Target: https://turma-assured-pre-prod.vercel.app (pre-prod) · Suite last run 20 Jul 2026, 11:06 · took 402.5s · Internal & confidential
Results page renders "Your your organisation is performing…".
When all dimension scores tie, the summary says "strongest on Shadow AI … and weakest on Shadow AI".
Key-finding copy can show "67.42105263157895 / 100" instead of a rounded score.
UI states "Your answers are saved automatically", but refreshing mid-assessment resets to an empty step 1. A 33-question assessment lost mid-way is likely abandonment.
The unlocked report payload contains a roiEstimate field, but it was null in every generated report observed (3/3 runs).
"Guarded by test" means a test watches each bug: the suite stays green while the bug exists, and flips the moment a deploy fixes (or reintroduces) it.
| AI-written section | Across runs | Word overlap (100% = same text) |
|---|---|---|
| overallPosition | DIFFERENT | |
| opportunityPosition | DIFFERENT | |
| riskRecommendations | DIFFERENT | |
| auditRecommendations | DIFFERENT | |
| opportunityRecommendations | DIFFERENT | |
| shadow-ai (domain narrative) | DIFFERENT | |
| usage-policies (domain narrative) | DIFFERENT | |
| staff-training (domain narrative) | DIFFERENT | |
| accountability (domain narrative) | DIFFERENT | |
| risk-mgmt (domain narrative) | DIFFERENT | |
| data-governance (domain narrative) | DIFFERENT | |
| tool-sprawl (domain narrative) | DIFFERENT | |
| strategic-alignment (domain narrative) | DIFFERENT |
Measured 20 Jul 2026, 11:13: same 33 answers submitted 3×, full report unlocked each time with an e2e+…@turma.io test lead. Full texts and line-level diffs: runs/report-consistency-report.json. Re-measure: npm run test:ai-report.
Substance stays on-theme (same priorities, same regulatory references) but the prose is fully rewritten per run. For a governance product this needs a founder/Akili decision: (1) cache the report by answer-hash: deterministic, cheaper, auditable (recommended); (2) temperature 0, which reduces but does not eliminate variation; (3) accept variation as intended, in which case sales copy must never claim deterministic assessments.
| Test and what it checks | Result | Took | Last run | Where |
|---|---|---|---|---|
|
assessment page renders step 1 with org profile dropdowns
The /assess page loads, shows the 4 organisation dropdowns, and the Continue button is locked until the profile is complete.
|
PASS | 3.1s | 20 Jul 2026, 11:07 | smoke.spec.ts:4 |
|
a submission is registered on page load
Opening the assessment registers a submission in the backend (POST /api/submission/start returns an ID).
|
PASS | 1.0s | 20 Jul 2026, 11:07 | smoke.spec.ts:13 |
|
core APIs respond
The three backend APIs behind the assessment (tenant, segmentation, questions) all answer with HTTP 200.
|
PASS | 3.1s | 20 Jul 2026, 11:07 | smoke.spec.ts:24 |
| Test and what it checks | Result | Took | Last run | Where |
|---|---|---|---|---|
|
questions payload has expected structure
Every question has a code, readable text, and at least 2 unique answer options; malformed content fails here.
|
PASS | 6.1s | 20 Jul 2026, 11:06 | api-contract.spec.ts:10 |
|
question inventory snapshot (codes + option counts)
Snapshot of the full question inventory (33 questions, codes, option counts). Fails if Akili adds, removes, or reorders questions between deploys.
|
PASS | 1.9s | 20 Jul 2026, 11:06 | api-contract.spec.ts:31 |
|
segmentation lists industries and role profiles
The industry list (5) and role profiles (4) used in step 1 are present.
|
PASS | 933ms | 20 Jul 2026, 11:06 | api-contract.spec.ts:42 |
|
tenant branding is configured
Turma branding config is served and the 8 scoring dimensions are defined.
|
PASS | 605ms | 20 Jul 2026, 11:06 | api-contract.spec.ts:50 |
| Test and what it checks | Result | Took | Last run | Where |
|---|---|---|---|---|
|
best-practice answers outscore worst-practice answers
Two full assessments with identical org profiles: one answering everything best-practice, one worst-practice. Best must outscore worst overall and on every one of the 8 dimensions.
