Critical gates: when a high score is not enough

Picture two companies with the same AI maturity score, a dignified 3.2 out of 5. The first is solid everywhere and brilliant nowhere. The second excels at strategy and delivery, but has no inventory of its own systems and processes personal data inside models without anyone ever having assessed the legal basis. A model made only of averages would declare them twins, and would recommend the same road to both, while the second is walking briskly towards a wall the first does not have. Critical gates exist to prevent the model from telling this statistical lie.

The logic of the non-compensable

The principle comes from worlds that have lived with risk longer than AI. In credit ratings, one breached covenant outweighs ten healthy indicators. In security certifications, a major non-conformity blocks the outcome regardless of the elegance of the rest. In aviation, the pre-flight checklist does not compute averages: one failed item keeps the aircraft on the ground even if the other forty are perfect. Across all these domains the lesson is identical, certain conditions change the nature of the risk by their absence rather than lowering a score, and the right mathematics for treating them is the constraint, never the weighting.

Our AI Rating embeds this logic: alongside the 0-5 scores on the four dimensions lives a restricted set of gates, conditions verified in binary fashion, and a high merit class requires both the score and the gates satisfied. Class A, for instance, demands a score above 4.0, no area below 3.5 and all gates in order: the third condition is not redundant with the first two, it is what makes them credible.

Which conditions deserve a gate

Not every gap deserves the treatment, otherwise the model degenerates into a list of vetoes and loses its ability to discriminate. The criteria we use to promote a condition to gate status are three, and they must hold together. The gap must be able to revoke the licence to operate, on regulatory grounds (unlawful personal data processing, the absence of the risk classification the AI Act presupposes) or on substantive grounds (no human oversight on decisions affecting people). It must be non-delegable, meaning unsolvable by buying something from a supplier, because whatever can be bought can also be weighted. And it must be foundational, in the sense that its absence makes the other scores unreliable: the systems register is the perfect example, because without a census every other evaluation describes an imaginary perimeter.

Applied with this discipline, gates stay few, typically between five and eight, each with a verifiable definition: not "good data management" but conditions ascertainable through evidence, ones a second evaluator would reproduce.

What they change in behaviour

The most interesting effect of gates appears after the assessment, in allocation choices. Without gates, the roadmap tends to chase the points where improvement is easiest or most visible, because every decimal is worth the same. With gates, the sequence inverts on its own: the blocking conditions get closed first, and they are usually the least glamorous ones (the register, the legal bases, human oversight), and only afterwards does the rest get optimised. In the engagements we run this inversion is often the single most valuable contribution of the whole measurement, because it moves budget from what glitters to what holds.

There is also an effect on the conversation with the top that deserves naming. Telling a board "we are at 3.2" invites a benchmark comparison; telling it "we are at 3.2 with two gates open, and here they are" invites a resolution. The gate turns maturity from a photograph into a list of decisions, which is the form in which a board can actually use it.

Building your own

The logic is replicable in-house, even without an external model, and the exercise is worth the half day it costs: gather whoever owns risk, data and AI, and ask which conditions, if absent, should stop a project regardless of what it promises. The list that emerges, filtered through the three criteria above, is your first version of the gates, and the honesty test comes right after, checking it against the projects currently running. If some active initiative would not pass your own gates, you have just discovered the most useful thing of the quarter.

We do it with the rigour of a model calibrated on dozens of assessments, inside the AI Rating, where scores and gates come out together and the roadmap inherits their priorities: calendly.com/fabiolalli/zerofive, or hello@zerofive.ai. The question to leave you with is the personal version of the opening one: in your organisation, today, does a condition exist that would stop everything, and is anyone watching it?