How confident are you in your AI governance program?

Most AI governance conversations start with a framework: NIST AI RMF, the EU AI Act, ISO 42001. None of them tell you what subgroup testing to run on your specific system, whether your halt authority has ever actually been used, or whether the person accountable for AI risk has standing to shape deployments or just reviews them after the fact.

This diagnostic asks the questions those frameworks don't. Twelve questions across seven areas, built for a 10-minute read that leaves you with a specific list of where the work is.

What it covers:

• Inventory and ownership — can you name every AI system making decisions in your organization, including the ones your team didn't build

• Policy vs. enforcement — the gap between a fairness policy and a fairness constraint actually embedded in your architecture

• Risk proportionality — whether your controls scale with what each system can actually do

• Agentic and autonomous systems — governance for AI that takes real-world action without a human approving each step

• Measurement and evidence — whether your monitoring has ever changed a deployment decision, or only produces documentation

• Organizational structure — whether AI risk ownership sits upstream of deployment decisions or downstream of them

• Organizational culture — whether business units come to governance proactively or only because they're required to