|
PASS | 13.7s | 20 Jul 2026, 11:06 | scoring.spec.ts:10 |
|
scenario "mature-finance-firm" completes and score is well-formed
Full assessment for this persona. Checks all scores are 0–100 across 8 dimensions, severity label exists, and the exact scores match the frozen baseline; any scoring change between deploys turns this red.
|
PASS | 12.9s | 20 Jul 2026, 11:07 | scoring.spec.ts:41 |
|
scenario "immature-legal-firm" completes and score is well-formed
Full assessment for this persona. Checks all scores are 0–100 across 8 dimensions, severity label exists, and the exact scores match the frozen baseline; any scoring change between deploys turns this red.
|
PASS | 12.3s | 20 Jul 2026, 11:07 | scoring.spec.ts:41 |
|
scenario "middling-healthcare-org" completes and score is well-formed
Full assessment for this persona. Checks all scores are 0–100 across 8 dimensions, severity label exists, and the exact scores match the frozen baseline; any scoring change between deploys turns this red.
|
PASS | 11.9s | 20 Jul 2026, 11:07 | scoring.spec.ts:41 |
|
scenario "inconsistent-profservices-org" completes and score is well-formed
Full assessment for this persona. Checks all scores are 0–100 across 8 dimensions, severity label exists, and the exact scores match the frozen baseline; any scoring change between deploys turns this red.
|
PASS | 11.5s | 20 Jul 2026, 11:07 | scoring.spec.ts:41 |
| Test and what it checks | Result | Took | Last run | Where |
|---|---|---|---|---|
|
same answers 3× → same scores and same advice text
The exact same organisation profile and answers submitted several times in fresh sessions. Scores AND the full advice text on the results page must be byte-identical every time; any AI/text drift fails here, with a line-by-line diff in runs/repeatability-report.json.
|
PASS | 44.1s | 20 Jul 2026, 11:06 | repeatability.spec.ts:58 |
|
same inputs 3× → identical scores; AI advice captured and diffed
Opt-in (creates leads + LLM cost): the same assessment unlocked several times with e2e+<timestamp>@turma.io. Scores/benchmarks must be identical; the AI-written report sections are captured, diffed, and similarity-scored in runs/report-consistency-report.json.
|
PASS | 401.7s | 20 Jul 2026, 11:06 | report-consistency.spec.ts:118 |
| Test and what it checks | Result | Took | Last run | Where |
|---|---|---|---|---|
|
results page renders scores consistent with /api/score
The scores displayed on the results page match the values the scoring API actually returned, catching UI/backend drift.
|
PASS | 9.9s | 20 Jul 2026, 11:06 | results-page.spec.ts:5 |
|
report copy has no templating defects
Report text is free of templating defects (duplicated words, strongest=weakest, raw unrounded floats, {{placeholders}}). Currently red-flagged: guards 3 known bugs.
Error: duplicated word "your your"
expect(received).not.toContain(expected) // indexOf
Expected substring: not "your your"
Received string: "your ai maturity assessment
here's how your organisation scores across 8 key dimensions
shadow ai
usage policies
staff training
accountability
risk management
data governance
tool sprawl
strategic alignment
0
1
2
3
4
5
you
industry benchmark
shadow
|
KNOWN BUG | 12.7s | 20 Jul 2026, 11:06 | results-page.spec.ts:28 |
| Test and what it checks | Result | Took | Last run | Where |
|---|---|---|---|---|
|
random sweep: random-seed-2026
Reproducible pseudo-random persona: random org profile and random answer to all 33 questions (fixed seed). Verifies the wizard never breaks on unusual combinations and the score matches the frozen baseline. Full answer list in the scenario log below.
|
PASS | 16.6s | 20 Jul 2026, 11:06 | random-scenarios.spec.ts:15 |
|
random sweep: random-seed-2027
Reproducible pseudo-random persona: random org profile and random answer to all 33 questions (fixed seed). Verifies the wizard never breaks on unusual combinations and the score matches the frozen baseline. Full answer list in the scenario log below.
