Strategy
1.Your organisation has a documented AI strategy that is reviewed at least annually.
2.Senior leadership can articulate specific AI use cases and the risks associated with each.
3.AI investments are tied to measurable business outcomes, not just adoption metrics.
Data
1.Data used to train or prompt AI systems is inventoried, with lineage documented.
2.Data quality checks run automatically before data is used in AI inference or training.
3.Personal or sensitive data used in AI systems is subject to documented access controls and retention limits.
4.Your organisation has a process for handling data correction requests when AI decisions are challenged.
Model Lifecycle
1.AI models in production are versioned and changes are tracked in a model registry.
2.There is a documented process for retiring or replacing an AI model when it degrades.
3.Model performance is monitored in production with defined drift detection thresholds.
Governance
1.A named individual or team is accountable for AI governance in your organisation.
2.AI systems are classified by risk tier before deployment, and higher-risk systems face additional scrutiny.
3.Your organisation has an AI incident response plan that has been tested.
4.External AI vendors and partners are assessed for governance maturity before procurement.
People
1.Employees who work with AI systems have received training on the system's limits and failure modes.
2.There is a clear mechanism for employees to report concerns about AI system behaviour.
3.Hiring and performance frameworks include AI governance competencies for relevant roles.
Security
1.AI model weights, training data, and inference endpoints are covered by your security classification policy.
2.Prompt injection and adversarial input risks are assessed for AI systems that handle external or untrusted input.
3.Access to AI system outputs is logged and reviewable by authorised personnel.
Refusal & HITL
1.AI systems in your organisation have documented refusal conditions — defined situations where the system will not proceed.
2.Human-in-the-loop (HITL) checkpoints are defined for high-stakes AI decisions.
3.When an AI system refuses or escalates, the reason is recorded and the escalation path is defined.
4.The organisation can demonstrate, with audit evidence, that HITL decisions are made by qualified humans.
Answer all 24 remaining questions to see results.