CMMI AIM (Artificial Intelligence Maturity) is the CMMI Institute's framework for governing the use of artificial intelligence in organizations. Published in April 2026, the model extends CMMI to cover the specific risks, practices, and domains of AI operations. It is not a standalone model: it is a benchmark extension that works in conjunction with existing CMMI assessments, without invalidating the organization's maturity history.
Consider a scenario that's already routine in technology companies: an AI system responds to customers in production, and in the first significant incident, the organization discovers it can't say what data fed the model, who is responsible for the decisions it made, or how to verify that the controls are working. Without a maturity model, these responses are based on perception, not evidence. CMMI AIM was built to transform these responses into verifiable processes, based on CMMI, a model consolidated over more than two decades of use in technology organizations worldwide. Those already operating with CMMI don't start from scratch: AIM adds a specific AI assessment layer to the processes the organization already masters. See the complete guide on CMMI.
This article describes what CMMI AIM is, its 8 domains, the 3 AI use cases, the available training and certifications, and how to begin implementation.
CMMI AIM is a maturity model developed by the CMMI Institute to guide organizations in the responsible, secure, and efficient use of artificial intelligence. Published in April 2026 and officially launched at the Capability Creates Conference in June 2026, it was developed by the CMMI AI Working Group, a group of over 25 industry experts with IBM Consulting as a founding sponsor. The content underwent extensive review by experts and the community, with participation from approximately 100 companies.
The model is compatible with the main international AI governance standards: ISO 42001 (Artificial Intelligence Management System), ISO 23894 (AI risk management), ISO 31000 (risk management), and ISO 23053 (framework for machine learning-based systems). This compatibility facilitates the integration of CMMI AIM into organizations that are already in the process of certification in these standards or that wish to build AI governance on an already established foundation.
The focus of CMMI AIM is not limited to companies that develop AI internally. The model applies both to organizations that build AI solutions and to those that acquire, integrate, or use AI in their systems and services. This ranges from software companies that build and train their own models to organizations in other sectors that contract AI solutions as a service.
According to the CMMI Institute, CMMI AIM offers a reliable, structured, and globally recognized approach to building and assessing AI capability and maturity. By incorporating AI considerations into CMMI practice areas and domains, the model enables risk management, performance benefits, compliance with regulatory and ethical obligations, and strengthening customer and stakeholder trust.
CMMI AIM does not replace CMMI, currently in version V3.0. This is the most important distinction for those already working with the model. AIM functions as an additional benchmark view, applied to the existing CMMI framework to cover specific practices related to the use of artificial intelligence.
All 31 CMMI practice areas now include AI-related content, and approximately 50% of the practices have received AI-specific context additions. CMMI assessments already conducted by an organization are not affected: the maturity history remains valid, and the CMMI AIM assessment is complementary, not a replacement.
The practical difference between the two models can be understood as follows: CMMI assesses the maturity of software development or service management processes, while CMMI AIM specifically assesses how the organization governs its AI systems, from data collection to production use, including security, privacy, and data and supplier management.
| Aspect | CMMI V3.0 | CMMI AIM |
|---|---|---|
| Main focus | Software process maturity | Artificial intelligence governance |
| Scope of coverage | Development, engineering, management | Data, security, agents, AI vendors |
| Relationship between the models | Base model | Complementary extension |
| Existing assessments | Reference for new evaluations | It does not affect previous CMMI assessments. |
| Training and certifications | Practitioner, Lead Appraiser | BAIM and AAIM courses; AI practitioner and lead appraiser certifications. |
For organizations with a current CMMI assessment, including CMMI AIM in the scope of a future assessment is the most straightforward approach. For organizations starting with CMMI, it's worth evaluating whether their business objectives significantly involve AI, which would determine the need to include AIM from the beginning of the program.
CMMI AIM introduces its own assessment perspective, the AIM View, which integrates 8 domains. Together, they ensure that AI initiatives address not only technical development but also critical enablers such as workforce readiness, data governance, security, regulatory compliance, and ethics.
It covers building a robust data management and governance infrastructure, from lineage to data quality, to support reliable AI results. In practice, when a model starts to make mistakes in production, root cause analysis begins with the data that fed it: without lineage traceability, this analysis has nowhere to begin.
The primary domain of the model focuses on ensuring the design, development, and use of high-quality AI solutions aligned with customer needs and expectations. This includes both building AI solutions for clients and leveraging AI-augmented solutions. The logic is the same that CMMI has applied to software for decades: quality is defined against customer needs, not against the technical sophistication of the solution.
It covers the talent management lifecycle, from development to retention, preparing the workforce to adopt AI in alignment with the organization's business objectives, in the context of AI democratization. From a governance perspective, it addresses the factor that most limits the adoption of AI at scale: people prepared to use the technology to achieve the organization's goals.
Focused on ensuring the safety of solutions and society in AI interventions, mitigating the severity and likelihood of technology-related harm. It is especially relevant for organizations that use AI in critical processes, such as healthcare, public safety, or infrastructure: in these contexts, the cost of a failure is not measured in rework, and that is what differentiates Safety from conventional quality testing.
Focused on building and enabling the secure use of AI platforms and tools, strengthening stakeholder trust. Organizations certified in information security find in this domain a natural extension to their AI requirements. The difference from conventional threats lies in the failure mode: manipulated training data does not generate system errors, but rather incorrect decisions that appear normal.