|
PASS | 12.7s | 20 Jul 2026, 11:06 | random-scenarios.spec.ts:15 |
|
random sweep: random-seed-2028
Reproducible pseudo-random persona: random org profile and random answer to all 33 questions (fixed seed). Verifies the wizard never breaks on unusual combinations and the score matches the frozen baseline. Full answer list in the scenario log below.
|
PASS | 11.9s | 20 Jul 2026, 11:06 | random-scenarios.spec.ts:15 |
|
random sweep: random-seed-2029
Reproducible pseudo-random persona: random org profile and random answer to all 33 questions (fixed seed). Verifies the wizard never breaks on unusual combinations and the score matches the frozen baseline. Full answer list in the scenario log below.
|
PASS | 12.9s | 20 Jul 2026, 11:07 | random-scenarios.spec.ts:15 |
|
random sweep: random-seed-2030
Reproducible pseudo-random persona: random org profile and random answer to all 33 questions (fixed seed). Verifies the wizard never breaks on unusual combinations and the score matches the frozen baseline. Full answer list in the scenario log below.
|
PASS | 13.0s | 20 Jul 2026, 11:07 | random-scenarios.spec.ts:15 |
|
random sweep: random-seed-2031
Reproducible pseudo-random persona: random org profile and random answer to all 33 questions (fixed seed). Verifies the wizard never breaks on unusual combinations and the score matches the frozen baseline. Full answer list in the scenario log below.
|
PASS | 13.2s | 20 Jul 2026, 11:07 | random-scenarios.spec.ts:15 |
|
random sweep: random-seed-2032
Reproducible pseudo-random persona: random org profile and random answer to all 33 questions (fixed seed). Verifies the wizard never breaks on unusual combinations and the score matches the frozen baseline. Full answer list in the scenario log below.
|
PASS | 11.9s | 20 Jul 2026, 11:07 | random-scenarios.spec.ts:15 |
|
random sweep: random-seed-2033
Reproducible pseudo-random persona: random org profile and random answer to all 33 questions (fixed seed). Verifies the wizard never breaks on unusual combinations and the score matches the frozen baseline. Full answer list in the scenario log below.
|
PASS | 13.0s | 20 Jul 2026, 11:07 | random-scenarios.spec.ts:15 |
| Test and what it checks | Result | Took | Last run | Where |
|---|---|---|---|---|
|
direct navigation to /results without an assessment redirects to /assess
Jumping straight to /results without doing an assessment must redirect to /assess, not crash or leak an empty report.
|
PASS | 7.1s | 20 Jul 2026, 11:06 | edge-cases.spec.ts:7 |
|
page refresh mid-flow preserves answers (auto-save claim)
The UI claims "Your answers are saved automatically". Refreshing at step 2 should restore progress. It does not: everything is lost (known defect #4).
Error: expect(locator).toBeVisible() failed
Locator: getByRole('heading', { name: 'AI usage' })
Expected: visible
Timeout: 10000ms
Error: element(s) not found
Call log:
- Expect "toBeVisible" with timeout 10000ms
- waiting for getByRole('heading', { name: 'AI usage' })
|
KNOWN BUG | 15.5s | 20 Jul 2026, 11:06 | edge-cases.spec.ts:13 |
|
double-clicking "See Your Results" does not create duplicate score submissions
Hammering "See Your Results" 3× must produce exactly one score submission, not duplicates.
|
PASS | 8.9s | 20 Jul 2026, 11:06 | edge-cases.spec.ts:38 |
|
changing an answer counts the final choice, not the first
Pick the worst answer, then change to the best. The final choice must be what counts, verified by hitting a perfect score.
|
PASS | 13.6s | 20 Jul 2026, 11:06 | edge-cases.spec.ts:62 |
|
Back button returns to previous section with answers intact
Going back one step keeps the answers already given (Continue stays unlocked without re-answering).
|
PASS | 5.7s | 20 Jul 2026, 11:07 | edge-cases.spec.ts:106 |
|
backend rejects malformed score submissions
Firing garbage payloads directly at the scoring API returns clean 400 errors, never a 500 crash.
