AI Governance Readiness Check

A twelve-question self-assessment for executives, CIOs and architecture leads in public-sector and regulated organizations.

AI now reaches an organization in three ways: in tools staff use, in products you buy, and in models you build. Being ready to govern it means you can show what you use, who is accountable, how each use is controlled, and what happens when one fails. This check takes five minutes. Answer honestly. Your answers never leave your browser.

How to answer

Answer each question Yes, Partly or No.

  • Yes — true across the organization, written down, and in use.
  • Partly — true in some areas but not all, or written down but not yet in use.
  • No — not in place, or you do not know.

Who is accountable

Question 1 of 12 Has your board or executive named one senior person accountable for how your organization uses AI?

A person, not a committee or a vendor. Their role should say so in writing.

Question 2 of 12 Do you have an AI policy that says which uses are allowed, which need approval and which are banned, and have staff read it?

A policy that covers only chatbots, or that no one has read, is Partly at best.

Question 3 of 12 Does your board or executive receive a report on AI use and AI risk at least once a year?

The report should name the highest-risk uses, not just list projects.

What AI you use

Question 4 of 12 Do you keep a current list of every AI system and model in use, including AI inside products you buy?

Includes AI features in SaaS tools, vendor models, and tools staff use on their own.

Question 5 of 12 Before an AI use goes live, is it given a risk level using written criteria?

Criteria should cover who is affected, how much the system decides alone, and what happens if it is wrong.

Question 6 of 12 For each AI system, do you know what data it uses and whether you are allowed to use that data for it?

Includes personal information, and data a vendor uses to train or run its model.

How each use is controlled

Question 7 of 12 For each AI use, is it written down how much the system may decide on its own, and when a person must review?

The level of autonomy should match the risk level and be signed off.

Question 8 of 12 Before a higher-risk AI use goes live, is it tested by someone independent of the team that built or bought it?

A vendor’s own test results are not independent.

Question 9 of 12 Once an AI system is live, do you check it on a schedule for drift, errors and unfair outcomes?

“We would notice if it broke” is a No.

Suppliers, staff and incidents

Question 10 of 12 Do your contracts require vendors to tell you before they change a model, and let you leave without losing your data or records?

Silent model updates and one-way data exports are the common gaps.

Question 11 of 12 Have the staff who build, buy, approve or use AI been trained on their part in governing it?

Training on how to use a tool is not training on how to govern it.

Question 12 of 12 Is there a tested plan to switch off or roll back an AI system, and to tell the people affected, if it causes harm?

A plan that has never been rehearsed is Partly.