AI Governance Quick Assessment

Your employees are using ChatGPT, Copilot, Gemini, Claude, AI note-takers and AI features that switched on inside your software. The question is not how to certify anything. It is whether anyone knows what AI is in use, who owns it, what data goes into it, and what happens when it is wrong.

This assessment answers that in twenty minutes. It scores seven areas and reports a maturity level for each and overall: 1 Unstructured, 2 Emerging, 3 Managed, 4 Measured, 5 Optimized. Your overall level can be at most one above your weakest area, because a strong policy with no inventory is not a working management system. It deliberately does not produce a compliance percentage.

Built around the NIST AI Risk Management Framework and informed by ISO/IEC 42001 AI management-system concepts.

What is included

1. AI-Governance-Quick-Assessment.pdf, with level definitions and 30-day actions for each level.

2. AI-Governance-Quick-Assessment-Scoring.xlsx, which scores itself and charts each area.

Who it is for

IT directors, security managers and engineers, compliance and risk managers, CIOs, COOs, AI program leaders and business owners at organizations of roughly 25 to 500 people whose employees are adopting AI faster than the organization is building the management system around it.

Formats

PDF, Self-scoring Excel workbook.

License

License. Your purchase grants one organization a perpetual, non-exclusive license to use, copy, and modify these materials for its own internal security program, including sharing completed questionnaires and contract exhibits with its own vendors. You may not resell, sublicense, or redistribute the templates themselves, in original or modified form, as a product. Consultants and managed service providers who want to use the materials across multiple client organizations need a practitioner license; contact cyberauctoritas.com.

Disclaimer

This material is provided for general information and internal program building. It is not legal advice and does not certify compliance with any law, regulation, or framework. Contract language must be reviewed by qualified counsel before use. Adapt every document to your organization, your risk tolerance, and your obligations.