|
PASS | 395ms | 20 Jul 2026, 11:07 | edge-cases.spec.ts:131 |
|
continue stays disabled until every dropdown is filled
With only 3 of 4 profile dropdowns filled, Continue must remain locked.
|
PASS | 2.8s | 20 Jul 2026, 11:07 | edge-cases.spec.ts:143 |
|
full assessment completes on a small phone screen
The entire 33-question assessment is completable on a 375px iPhone-size screen.
|
PASS | 16.3s | 20 Jul 2026, 11:07 | edge-cases.spec.ts:160 |
Each row is one complete assessment run. Expand it to see the full organisation profile, every question, the exact answer clicked, and the scores returned. Sorted by overall score. Same data on disk under runs/.
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | No company data is used with AI tools |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Clearly classified and documented for staff |
| G04 | How visible is AI / LLM use across your organisation today? | High visibility - we know which teams and tools are in use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 0-2 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | Clear rules with examples, prohibited uses, and escalation points |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Mandatory training completed by most relevant staff |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Required and consistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Explicitly prohibited and enforced |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Yes - formal discovery exercise completed in the last 12 months |
| G08 | Do you have a written AI usage policy for employees and contractors? | Yes - published, current, and in use |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Completion and acceptance are clearly tracked and reportable |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Yes - named owner with defined responsibilities |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Yes - both permitted and prohibited use cases are defined with examples |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Yes - formal pathway with defined criteria and sign-off |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Yes - formal review for all automated decision use cases |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Yes - documented escalation path with named contacts |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Yes - access revocation is part of offboarding |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Yes - formal assessment for relevant use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Clear reporting path, owner, and response process |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Formal due diligence and approval is required |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Yes - clear channel with named owner and response process |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We actively review embedded AI features in core tools and communicate approved use |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Clearly defined with examples and communicated to staff |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Yes - important uses are documented with clear review or sign-off records |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | There is a defined refresh process with targeted updates and tracking |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Very clearly - approved tools are known and alternatives are restricted |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | On a defined cycle and when material changes occur |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | High - clients, insurers, partners, or regulators already expect evidence |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Highly likely and commercially important |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Scale AI with clear governance and control |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Yes - formal assurance obtained from vendors |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Confidently, with clear policies, controls, and evidence |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Consistently captured, reviewed, and fed back into controls or training |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | No company data is used with AI tools |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Clearly classified and documented for staff |
| G04 | How visible is AI / LLM use across your organisation today? | High visibility - we know which teams and tools are in use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 0-2 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | Clear rules with examples, prohibited uses, and escalation points |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Mandatory training completed by most relevant staff |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Required and consistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Explicitly prohibited and enforced |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Yes - formal discovery exercise completed in the last 12 months |
| G08 | Do you have a written AI usage policy for employees and contractors? | Yes - published, current, and in use |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Completion and acceptance are clearly tracked and reportable |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Yes - named owner with defined responsibilities |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Yes - both permitted and prohibited use cases are defined with examples |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Yes - formal pathway with defined criteria and sign-off |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Yes - formal review for all automated decision use cases |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Yes - documented escalation path with named contacts |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Yes - access revocation is part of offboarding |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Yes - formal assessment for relevant use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Clear reporting path, owner, and response process |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Formal due diligence and approval is required |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Yes - clear channel with named owner and response process |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We actively review embedded AI features in core tools and communicate approved use |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Clearly defined with examples and communicated to staff |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Yes - important uses are documented with clear review or sign-off records |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | There is a defined refresh process with targeted updates and tracking |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Very clearly - approved tools are known and alternatives are restricted |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | On a defined cycle and when material changes occur |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | High - clients, insurers, partners, or regulators already expect evidence |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Highly likely and commercially important |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Scale AI with clear governance and control |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Yes - formal assurance obtained from vendors |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Confidently, with clear policies, controls, and evidence |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Consistently captured, reviewed, and fed back into controls or training |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Discouraged but not formally controlled |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Tracked for some groups or requirements only |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Vendor statements reviewed but not independently verified |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Discouraged but not formally controlled |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Tracked for some groups or requirements only |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Vendor statements reviewed but not independently verified |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Discouraged but not formally controlled |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Tracked for some groups or requirements only |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Vendor statements reviewed but not independently verified |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Discouraged but not formally controlled |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Tracked for some groups or requirements only |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Vendor statements reviewed but not independently verified |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Discouraged but not formally controlled |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Tracked for some groups or requirements only |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Vendor statements reviewed but not independently verified |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Discouraged but not formally controlled |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Tracked for some groups or requirements only |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Vendor statements reviewed but not independently verified |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Discouraged but not formally controlled |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Tracked for some groups or requirements only |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Vendor statements reviewed but not independently verified |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Discouraged but not formally controlled |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Tracked for some groups or requirements only |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Vendor statements reviewed but not independently verified |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Discouraged but not formally controlled |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Tracked for some groups or requirements only |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Vendor statements reviewed but not independently verified |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Regulated, sensitive, or client-critical data is used |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Clearly classified and documented for staff |
| G04 | How visible is AI / LLM use across your organisation today? | Moderate visibility - we know the main tools but not all use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | Mostly verbal or informal guidance |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Mandatory training completed by most relevant staff |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Expected but inconsistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Common practice or unknown |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Yes - formal discovery exercise completed in the last 12 months |
| G08 | Do you have a written AI usage policy for employees and contractors? | Covered indirectly in other policies only |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Cannot evidence this reliably |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Yes - named owner with defined responsibilities |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | General principles only with no specific use case guidance |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Unknown |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Yes - formal review for all automated decision use cases |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Yes - documented escalation path with named contacts |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Informal judgement only |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Informal escalation only |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Assessed for major tools only |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Yes - clear channel with named owner and response process |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Yes - important uses are documented with clear review or sign-off records |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates are usually communicated, but not always tracked |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Mostly clear, but some grey areas remain |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed only when issues arise |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Unlikely or not considered |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Scale AI with clear governance and control |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Yes - formal assurance obtained from vendors |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Handled case by case with little structured follow-up |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | Low visibility - some usage is likely outside oversight |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 6-10 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | Clear rules with examples, prohibited uses, and escalation points |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Mandatory training completed by most relevant staff |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Only in sensitive cases |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Common practice or unknown |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Yes - published, current, and in use |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Completion and acceptance are clearly tracked and reportable |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Informal ownership only |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Yes - formal pathway with defined criteria and sign-off |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Yes - formal review for all automated decision use cases |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | No assessment or unknown |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Informal escalation only |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Formal due diligence and approval is required |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Yes - clear channel with named owner and response process |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We know the main embedded AI features, but review is not consistent |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Not defined or not understood |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | No consistent logging or review trail exists |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | No clear refresh process exists |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | There is little distinction in practice |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Assumed from general reputation or market position |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | We would struggle to explain or evidence it |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | No company data is used with AI tools |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | High visibility - we know which teams and tools are in use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 0-2 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | No clear review requirement |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Common practice or unknown |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Never formally assessed |
| G08 | Do you have a written AI usage policy for employees and contractors? | Covered indirectly in other policies only |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Evidence is manual or incomplete |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Informal ownership only |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Yes - both permitted and prohibited use cases are defined with examples |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Yes - formal review for all automated decision use cases |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Yes - access revocation is part of offboarding |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Clear reporting path, owner, and response process |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | No due diligence or unknown |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We have little or no visibility of embedded AI features |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Not defined or not understood |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | No consistent logging or review trail exists |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates happen irregularly or rely on managers passing them on |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | There is little distinction in practice |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed only when issues arise |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Possible but not yet material |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Yes - formal assurance obtained from vendors |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Handled case by case with little structured follow-up |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Regulated, sensitive, or client-critical data is used |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Informal guidance exists but is not structured |
