Skip to content

Free tool

Where does your board stand on AI accountability?

Thirty-three questions across five areas of AI accountability: awareness at the top, honest diagnosis, guardrails in place, value showing up, and foundations and impact. Answer them with your board, see where you stand and what to do next, and download a one-page summary to take into the room. A starting point, not a maturity assessment.

Your one-page summary is emailed to you and shared with the Governance AI team to prepare for your call.

0 / 33 YesAnswer to see your starting point
1

Awareness at the top

Do your directors understand what they're being asked to govern? Knowledge, language, ownership.

0/7

Individual directors have completed a short AI awareness check.

A quick quiz showing what each director understands and where confidence is low.

Individual directors have completed a short AI awareness check.

The board has had an AI maturity snapshot, even informal.

A one-page view of strengths and gaps across people, process, technology and risk.

The board has had an AI maturity snapshot, even informal.

You have identified your main AI risks.

Data leakage, inaccurate outputs, bias, cyber attack, supplier failure, with owners.

You have identified your main AI risks.

There is a named AI lead at executive or board level.

Someone accountable for AI and reporting to the board. Not the IT director by default.

There is a named AI lead at executive or board level.

Your leaders know the basics of current rules and standards.

Direction of travel on the EU AI Act, UK guidance and ISO 42001. No need to be lawyers.

Your leaders know the basics of current rules and standards.

The board has the skills and mindset to guide AI-driven change.

Change experience plus the confidence to challenge assumptions and ask hard questions.

The board has the skills and mindset to guide AI-driven change.

The chair sets the tone on AI proactively, not reactively.

Starts conversations before incidents force them, and invites outside perspectives in.

The chair sets the tone on AI proactively, not reactively.

If you don't: Boards approving AI strategy they can't interrogate. Decisions deferred to the CIO or a vendor. When something goes wrong, no one has standing to ask the hard questions.

Where this leads: Step 1, Governance AI Wake-Up Call Workshop. Builds shared language, frames responsibilities, runs a live risk assessment against your own context.

2

Honest diagnosis

You can't fix what you can't see. An objective picture of where you actually are, beyond gut feel.

0/7

Each core function has been asked how it uses or wants to use AI.

A light survey across Finance, HR, Customer Service, Sales, IT, Legal and Operations.

Each core function has been asked how it uses or wants to use AI.

Those inputs have been pulled into a single enterprise view.

One summary of common needs and priorities, not a stack of departmental memos.

Those inputs have been pulled into a single enterprise view.

You have in-house help for AI and automation, even part-time.

A named person who can run pilots and support colleagues. Not a quarterly consultant.

You have in-house help for AI and automation, even part-time.

There is a simple AI roadmap with milestones and owners.

A 3 to 6 month plan, names against tasks, and a date for board review.

There is a simple AI roadmap with milestones and owners.

You have compared yourself against a standard or peer benchmark.

An external benchmark or assessment. Self-belief is not a benchmark.

You have compared yourself against a standard or peer benchmark.

The board has the right information to oversee AI decisions.

Board papers have depth on AI; all functions feed in, not just IT.

The board has the right information to oversee AI decisions.

You are measuring the right things on AI.

Dashboards reflect outcomes and context, not just activity.

You are measuring the right things on AI.

If you don't: Assumptions about capability that don't survive contact with reality. You can't answer the question a regulator or insurer will ask: what AI is in use here, who owns it, and what could go wrong?

Where this leads: Steps 2 and 3, GovernIQ™ Diagnostic and Benchmarking. Confidential self-assessment per director, plus organisation-wide scoring against peers and standards.

3

Guardrails in place

The basics written down, owned, and known to staff. Without these, every AI conversation starts from scratch.

0/6

There is an AI Steering Group with terms of reference and a meeting rhythm.

A small cross-functional group with clear responsibilities and a line to the board.

There is an AI Steering Group with terms of reference and a meeting rhythm.

There is an AI strategy or charter approved by leadership.

Aims, risk approach, and where you will and won't use AI. Signed off, not just drafted.

There is an AI strategy or charter approved by leadership.

You have an AI usage policy people can find and follow.

Simple rules on tools, data handling and transparency. A living document, not a buried PDF.

You have an AI usage policy people can find and follow.

You keep a register of AI tools and use cases.

A live list of what's in use, why, what data is involved, who owns it, and what's been checked.

You keep a register of AI tools and use cases.

AI training is available and being taken up.

