Guided assessment

Where does your business stand?

Answer honestly. "Don't know" is a valid answer and is scored as risk, not as a failure — it tells us where to look first.

Organisation name

AI Governance

How AI use is inventoried, approved, supervised and documented.

Step 1 of 6

Do you maintain a current inventory of AI systems and AI-enabled tools in use?

Includes assistants, embedded vendor AI features and internal models.

Evidence required: AI system inventory with owner and last-reviewed date

Is there a named human accountable for approving new AI use cases?

A role, not a committee in theory. Decisions must be traceable to a person.

Evidence required: Role description or approval log with signatures

Are high-impact AI outputs reviewed by a person before they affect customers?

Pricing, hiring, credit, safety or legal-facing outputs.

Evidence required: Review procedure plus sample of reviewed outputs

Do you record which data is sent to external AI providers?

Prompt content, customer data, source code, documents.

Evidence required: Data flow note per AI tool

Do staff have written guidance on acceptable AI use?

Short and practical beats long and unread.

Evidence required: Published guidance with version and date

Live score preview

0% answered

Readiness

Early

Evidence

Unknown — no evidence assessed

Exposure

Critical

Readiness — Are the controls in place? Based on your answers (self-reported). Readiness 0/100 is the weighted average of six domain scores. Each question carries a fixed weight; "yes" counts fully, "partial" counts half, "no" and "unknown" count zero. Strongest domain: AI Governance (0).

Evidence Confidence — Can you prove it? Based only on evidence records, never on answers. Evidence Confidence is unknown: 0 control(s) are claimed in the answers, but no evidence records back them. Self-reported answers alone never raise this score.

Exposure — What is at risk? Business impact of missing or unknown controls. Higher is worse. Exposure 85/100 (higher means more exposure) weights each missing control by its business impact. Largest contributors: AI Governance (85), Cyber Readiness (85). "Unknown" is treated as 85% of a missing control, because undocumented controls fail under scrutiny.

Based on: Readiness — assessment responses and control weights; Evidence Confidence — linked posture evidence records and v0.2 evidence methodology; Exposure — missing or weak controls and configured exposure weights. Methodology

Bands are the EvidentraIQ v0.2 interpretation (Pilot / calibration stage), not external standards. Treat scores as indicative: a difference of a few points is not meaningful on its own.

How this score is calculated

Only controls you claim (answered "yes" or "partial") need proof: 0 claimed, 0 with an evidence record.
A record must exist to count. It is then scored on source authority (20%), verification (35%), freshness (25%) and confidence (20%).
A claimed control with no evidence record scores zero, whatever the answer.
With no evidence records at all, the score is shown as unknown.

Methodology v0.2 — pilot methodology, calibration stage. These are EvidentraIQ design choices, not regulatory thresholds. Read the full methodology

AI Governance rationale

0/100 readiness from 5 weighted questions (0 answered). 5 control(s) not fully in place, 5 answered as unknown. Exposure 85/100 is driven by the weighted impact of those gaps.

Readiness0

Exposure85

Answer all 26 questions to request a copy of your report.