| G04 | How visible is AI / LLM use across your organisation today? | High visibility - we know which teams and tools are in use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | Training delivered to some teams only |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | No clear review requirement |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Not addressed in policy |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | No exercise conducted or unknown |
| G08 | Do you have a written AI usage policy for employees and contractors? | Covered indirectly in other policies only |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Cannot evidence this reliably |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Yes - both permitted and prohibited use cases are defined with examples |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | No pathway - teams adopt as needed |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Unknown |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Escalation is unclear or situational |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Unknown |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Informal escalation only |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Formal due diligence and approval is required |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Yes - clear channel with named owner and response process |
| G105 | How aware are you of AI features already embedded in software your business already uses? | Awareness depends on individual teams or vendors telling us |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Handled informally through general data policies only |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Logging is informal or left to individual judgment |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | There is a defined refresh process with targeted updates and tracking |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Very clearly - approved tools are known and alternatives are restricted |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed periodically, but not to a fixed cadence |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | High - clients, insurers, partners, or regulators already expect evidence |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Scale AI with clear governance and control |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Assumed from general reputation or market position |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | No company data is used with AI tools |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Not classified or not understood |
| G04 | How visible is AI / LLM use across your organisation today? | High visibility - we know which teams and tools are in use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | General principles with some examples |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | No training or not sure |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Required and consistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Explicitly prohibited and enforced |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Never formally assessed |
| G08 | Do you have a written AI usage policy for employees and contractors? | Yes - published, current, and in use |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Cannot evidence this reliably |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | No owner or unknown |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Yes - both permitted and prohibited use cases are defined with examples |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Informal route through IT or line management |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Yes - formal review for all automated decision use cases |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | No escalation path or unknown |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Informal and inconsistent |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | No assessment or unknown |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | No process or unknown |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Formal due diligence and approval is required |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | No clear route but could escalate generally |
| G105 | How aware are you of AI features already embedded in software your business already uses? | Awareness depends on individual teams or vendors telling us |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Defined at a high level, but examples or clarity are limited |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | No consistent logging or review trail exists |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | No clear refresh process exists |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Very clearly - approved tools are known and alternatives are restricted |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | On a defined cycle and when material changes occur |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | No clear pressure currently |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Highly likely and commercially important |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Scale AI with clear governance and control |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Not assessed or unknown |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Reasonably well, but some areas would need strengthening |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Rarely captured or not used to improve governance |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | No company data is used with AI tools |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Not classified or not understood |
| G04 | How visible is AI / LLM use across your organisation today? | High visibility - we know which teams and tools are in use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 11+ tools or the total is unknown |
| G09 | How practical is your AI guidance on what staff can and cannot do? | Clear rules with examples, prohibited uses, and escalation points |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | No training or not sure |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Required and consistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Common practice or unknown |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Yes - formal discovery exercise completed in the last 12 months |
| G08 | Do you have a written AI usage policy for employees and contractors? | No policy or not sure |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Completion and acceptance are clearly tracked and reportable |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | No owner or unknown |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Yes - both permitted and prohibited use cases are defined with examples |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Unknown |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Yes - formal review for all automated decision use cases |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | No escalation path or unknown |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Yes - access revocation is part of offboarding |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | No assessment or unknown |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Clear reporting path, owner, and response process |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | No due diligence or unknown |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Yes - clear channel with named owner and response process |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We have little or no visibility of embedded AI features |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Clearly defined with examples and communicated to staff |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | No consistent logging or review trail exists |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | There is a defined refresh process with targeted updates and tracking |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | There is little distinction in practice |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | On a defined cycle and when material changes occur |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | No clear pressure currently |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Highly likely and commercially important |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | No agreed direction yet |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Yes - formal assurance obtained from vendors |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | We would struggle to explain or evidence it |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Consistently captured, reviewed, and fed back into controls or training |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | No company data is used with AI tools |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Partly classified for some teams or data types |
