How It Works
Assessment
Methodology
The AI Governance Self-Assessment assesses your organization across 20 structured questions spanning 5 critical governance domains. Each response is scored on a 0–3 scale, and domain scores are normalized to produce a single 0–100 maturity score.
The assessment is designed for C-suite executives, CISOs, board members, and senior technology leaders who need a fast, credible snapshot of their AI governance posture — without engaging a consultant. It takes under 5 minutes and requires no account.
Scoring Formula
Each question offers four topic-specific responses scored 0–3, from the least to the most established practice.
Each domain contains 4 questions (max 12 raw points). Domain score = (raw score ÷ 12) × 100, rounded to the nearest integer.
The overall score is the simple average of all 5 domain scores. Each domain carries equal weight in the final result.
Maturity Levels
Every score — both overall and per-domain — maps to one of four maturity levels. These labels summarize self-reported responses. The descriptions below are indicative practices, not verification that those practices exist. Review domain gaps and supporting evidence before drawing conclusions.
No formal governance exists. AI deployments are ad hoc, unowned, and ungoverned. Risk exposure is high and largely unmeasured.
Governance is beginning to take shape in isolated areas, but adoption is uneven and critical gaps remain across most domains.
A solid governance foundation exists. Policies and controls are documented and broadly adopted. Consistency and enforcement are the primary challenges.
Governance is comprehensive, embedded in operations, and continuously improving. The organization can demonstrate accountability to regulators, boards, and customers.
The Five Domains
The five domains were selected to reflect the primary governance responsibilities that enterprise organizations must address as they scale AI adoption. They align with the NIST AI Risk Management Framework, the EU AI Act's requirements, and ISO 42001 — the international standard for AI management systems.
Governance policies and acceptable use
Covers documented AI governance frameworks, use-case review processes, AI system inventories, and defined ownership structures.
Read more →Data governance for AI training and inference
Covers AI-specific data governance, privacy impact assessments, data quality controls, and consent management for personal data.
Read more →Securing AI models, APIs, and supply chain
Covers adversarial defenses, third-party AI risk assessments, output auditing, and inclusion of AI systems in vulnerability programs.
Read more →EU AI Act, NIST AI RMF, and SOC 2 alignment
Covers regulatory monitoring, risk classification, audit evidence collection, and legal risk management for AI systems.
Read more →Culture, training, and board-level oversight
Covers board and executive oversight, workforce AI literacy, ethics frameworks, and incident response capability.
Read more →Design Principles
Calibrated for Executives
Questions are phrased in governance and risk language, not engineering terminology. A board director, CISO, or General Counsel should be able to answer every question without technical assistance.
Grounded in Standards
The domain structure and question logic draw from the NIST AI RMF Govern function, EU AI Act obligations, ISO 42001 management requirements, and MITRE ATLAS for adversarial AI threats.
Equal Domain Weight
Each of the five domains contributes equally to the overall score. Review each domain alongside the average: a strong overall score can coexist with a serious gap in a specific area.
Actionable by Design
Each result page surfaces domain-level scores, gap analysis, and prioritized recommendations — not just a number. The intent is to give executives a starting point for board-level conversation.
Share This Page
Use this as a conversation starter with prospects or board members.