The primary domain focuses on delivering superior service quality in AI-as-a-Service (AIaaS) business models and integrating AI into existing and new service delivery ecosystems. The perspective evaluated is that of the end customer: the average accuracy of the model matters less than delivering the right answer at the moment the customer needs it.
Focused on building an effective and efficient ecosystem of AI partnerships, capable of delivering consistent value to end users. It is one of the most relevant domains for organizations that do not develop AI internally but rely on external solutions to operate critical processes. A common scenario illustrates the risk: the vendor updates the model without warning, the system's behavior changes accordingly, and the organization needs to detect this change before the customer.
Focused on enabling effective virtual collaboration through robust infrastructure, to deliver cohesive results in the development and use of AI solutions. This domain recognizes a reality of working with AI: much of it takes place in distributed teams, and without collaborative infrastructure, governance cannot be sustained in practice.
The distribution across 8 domains reflects the breadth of AI governance scope: it's not just about developing models, but about governing the entire chain that supports the use of AI in an organization, from the origin of the data to the operation of systems in production.
The CMMI AIM categorizes the use of AI into three scenarios, which differ in the degree of autonomy of the systems in relation to human decisions. The scenarios help the organization determine how the model applies to each AI system in operation.
The AI system provides recommendations, analyses, or automations, but the human retains control and responsibility for the decisions. A typical example: code analysis tools with AI suggestions that the developer accepts or rejects. Organizations beginning to adopt AI typically operate in this scenario and consolidate basic controls before moving on to the next ones.
The AI system performs tasks autonomously, with human supervision. Example: risk analysis systems that generate alerts and take automatic preventive actions within parameters defined by the organization.
The system operates independently, making decisions and executing actions without continuous human intervention. It requires the most rigorous governance controls, traceability, and risk analysis. Example: autonomous technical support agents or incident response systems that act without prior approval.
Organizations in the early stages of AI adoption typically operate in the first scenario and evolve as process maturity increases. Mapping the current scenario of each AI system is part of the initial CMMI AIM implementation diagnosis.
The CMMI Institute periodically publishes performance data from the organizations it evaluates. The most recent report consolidates results from over 24,000 evaluations conducted between 2020 and 2025, covering organizations from multiple countries and sectors.
The numbers documented in the report show concrete results for organizations that rigorously implement the model:
These results contextualize CMMI AIM: the CMMI maturity model has a documented history of performance improvement. AIM extends this logic to the AI domain, applying the same framework of verifiable practices and assessments with objective criteria that have characterized CMMI since its inception. Organizations that already have a CMMI assessment start from a proven process base to incorporate AI practices.
Source: CMMI Technical Report: Performance Results 2020-2025, CMMI Institute, May 2026.
CMMI AIM includes structured training and certification tracks, aligned with existing CMMI tracks. The two main courses are BAIM and AAIM, which lead to Practitioner and Lead Appraiser certifications in the AI context.
This is a hybrid course that combines prior e-learning with instructor-led training. The content covers AI concepts, data quality, responsible AI and ethics, regulations, and the management of AI initiatives.
Advanced course aimed at CMMI certified Lead Appraisers. Covers the scope and planning of AI assessments, performance analysis, and the sustainability of AI-driven improvement.
Those who already hold CMMI certifications are not immediately impacted: the extension to CMMI AIM is an option, not a requirement. For organizations planning a formal assessment, it's worth knowing that evaluating AI maturity introduces specific planning and scope considerations, which are addressed precisely in these specialized training programs.
The implementation of CMMI AIM follows the same logic as CMMI: it begins with diagnosis, moves through mapping the current state, and evolves to formal evaluation. It is not a project with an end date: it is a continuous review of processes in search of optimization, applied to the AI domain. Decisions along the way are based on diagnostic data, not intuition.
The first step is to map how the organization uses AI today. This includes identifying which AI systems are in operation, who operates them, what data they use, and the degree of autonomy of each system. The diagnosis generates a view of the current state and points out gaps in relation to the practices of the 8 domains of CMMI AIM.
Based on the diagnosis, the organization identifies which of three scenarios each AI system falls into: human-augmented, autonomous augmentation, or fully autonomous. This defines the level of controls required and prioritizes the practice areas to develop first. A low-risk decision support system requires a different set of controls than an autonomous agent operating in production.
The organization implements the practices of the prioritized domains, integrating them with existing CMMI processes where applicable. The work is iterative: it starts with the most critical gaps and progresses through each domain. The CMMI maturity levels already achieved serve as a basis for accelerating the development of AI practices, especially in the Development and Security domains.
The formal assessment completes the cycle. It is conducted by a Lead Appraiser accredited by the CMMI Institute and results in a maturity report that documents performance across the 8 domains, serving as a benchmark for subsequent improvement cycles.
Promove works in the implementation phase: adherence diagnosis, structuring of practices in the 8 domains, and preparing the organization to arrive at the formal assessment in the right conditions. This work is led by Mariano Montoni, the only Brazilian certified as a High Maturity Lead Appraiser by the CMMI Institute. He has conducted more than 150 CMMI assessments, which means he knows exactly what an organization needs to demonstrate when the assessor arrives.
The difference between adopting AI and governing AI becomes apparent at the first incident. If your organization wants to be prepared, with evidence-based responses, Promove leads the entire implementation of processes adhering to CMMI AIM. Contact us to speak with our specialist!
On March 11, 2026, Vasilios Syrakis received the email that many senior engineers have received: eight years at Atlassian, infrastructure...
Be the first to comment!