIMAGINE
Are we automating an inherited process that should be redesigned?
What becomes possible because AI can learn, recognise or generate?
Which existing organisational boundary is no longer necessary?
ACT
Who owns the intervention and its consequences?
What evidence will justify deployment, continuation or expansion?
What thresholds will trigger escalation, rollback or shutdown?
LEARN
Which technical and human patterns are changing?
Are controls still effective after model, vendor or context changes?
What has the organisation learned that should modify its AI strategy?
Final judgment
CMMI AIM is a significant development in enterprise AI management because it addresses a central failure in organisational AI adoption:
AI initiatives are often technologically impressive but institutionally immature.
It offers the structure required to convert isolated experiments into governed, measurable and scalable organisational capability.
But Pattern AI reveals an equally important warning:
A mature process can repeatedly produce the wrong pattern.
Therefore, AI maturity must be judged at three levels:
Practice maturity — Are AI practices defined and institutionalised?
Performance maturity — Do they produce measurable, reliable outcomes?
Pattern maturity — Can the organisation see, understand, reshape and continuously learn from the patterns created by AI?
The combined proposition is:
CMMI AIM helps organisations govern how AI is adopted. Pattern AI helps them judge what patterns AI is learning, reinforcing and creating.
Together, they provide a stronger pathway:
SEE the AI system → UNDERSTAND its patterns → LEVER its capability → REIMAGINE the organisation → ACT with evidence → LEARN continuously.
AIYING — Accomplishing with AI
Pattern AI Multi-Lens: SEE → UNDERSTAND → LEVER → REIMAGINE → ACT → LEARN
