The 12-Question AI Governance Self-Test

Inventory & Accountability (Map, Govern)

Can you produce a complete inventory of every AI system in use - including AI features embedded in vendor products your teams did not build? Does every AI system have a named business owner - a person, not a department - accountable for its outcomes? When a team wants to adopt a new AI tool, is there a review gate it must pass before procurement completes - and can you show a record of it firing? Do you know which of your AI systems touch personal, regulated, or contractually protected data?

Evaluation & Evidence (Measure)

Have you tested any AI system's accuracy yourselves, or are you relying entirely on vendor claims? For systems that affect people - hiring, eligibility, pricing, triage - have you measured whether outcomes differ across groups? For generative AI in customer-facing roles: do you know its error or hallucination rate, and is there a threshold that would trigger action? If a model's performance degraded next month, how would you find out - monitoring, or complaints?

Response & Governance (Manage, Govern)

If an AI system gave a wrong answer that affected a customer or contract, is there a documented escalation path - and has it ever been used? Do your AI vendor contracts give you the right to see evaluation results, incident notices, and model change logs? Are AI risks in your enterprise risk register with owners and review dates - or handled ad hoc by whoever notices? Could you show an auditor one example of an AI-related finding that changed your policy or practice?

Your score: 0 / 12

Check the questions you can evidence within one business day.

12 questions your auditor will ask about your AI program.

The checklist and the white paper, by email.

Scored under 10?