Free assessment · answer in a few minutes
AI Governance Assessment
For risk, legal and compliance leads who need to see where decisions about AI have no clear owner, and what to do about it first.
Built by XONIK. Nothing you enter leaves this page.
In brief
This assessment shows who is accountable for the AI your organization uses and where the gaps are. You answer questions on accountability, inventory, oversight, change and incidents, suppliers and records. You get a governance band, the two areas with the thinnest cover and their steps, plus a downloadable report. It is rule-based and is not an audit.
Step 1 of 6: Accountability
0 of 18 answered
- Accountability (current step)
- Inventory (not yet reached)
- Oversight (not yet reached)
- Change and incidents (not yet reached)
- Suppliers and third parties (not yet reached)
- Records (not yet reached)
Accountability
Accountability is whether a named person answers for each AI system, who may approve one for use and whether senior people see how AI is used. Without it a problem has no one whose job it is to act, and every control below depends on someone doing so.
Inventory
Inventory is the list of AI systems and AI features in use, with the data each touches and the decisions about people it influences. A control cannot cover a system nobody knows exists, so everything else here reaches only as far as this list does.
Oversight
Oversight is whether a person can review, question or reverse what an AI system produces, and whether quality is checked while it runs. Rules on paper count for little if nobody is placed to catch a wrong output before it reaches someone.
Change and incidents
Change and incidents covers what happens when a model, a prompt or a supplier changes under a live system, and what happens when something goes wrong. A system that was sound on the day it was approved can stop being sound without anyone deciding it should.
Suppliers and third parties
Suppliers and third parties is how you choose, contract with and keep watch on those who provide AI to you or use it to deliver your work. Much of the AI an organization depends on is built by others, so your cover reaches only as far as what you have asked of them.
Records
Records are the logs and the written decisions that let you reconstruct what a system did and why it was approved. When a regulator, a customer or an auditor asks, an arrangement you cannot evidence is, in practice, one you cannot rely on.
Answer the 3 questions left on this step to go on.
Your result
Where your points are
Your two weakest areas
Your strongest area
Want to talk through what this means for your organization?
Review your governance gaps with usOn this page
What does a governance self-assessment tell you, and where does it stop?
It tells you where decisions about AI have no clear owner and where your cover is thinnest. It does not tell you which laws apply, whether you meet them or how well a system performs, and it is not legal advice. A band describes arrangements you reported; whether they work is another question, and a regulator will ask it.
Whose knowledge does each area draw on?
Nobody holds all six areas in their head, so some questions will send you to a colleague.
| Area | Who usually knows | What may need looking up |
|---|---|---|
| Accountability | The risk lead | Who is named for each system and who may approve a new one |
| Inventory | The technology lead and procurement | Tools bought, built, and switched on inside other products |
| Oversight | The owners of live systems | How outputs are reviewed and who may override them |
| Change and incidents | The engineering lead and the head of security | How a model or supplier change is handled |
| Suppliers and third parties | Procurement and the general counsel's office | What each contract says about your data |
| Records | The compliance lead | Logs, the retention rule and approvals |
Should you answer alone, and how long does it take?
The sitting is short when you answer from what you know, and longer if you stop to find out who approves a new system; those pauses are the assessment doing its work. Answer once alone, then ask risk, engineering and procurement to do the same. The differences tell you more than the score.
Is this the right place to start?
Start here when
- You need to see where decisions about AI have no named owner before anyone drafts a policy
- A regulator, a customer or your board may ask how you govern AI
Look elsewhere when
- You need to know which law applies or whether you comply, which is for legal advice
- A third party must be able to rely on the result, as with an audit
The assessment is quick because it takes your account on trust. It shows you where to look and not what you will find there.
What does a band such as In place tell you?
The labels describe arrangements and not compliance. In place means they exist, are written down and are used; In place and rehearsed adds that you have run them on a real or a practice case and found that they hold. Cover is thinnest in the two areas that earned the smallest share of their own points, and a high band with one area near the bottom still has a hole where an inquiry will push first.
What to do once you have the result
- 01
Hand it up
Give the report to the executive who would answer a regulator.
- 02
Name an owner
Put a name and a date against the first step in each weak area.
- 03
Put it on paper
Turn the step into a list, an authority, a rule or a route.
- 04
Run it on a made-up case
Try one arrangement on an invented incident and record what failed.
What do people ask before using the AI governance assessment?
Does this assessment tell us whether we comply with AI law?
No. It shows where decisions about AI have no named owner and where your cover is thinnest. It does not say which laws apply to you, whether you meet them or how well a system performs, and it is not legal advice. Take advice from counsel on the obligations themselves.
Who in the company should answer the governance questions?
Nobody holds every area, so answer once alone, then ask risk, engineering and procurement to answer separately. Compliance usually knows the records, and procurement the supplier contracts. The differences between the sets of answers tell you more than the score does, so compare them area by area.
What does a band such as In place actually tell me?
It describes arrangements, not compliance. In place means they exist, are written down and are used. In place and rehearsed adds that you have run them on a real or practice case and found they hold. A high band with one area near the bottom still has a hole.
Why does it ask about AI tools that staff chose on their own?
Because governance usually breaks at the inventory. The policy is rarely the first thing to fail; the list it covers is. Tools staff adopt and features suppliers add in an update go unrecorded, so approval, oversight and records reach only as far as the list does.
Related
Ready to close the gaps this showed?
Describe what you are weighing in a few lines. A senior practitioner replies with a suggested first conversation.