| G04 | How visible is AI / LLM use across your organisation today? | High visibility - we know which teams and tools are in use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | Mostly verbal or informal guidance |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | No training or not sure |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Only in sensitive cases |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Common practice or unknown |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | No policy or not sure |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Cannot evidence this reliably |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Shared ownership across a known group |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | Prohibited uses are listed but permitted uses are unclear |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Yes - formal pathway with defined criteria and sign-off |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Yes - formal review for all automated decision use cases |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Known informally across teams |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Generally handled through IT offboarding but not AI-specific |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Informal escalation only |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Formal due diligence and approval is required |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | Awareness depends on individual teams or vendors telling us |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Not defined or not understood |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | No clear refresh process exists |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | There is little distinction in practice |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | No formal review process exists |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | No clear pressure currently |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Unlikely or not considered |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Experiment first and address governance later |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Yes - formal assurance obtained from vendors |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Confidently, with clear policies, controls, and evidence |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Regulated, sensitive, or client-critical data is used |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Not classified or not understood |
| G04 | How visible is AI / LLM use across your organisation today? | Low visibility - some usage is likely outside oversight |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 0-2 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | No meaningful guidance for day-to-day use |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | No training or not sure |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Required and consistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Not addressed in policy |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | No exercise conducted or unknown |
| G08 | Do you have a written AI usage policy for employees and contractors? | Yes - published, current, and in use |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Evidence is manual or incomplete |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | Informal ownership only |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | No policy or unknown |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Yes - formal pathway with defined criteria and sign-off |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Review required for higher-impact decisions only |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | Escalation is unclear or situational |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Informal and inconsistent |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Informal judgement only |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Clear reporting path, owner, and response process |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | Formal due diligence and approval is required |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | Awareness depends on individual teams or vendors telling us |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Clearly defined with examples and communicated to staff |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Some are logged, but only for certain teams or use cases |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | Updates happen irregularly or rely on managers passing them on |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | Teams make their own judgment in many cases |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | Reviewed only when issues arise |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Moderate - expectations are emerging and increasing |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Possible but not yet material |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | No agreed direction yet |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Assumed from general reputation or market position |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | We would struggle to explain or evidence it |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Handled case by case with little structured follow-up |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Internal business data only, not personal or client-sensitive |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Not classified or not understood |
| G04 | How visible is AI / LLM use across your organisation today? | High visibility - we know which teams and tools are in use |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 3-5 known tools or features |
| G09 | How practical is your AI guidance on what staff can and cannot do? | Mostly verbal or informal guidance |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | No training or not sure |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | Required and consistently applied |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Common practice or unknown |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | Informal checks or manager-led enquiries only |
| G08 | Do you have a written AI usage policy for employees and contractors? | Drafted or partly rolled out |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Cannot evidence this reliably |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | No owner or unknown |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | General principles only with no specific use case guidance |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Yes - formal pathway with defined criteria and sign-off |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Unknown |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | No escalation path or unknown |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Informal and inconsistent |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | Sometimes for higher-risk use cases |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | Known escalation route but limited process detail |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | No due diligence or unknown |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | Informal routes exist through line management |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We actively review embedded AI features in core tools and communicate approved use |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Not defined or not understood |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | Yes - important uses are documented with clear review or sign-off records |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | There is a defined refresh process with targeted updates and tracking |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | There is little distinction in practice |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | No formal review process exists |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | Low today but likely to grow |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Likely in some situations |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | Expand selectively while governance matures |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Assumed from general reputation or market position |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | Only at a high level - evidence and detail are limited |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Usually captured when significant, but feedback loops are limited |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Regulated, sensitive, or client-critical data is used |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Not classified or not understood |
