Self-assessment

Rapid AI Governance Diagnostic

This scorecard gives you a fast, structured read on how responsibly AI is being adopted across your organisation, built on the risk themes and governance framework from Responsible AI: An Executive Perspective. It is designed to be completed in a single working session, typically 60–90 minutes, either alone or with your leadership team.

Your answers stay in this browser. Nothing is sent to Kivè Advisory unless you choose to book a conversation.

Details for your printout (optional)

Section ARisk exposure

Data Exposure & IP Leakage

Do we have a documented policy governing what data can be entered into AI tools (internal or external)?
Is there a technical control (e.g. DLP, access restriction) preventing sensitive data reaching unapproved AI platforms?
Are employees trained on what counts as sensitive or confidential data in an AI context?

Shadow AI

Do we have visibility into which AI tools are actually being used across the organisation, approved or not?
Is there an approved, low-friction channel for employees to request or trial new AI tools?
Do we monitor for unsanctioned AI or SaaS usage, e.g. via network or expense monitoring?

Hallucinations & Accuracy

Are there defined boundaries for which decisions AI may inform versus dictate outright?
Is human validation mandatory before AI outputs are used in high-stakes decisions (financial, legal, customer-facing)?
Do we track or audit instances of AI errors or hallucinations in production use?

Bias & Fairness

Have AI systems used in hiring, lending, pricing or evaluation been tested for demographic bias?
Is there a defined process for remediating bias once identified?
Do we have diverse representation among the teams designing and reviewing AI use cases?

Regulatory Ambiguity

Have we mapped which AI regulations apply to us by geography and sector (e.g. EU AI Act, sector rules)?
Is there a designated owner accountable for AI regulatory compliance?
Do we maintain documentation and audit trails sufficient to demonstrate compliance if asked?

Trust as a Systemic Risk

Do we measure or track stakeholder trust in AI-driven decisions (employees, customers, regulators)?
Is there a clear escalation path when an AI-related trust incident occurs?
Do leadership and the board receive regular reporting on AI governance and trust metrics?

Amplified Cyber Security Risk

Have we assessed how AI tools and agents expand our attack surface (e.g. prompt injection, data poisoning, model theft)?
Are AI systems and their data pipelines covered by existing cyber security / ISO 27001 control frameworks?
Do we have incident response procedures specific to AI-related security incidents?

Section BGovernance framework maturity

Identify

Do we have a common taxonomy for classifying AI risk across data, model behaviour, access and decision impact?
Have we inventoried all AI use cases currently in production or pilot?
Is risk identification a continuous process, rather than a one-off exercise?

Categorise

Is AI risk mapped against existing IT risk domains, rather than treated as an entirely separate category?
Are AI risks categorised by severity and likelihood consistently across the organisation?
Is there a shared owner and taxonomy agreed across IT, data, risk and legal?

Prioritise

Do we have a method for ranking AI risks by operational and reputational exposure?
Are resources (budget, people) allocated in proportion to prioritised risk?
Is there executive or board visibility into the prioritised risk list?

Operationalise

Are controls for AI risk embedded into daily operational processes, not just policy documents?
Is there clear ownership and accountability for each control?
Do we have a defined escalation and review cadence?
0 of 33 answered