AI Readiness Assessment: Is Your Organisation Ready to Use AI Safely?

1.How does your organisation assess and manage the risks associated with AI adoption and usage?*

[0] No risk assessment process exists for AI

[1] Risks are identified reactively when issues arise, with no structured process

[2] Some AI risks are identified but assessment is informal and depends on individuals

[3] A documented AI risk assessment process exists and is applied to new AI initiatives

[4] AI risks are regularly reviewed, measured, and reported to management

[5] AI risk management is continuously improved and integrated into enterprise risk management

2.Has your organisation conducted a formal risk assessment before deploying any AI tool or system?*

[0] No risk assessment process exists for AI

[1] Occasionally, but only when something goes wrong or a concern is raised

[2] Sometimes, depending on the team or individual leading the initiative

[3] Yes, we have a defined process and it is applied consistently before deployment

[4] Yes, and outcomes are tracked, measured, and used to inform our risk register

[5] Yes, and the process is continuously refined based on lessons learned and emerging threats

3.How mature is your organisation's data classification framework in the context of AI usage?*

[0] No data classification framework exists

[1] Data is classified informally and inconsistently

[2] A classification framework exists but is not consistently applied when using AI tools

[3] Data classification is documented and staff are expected to apply it before using AI tools

[4] Compliance with data classification requirements for AI usage is monitored and enforced

[5] Data classification is continuously reviewed and updated to address evolving AI use cases

4.Does your organisation have an acceptable use policy that specifically addresses AI tools and their use by employees?*

[0] No acceptable use policy exists for AI

[1] General IT policies exist but do not specifically address AI tools

[2] An AI acceptable use policy is in draft or exists informally

[3] A documented AI acceptable use policy exists and has been communicated to staff

[4] Policy compliance is actively monitored and exceptions are tracked and managed

[5] The policy is regularly reviewed and updated based on new AI tools, threats, and regulatory changes

5.How does your organisation assess the security and risk posture of third-party AI tools and vendors before procurement?*

[0] No third-party AI risk assessment process exists

[1] Vendor risk is considered informally and only when concerns are raised

[2] Some vendor assessments are conducted but the process is inconsistent

[3] A defined vendor risk assessment process exists and is applied to AI tools before procurement

[4] Third-party AI risk is monitored post-procurement and reviewed regularly

[5] Vendor AI risk management is continuously improved and integrated into the broader third-party risk programme

6.How does your organisation manage access to approved AI tools and the data those tools can access?*

[0] No access controls are in place for AI tools

[1] Access is managed informally, typically by the tool owner or individual teams

[2] Some access controls exist but are inconsistently applied across the organisation

[3] Access to AI tools is governed by a defined process aligned with least privilege principles

[4] Access rights are regularly reviewed, and anomalies are detected and acted upon

[5] Access controls for AI tools are continuously optimised based on usage patterns and risk data

7.Does your organisation's incident response process specifically account for AI-related incidents such as data leakage through AI tools, model manipulation, or prompt injection attacks?*

[0] No incident response process exists for AI-related incidents

[1] AI incidents are handled ad hoc under the general IT incident process with no specific guidance

[2] Some consideration of AI incidents exists but is not formally documented

[3] AI-specific incident scenarios are documented and included in the incident response plan

[4] AI incident response is tested regularly and response times and outcomes are measured

[5] The AI incident response process is continuously improved based on test results and real incidents

8.What is the state of AI security awareness training within your organisation?*

[0] No AI-specific security awareness training exists

[1] Staff receive ad hoc guidance on AI risks when issues arise

[2] Some training exists but coverage is inconsistent across the organisation

[3] A structured AI security awareness programme exists and is delivered to all relevant staff

[4] Training effectiveness is measured and completion is tracked and enforced

[5] Training is continuously updated to reflect new AI threats, tools, and regulatory requirements

9.How well does your organisation understand and manage its regulatory and legal obligations related to AI usage, including data protection laws such as GDPR?*

[0] No assessment of regulatory obligations related to AI has been conducted

[1] Legal and compliance teams are aware of AI informally but have not formally assessed obligations

[2] Some regulatory requirements have been identified but are not consistently applied

[3] Regulatory obligations related to AI are documented and mapped to controls

[4] Compliance with AI-related regulations is monitored and reported to management

[5] Regulatory compliance for AI is continuously reviewed as laws and guidance evolve

10.Is there a named individual or function accountable for AI governance within your organisation?*

[0] No accountability for AI governance has been assigned

[1] Accountability is assumed informally by IT or a business unit without formal assignment

[2] Accountability is informally acknowledged but not documented or enforced

[3] A named owner for AI governance is formally documented and their responsibilities are defined

[4] AI governance accountability is reviewed regularly and performance is measured

[5] AI governance ownership is embedded in enterprise governance structures and continuously evaluated

11.How visible is AI risk and governance to your board or executive leadership?*

[0] AI risk is not reported to or discussed at board or executive level

[1] AI risk is raised occasionally and reactively when incidents or concerns escalate

[2] Some reporting exists but it is informal and not part of a regular governance cadence

[3] AI risk is included in regular board or executive reporting on a defined schedule

[4] Board reporting on AI risk includes metrics, trends, and management actions

[5] Board-level AI governance is continuously refined based on strategic priorities and emerging risks

12.How does your organisation detect and manage the use of unsanctioned AI tools by employees?*

[0] No process exists to detect or manage shadow AI usage

[1] Shadow AI is acknowledged as a risk but no detection or management process is in place

[2] Some informal monitoring occurs but there is no consistent process or policy enforcement

[3] A defined process exists to identify and manage unsanctioned AI tool usage

[4] Shadow AI detection is actively monitored, with incidents tracked and remediated

[5] Shadow AI risk management is continuously improved using usage data, policy updates, and tooling

13.Has your organisation assessed what personal or sensitive data may be transmitted to AI tools and whether appropriate consent and data minimisation practices are in place?*

[0] No assessment of data transmitted to AI tools has been conducted

[1] Some awareness exists but no formal assessment or controls are in place

[2] An assessment has been partially conducted but gaps remain unaddressed

[3] A documented assessment exists and data minimisation and consent requirements are applied

[4] Data privacy controls for AI are monitored and non-compliance is tracked and remediated

[5] Data privacy practices for AI are continuously reviewed and improved as tools and regulations evolve

14.Does your organisation's software development lifecycle include specific controls for AI-generated or AI-assisted code?*

[0] No controls exist for AI-generated code within the SDLC

[1] Developers use AI coding tools informally with no specific guidance or controls

[2] Some guidance exists but it is not consistently applied across development teams

[3] Defined controls for AI-generated code are documented and integrated into the SDLC

[4] AI-generated code is subject to the same security review and testing as human-written code, and compliance is tracked

[5] SDLC controls for AI-generated code are continuously improved based on emerging threats and tool capabilities

15.Does your organisation have visibility into which AI coding tools developers are using, including unsanctioned tools?*

[0] No visibility exists into AI coding tool usage by developers

[1] Some awareness exists but there is no formal inventory or monitoring

[2] An informal inventory exists but is incomplete and not actively maintained

[3] A defined process exists to inventory and approve AI coding tools used in development

[4] AI coding tool usage is actively monitored and unapproved tools are flagged and addressed

[5] AI coding tool governance is continuously refined based on usage data and emerging risk

AI Readiness Assessment: Is Your Organisation Ready to Use AI Safely?

The InfoSec Nerd