Short, practical sessions on safe use and role-specific skills, for staff and leaders.

AI training is available and being taken up.

There is clarity on roles, responsibilities and mandates for AI.

Oversight explicitly assigned across committees and board; AI is on the agenda.

There is clarity on roles, responsibilities and mandates for AI.

If you don't: Shadow AI everywhere. Staff feeding sensitive data into public chatbots. No way to show due diligence to clients or insurers. The board hears about issues weeks late.

Where this leads: Step 4, Governance AI Playbook Workshop. Co-develop your AI Code, policies, roles, register and escalation paths, mapped to ISO 42001 and the EU AI Act.

4

Value showing up

Governance without value is theatre. Is AI doing useful work yet, and are you set up to keep going?

0/7

You use, or pilot, a chatbot for staff or customers.

An assistant that answers common questions and reduces repetitive load.

You use, or pilot, a chatbot for staff or customers.

You use, or pilot, voice assistants or phone agents.

Tools that take or route calls, or create call summaries automatically.

You use, or pilot, voice assistants or phone agents.

You have automated at least one routine business process.

Software that moves information, drafts documents, or triggers approvals without re-keying.

You have automated at least one routine business process.

Staff routinely use AI assistants for email or knowledge work.

Drafting, summarising, meeting notes, first-cut reports, with permission and policy behind it.

Staff routinely use AI assistants for email or knowledge work.

Teams use research or report assistants for data and insights.

Tools that pull data together and produce first drafts for human review.

Teams use research or report assistants for data and insights.

You have run a low-risk, high-impact AI pilot to a measurable result.

An experiment that saved time or cost without touching sensitive data, with numbers.

You have run a low-risk, high-impact AI pilot to a measurable result.

The board itself uses new technology to improve how it works.

AI in its own meetings and papers, and open to learning from experimentation.

The board itself uses new technology to improve how it works.

If you don't: AI fatigue. Lots of demos, no traction. Competitors move ahead while teams disengage. Leadership starts asking whether the investment was worth it, just as the curve is about to bend.

Where this leads: Step 5, Thematic AI Workshops and Use Case Tasters. Hands-on sessions that ship at least one working pilot per priority area, governed by the Playbook.

5

Foundations and impact

Data, security, suppliers, and the question that matters: is the board enabling adaptation, or holding it back?

0/6

You have a basic data and cyber picture for AI.

Where key data lives, who can access it, known risks, and whether DPIAs are done for new tools.

You have a basic data and cyber picture for AI.

Your risk framework covers AI-specific risks.

Register and appetite reflect bias, model drift, supplier failure, prompt injection, data poisoning.

Your risk framework covers AI-specific risks.

Procurement asks meaningful AI questions of new vendors.

Due diligence covers AI claims, training data, model provenance, security testing, incident history.

Procurement asks meaningful AI questions of new vendors.

The board understands how you create value in an AI-powered world.

Shared view of the business model and competitive advantage, and how AI helps or threatens each.

The board understands how you create value in an AI-powered world.

The board has agreed what success on AI looks like in 2 to 3 years.

Defined success, agreed a path, and discussed how the board's own role will evolve.

The board has agreed what success on AI looks like in 2 to 3 years.

Staff would say the board enables AI adoption, not slows it.

People see clear direction and support, with visible evidence the board listens and adjusts.

Staff would say the board enables AI adoption, not slows it.

If you don't: GDPR and EU AI Act exposure hiding in vendor contracts. AI risk concentrated in suppliers you don't audit. Strategy without measurement, so impact stays anecdotal. The board ends up reactive, not directive.

Where this leads: Step 6, Data and Security Diagnostic, leading into Step 7, Governance AI Quality Mark: formal recognition that you run AI to a standard stakeholders can trust.

Your result

0
Yes
0
In progress
0
No
0/33
Answered

Start of the Journey

Answer all 33 questions and your starting point on the Journey appears here.

Book a 30-minute call

Answer all 33 to download your summary, 33 to go.

How to use it

  • Mark Yes only if you would defend the answer in front of a regulator, an investor or a journalist.
  • In progress is honest, not a hedge: it usually means someone has started but no one has owned it.
  • Bring the completed summary to a 30-minute call. We map it to the Governance AI Journey and scope the right next step.

Find out where your AI exposure sits.

We'll tell you plainly what's worth doing, what isn't, and what a board or regulator will expect to see. No pitch deck.

No obligation · no pitch.