Ned Knight
Free tool

AI Governance Readiness Scorecard

Ten questions, about two minutes. Get an instant maturity score, benchmarked against the EU AI Act, NIST AI RMF, ISO/IEC 42001 and, for banks, SR 11-7, with your three priority actions.

  • 10 questions
  • About 2 minutes
  • Instant score and recommendations

The scorecard needs JavaScript. You can also contact us for a readiness conversation.

Do you have a central inventory of the AI systems your organization uses, including third-party and generative AI tools?
Are your AI systems classified by risk level, for example against the EU AI Act risk categories or an internal tiering?
Do you have an approved AI policy and acceptable-use standard?
Is accountability for AI clearly assigned, with named owners and a governance forum or committee?
Are AI use cases assessed for risk before they go live (bias, privacy, security, model risk)?
Are AI capabilities in third-party software and vendors assessed before you buy or switch them on?
Are AI models and agents monitored once they are in production (performance, drift, incidents)?
For AI agents that can act in business systems, are permissions, human approvals and audit trails controlled?
If a regulator or auditor asked tomorrow, could you produce evidence of how your AI is governed (documentation, tests, approvals)?
How do you keep track of AI regulations such as the EU AI Act, US state laws and sector rules?
Your score is ready

Tell us where to send it. You will see your results straight away, and we will email you a copy.

We use these details to send your results and to follow up if you ask us to. See our Privacy Policy.

0/100

Your maturity level

  1. InitialAI is being used without the basic foundations of governance. The priority is visibility: know what AI you run, who owns it and which rules apply.
  2. DevelopingSome foundations are in place, but they depend on individuals and manual effort. The priority is to make governance consistent and repeatable.
  3. DefinedYou have a defined governance program. The priority is to automate controls and evidence so it scales with your AI and agents.
  4. AdvancedYour governance is mature. The priority is to keep pace with new regulations and agentic AI, and to prove it continuously to regulators and your board.

Your scores by area

AI inventory & classification0

EU AI Act risk classification · NIST AI RMF Map · ISO/IEC 42001 · SR 11-7 model inventory

Policy & accountability0

EU AI Act governance and AI literacy · NIST AI RMF Govern · ISO/IEC 42001 policy and roles

Risk & impact assessment0

EU AI Act risk management and impact assessment · NIST AI RMF Map and Measure · ISO/IEC 42001 risk and impact assessment

Controls & monitoring0

EU AI Act human oversight and post-market monitoring · NIST AI RMF Manage · SR 11-7 ongoing monitoring

Evidence & regulatory readiness0

EU AI Act documentation and record-keeping · ISO/IEC 42001 internal audit · supervisory examinations

Your three priority actions

    • AI inventory & classification. Build a single inventory of every AI system, model and agent, including third-party and generative AI tools, give each a named owner, and tier them by risk so effort goes where the risk is.
    • Policy & accountability. Approve an AI policy and acceptable-use standard, name accountable owners, and set up a governance forum with clear decision rights and regular reporting to leadership.
    • Risk & impact assessment. Introduce a tiered risk and impact assessment that every AI use case and AI vendor passes before go-live, covering bias, privacy, security and model risk.
    • Controls & monitoring. Put production monitoring, incident handling and human approval thresholds in place, and give AI agents identity-based permissions and complete audit trails.
    • Evidence & regulatory readiness. Collect evidence automatically as work happens (approvals, tests, monitoring) and map it to the regulations you face, so you can answer a regulator or auditor in days, not months.

    Turn this snapshot into a plan

    Our six-week AI Governance Readiness Assessment gives you a full inventory of your AI systems and agents, risk tiering, a maturity baseline against the regulations that apply to you, and a prioritized roadmap with a business case.

    Talk to us about your results About the Readiness Assessment

    This scorecard is a self-assessment for guidance only. It is not legal advice or a formal audit.