| G04 | How visible is AI / LLM use across your organisation today? | No meaningful visibility or inventory |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 11+ tools or the total is unknown |
| G09 | How practical is your AI guidance on what staff can and cannot do? | No meaningful guidance for day-to-day use |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | No training or not sure |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | No clear review requirement |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Common practice or unknown |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | No exercise conducted or unknown |
| G08 | Do you have a written AI usage policy for employees and contractors? | No policy or not sure |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Cannot evidence this reliably |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | No owner or unknown |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | No policy or unknown |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Unknown |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Unknown |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | No escalation path or unknown |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Unknown |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | No assessment or unknown |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | No process or unknown |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | No due diligence or unknown |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | No mechanism or unknown |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We have little or no visibility of embedded AI features |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Not defined or not understood |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | No consistent logging or review trail exists |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | No clear refresh process exists |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | There is little distinction in practice |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | No formal review process exists |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | No clear pressure currently |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Unlikely or not considered |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | No agreed direction yet |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Not assessed or unknown |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | We would struggle to explain or evidence it |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Rarely captured or not used to improve governance |
| Shadow AI | |
| Usage Policies | |
| Staff Training | |
| Accountability | |
| Risk Management | |
| Data Governance | |
| Tool Sprawl | |
| Strategic Alignment |
| Code | Question | Answer chosen |
|---|---|---|
| G01 | What level of business data is currently being used with AI / LLM tools in your organisation? | Regulated, sensitive, or client-critical data is used |
| G02 | How clearly is sensitive, confidential, or regulated data classified before staff use AI tools? | Not classified or not understood |
| G04 | How visible is AI / LLM use across your organisation today? | No meaningful visibility or inventory |
| G06 | How many separate AI-enabled tools, copilots, or AI features are being used across the business? | 11+ tools or the total is unknown |
| G09 | How practical is your AI guidance on what staff can and cannot do? | No meaningful guidance for day-to-day use |
| G12 | How much AI-specific training have relevant employees completed in the last 12 months? | No training or not sure |
| G18 | How strong is human review of AI-generated outputs before external use or important decisions? | No clear review requirement |
| G31 | Do employees use personal devices or personal accounts to access AI tools for work purposes? | Common practice or unknown |
| G32 | Has your organisation conducted any exercise to discover AI tools being used outside formal approval? | No exercise conducted or unknown |
| G08 | Do you have a written AI usage policy for employees and contractors? | No policy or not sure |
| G14 | How well can you evidence who has completed required AI training and accepted related policies? | Cannot evidence this reliably |
| G15 | Is there a named owner for AI governance, oversight, or responsible use? | No owner or unknown |
| G37 | Does your AI policy define acceptable use cases as well as prohibited ones? | No policy or unknown |
| G87 | Is there a defined approval pathway for new AI tools before they are adopted by teams? | Unknown |
| G98 | Is there a defined process for reviewing and approving AI use cases that involve automated or semi-automated decisions? | Unknown |
| G44 | Is there a defined escalation path when an AI-related concern, incident, or uncertainty arises? | No escalation path or unknown |
| G92 | Is there a defined process for managing access rights when an employee with AI tool access leaves the business? | Unknown |
| G17 | Are AI use cases assessed for risk before going live or being scaled? | No assessment or unknown |
| G19 | How prepared are you to report or investigate an AI-related incident, error, or data leak? | No process or unknown |
| G20 | How do you assess third-party AI vendors or tools before employees use them? | No due diligence or unknown |
| G35 | Do you have a mechanism for employees to report concerns about AI use or request guidance? | No mechanism or unknown |
| G105 | How aware are you of AI features already embedded in software your business already uses? | We have little or no visibility of embedded AI features |
| G106 | How clearly does your organisation define what data must never be entered into public or unapproved AI tools? | Not defined or not understood |
| G107 | Are important AI-assisted outputs or decisions logged so they can be reviewed later if challenged? | No consistent logging or review trail exists |
| G108 | When AI-related policies, tools, or regulations change, how is staff training and guidance updated? | No clear refresh process exists |
| G111 | How clearly does your organisation separate approved enterprise AI tools from personal, free-tier, or unapproved tools? | There is little distinction in practice |
| G112 | How often are approved AI tools, controls, and related policies formally reviewed and updated? | No formal review process exists |
| G22 | What level of external pressure do you face to demonstrate responsible AI use? | No clear pressure currently |
| G23 | How likely is AI governance maturity to affect tendering, client trust, insurer confidence, or supplier relationships in the next 12 months? | Unlikely or not considered |
| G24 | What best describes current leadership ambition for AI over the next 12 months? | No agreed direction yet |
| G100 | Do you have assurance that AI tools used by your business comply with UK data protection requirements? | Not assessed or unknown |
| G109 | How confidently could your business explain its AI governance approach to a client, insurer, or regulator today? | We would struggle to explain or evidence it |
| G110 | How consistently are AI incidents, near misses, or unusual outputs captured and used to improve controls? | Rarely captured or not used to improve governance |