Free assessment · quick to answer
AI Governance Assessment
Somebody will ask who answers for your AI: a regulator, a customer or your board. This AI governance assessment shows risk, legal and compliance leads where nobody does, and what to fix first.
Built by XONIK. Nothing you type leaves your browser.
In brief
This free AI governance assessment shows who is accountable for the AI your organization uses and where the gaps are. You answer questions on accountability, inventory, oversight, change and incidents, suppliers and records. You get a governance band, the thinnest areas with their steps, and a report to download. Nothing here is an audit.
Step 1 of 6: Accountability
0 of 18 answered
- Accountability (current step)
- Inventory (not yet reached)
- Oversight (not yet reached)
- Change and incidents (not yet reached)
- Suppliers and third parties (not yet reached)
- Records (not yet reached)
Accountability
Accountability is whether a named person answers for each AI system, who may approve one for use and whether senior people see how AI is used. Without it a problem has nobody whose job it is to act, and every control below depends on someone doing so.
Inventory
Inventory is the list of AI systems and AI features in use, with the data each touches and the decisions about people it influences. A control can't cover a system nobody knows exists, so everything else here reaches only as far as this list does.
Oversight
Oversight is whether a person can review, question or reverse what an AI system produces, and whether quality is checked while it runs. Rules on paper count for little if nobody is placed to catch a wrong output before it reaches someone.
Change and incidents
Change and incidents covers what happens when a model, a prompt or a supplier changes under a live system, and what happens when something goes wrong. A system that was sound on the day it was approved can stop being sound without anyone deciding it should.
Suppliers and third parties
Suppliers and third parties is how you choose, contract with and keep watch on those who provide AI to you or use it to deliver your work. Much of the AI an organization depends on is built by others, so your cover reaches only as far as what you've asked of them.
Records
Records are the logs and the written decisions that let you reconstruct what a system did and why it was approved. When a regulator, a customer or an auditor asks, an arrangement you can't evidence is, in practice, one you can't rely on.
Answer the 3 questions left on this step to go on.
Your result
Where your points are
Your two weakest areas
Your strongest area
Want to talk through what this means for your organization?
Go through your governance gaps with usOn this page
What does an AI governance assessment tell you, and where does it stop?
It tells you where decisions about AI have no clear owner and where your cover is thinnest. It won't tell you which laws apply, whether you meet them or how well a system performs, and it isn't legal advice. A band describes arrangements you reported. Whether they work is another question, and a regulator will ask it.
Whose knowledge does each area draw on?
Nobody holds every area in their head, so some questions will send you to a colleague.
| Area | Who usually knows | What may need looking up |
|---|---|---|
| Accountability | The risk lead | Who is named for each system and who may approve a new one |
| Inventory | The technology lead and procurement | Tools you bought, tools you built, and AI switched on inside other products |
| Oversight | The owners of live systems | How outputs are reviewed and who may override them |
| Change and incidents | The engineering lead and the head of security | How a model or supplier change is handled |
| Suppliers and third parties | Procurement and the general counsel's office | What each contract says about your data |
| Records | The compliance lead | Logs, the retention rule and approvals |
Should you answer alone?
Answer from what you know and the sitting is short. It gets longer if you stop to find out who approves a new system, and those pauses are the assessment doing its work. Answer once alone, then ask risk, engineering and procurement to do the same. The differences between your answers will tell you more than the score.
Is this the right place to start?
Start here when
- You need to see where decisions about AI have no named owner before anyone drafts a policy
- A regulator, a customer or your board may ask how you govern AI
Look elsewhere when
- You need to know which law applies or whether you comply, which is a question for legal advice
- A third party has to be able to rely on the result, as with an audit
It's quick because it takes your account on trust. It shows you where to look, not what you'll find there.
What does a governance band such as In place tell you?
The labels describe arrangements, not compliance. In place means the arrangements exist, are written down and are used. In place and rehearsed adds that you've run them on a real or practice case and found they hold. Cover is thinnest in the areas that earned the smallest share of their own points. A high band with one area near the bottom still has a hole, and an inquiry will push there first.
What should you do once you have the result?
- 01
Hand it up
Give the report to the executive who would have to answer a regulator.
- 02
Name an owner
Put a name and a date against the first step in each weak area.
- 03
Put it on paper
Turn each step into a list, an authority, a rule or a route.
- 04
Run it on a made-up case
Try one arrangement on an invented incident and write down what failed.
What do risk and legal leads ask before they start?
Does this assessment tell us whether we comply with AI law?
No, and it doesn't try to. It shows where decisions about AI have no named owner and where your cover is thinnest. Which laws apply, whether you meet them and how well a system performs are outside it, and it isn't legal advice. Take counsel's advice on the obligations themselves.
Who in the company should answer the governance questions?
Nobody holds every area, so answer once alone, then ask risk, engineering and procurement to answer separately. Compliance usually knows the records and procurement knows the supplier contracts. Compare the sets of answers area by area, because the differences tell you more than the score does.
What does a band such as In place actually tell me?
It describes arrangements, not compliance. In place means they exist, are written down and are used. In place and rehearsed adds that you've run them on a real or practice case and found they hold. A high band with one area near the bottom still has a hole.
Why does it ask about AI tools that staff chose on their own?
Because governance usually breaks at the inventory. Tools staff adopt and features suppliers add in an update go unrecorded, so approval, oversight and records reach only as far as the list does. The policy is rarely the first thing to fail; the list it covers is.
Related
Want a second pair of eyes on the gaps this showed?
Tell us which area scored lowest and who answers for it today. A senior person reads it and writes back with where we'd start.