Read the report in 10 minutes
You do not need all six sections. Read these two first:
- Executive Summary (section 1). Your level, your score, your weakest pillars and the top recommendations.
- Improvement Roadmap (section 5). The actions for 90, 180 and 365 days. Each action says when it is done and how much effort it takes.
Use the rest (pillar profile, findings, gap analysis, appendix) when you need the detail behind an action.
Check that the result is reliable
- Review the answers marked “Yes” with the people who know the work.
- Add an evidence note where you can (a policy, a register, a ticket).
- The result is confidential. Share it with your sponsor and the people who took part, not wider.
Choose two people
- An executive sponsor: a senior person who supports the work.
- An AI governance owner: the person who drives it. One person plus part-time helpers is enough to start.
Pick your first actions
Start with the 90-day list in your roadmap, in the order shown. Do not try to fix all 35 questions at once. Aim for three actions you can finish in the first 30 days.
Suggested focus by level (your level is on the first page of the report):
| Your level | Score | Focus first |
|---|---|---|
| 1 Experimental | 0 to 7.5 | List every AI tool in use (the AI Service Register), give each one a named owner, write a short AI policy (two pages at most). |
| 2 Controlled | 8 to 14.5 | Make incident and change handling routine: one way to report an AI incident, one approval step before a change to production AI. Start a risk register. |
| 3 Managed | 15 to 21.5 | Assess the risk of every AI service, classify the data AI may use, add monitoring for the key services, define a few KPIs. |
| 4 Governed | 22 to 28.5 | Close the remaining gaps, complete the security assessments, measure results and keep a fixed improvement cycle. |
| 5 Optimized | 29 to 35 | Keep the level: review on a schedule, test the controls, share what works. |
Your own gaps and risks come first. This table is only a starting point.
A simple 90-day rhythm
| When | What |
|---|---|
| Weeks 1 to 4 | Validate the result with participants and sponsor. Register AI services. Assign owners. Approve a short AI policy. |
| Days 31 to 60 | Put incident and change handling to work. Build the first risk register. |
| Days 61 to 90 | Define KPIs. Hold a lessons-learned session. Run the assessment again. |
Measure again
Run the assessment again at about 90 days and compare it with the first one. After that, reassess every 6 to 12 months.
This page is guidance, not an AIIL certification, and it does not replace the Assessment Methodology.
Ready to measure again?
The assessment runs in your browser. Nothing is sent anywhere.
Take the Assessment → Explore the Framework