Most AI failures we see are not model failures. They are governance failures: no owner, no data rules, no review step, and no way to tell whether the tool helped. This check scores the controls that decide whether an AI program can scale safely. Ten questions, about four minutes, scored in your browser.
What This Checks
The questions cover ownership, approved tools, data classification, vendor terms, human review, training, testing, logging, application security, and measurement. Each is scored 0 (no), 1 (partly), or 2 (yes), for a maximum of 20 points.
A high score does not mean a use case is worth doing. It means the controls exist to do it without adding avoidable risk.
Take the Check
Ten questions on ownership, data, training, and controls. Score each one 0, 1, or 2. Answers stay in your browser; nothing is sent or saved.
Score 0–6: Not ready; start with policy and one bounded pilot — No guardrails are in place yet. Start small and write the rules first.
Score 7–12: Piloting without guardrails — Work has started. Data rules, training, and review are the gaps.
Score 13–17: Ready to scale with controls — Controls are in place. Add evaluation and monitoring before scaling.
Score 18–20: Mature; focus on evaluation and monitoring — The program is mature. Watch vendor and agent risk as you add tools.
How to Read Your Score
| Score | Band | What it means |
|---|---|---|
| 0–6 | Not ready; start with policy and one bounded pilot | No guardrails yet. Write the rules and pick one small, measurable workflow. |
| 7–12 | Piloting without guardrails | Work has started. Data classification, training, and human review are the gaps. |
| 13–17 | Ready to scale with controls | Controls are in place. Add evaluation and monitoring before you scale up. |
| 18–20 | Mature; focus on evaluation and monitoring | The program is mature. Watch vendor and agent risk as you add tools. |
What to Do Next
- Below 7: write a one-page acceptable-use policy, publish an approved-tool list, and pick one bounded pilot with a baseline. Do not buy enterprise licences yet.
- 7–12: classify what data may enter a model, train staff on the specific scenarios that go wrong, and add a named human reviewer before anything leaves the firm.
- 13 and above: build a small evaluation set for each workflow, log prompts and outputs, and test the guardrails before each release.
- 18 and above: focus on vendor terms, agent permissions, and monitoring. AI security assessments are the relevant independent check.
The reasoning behind these questions is in the AI for business guide. The data-leakage failure mode most organizations miss first is covered in Shadow AI, and the staff side is where most policies fail first: cybersecurity training covers the specific scenarios that go wrong.
For help with a pilot, an assessment, or a security review of an AI application, see AI consulting and AI security, or call 703-486-0200.
Schedule an AI strategy session