Skip to content
FortaRisks
Free report
All toolsAI governance

AI governance assessment

Do you know which AI is used in your company, who approved it and what it sees of your data? Gauge your AI governance in five minutes.

≈ 5 minutes · no sign-up

Banning AI or letting it happen are not policies. Answer the 16 statements below: everything is computed in your browser, and nothing is sent unless you ask for the report by email.

Answer each statement based on your real situation. Your score and priorities appear instantly in your browser. Nothing is sent, unless you then ask for your report by email.

Progress0 / 16 answered

1.Inventory and shadow AI

You keep an up-to-date list of the AI tools and uses in your organization.

You keep an up-to-date list of the AI tools and uses in your organization.

You know which AI tools your teams use without formal approval.

You know which AI tools your teams use without formal approval.

You track AI features that vendors add to the software you already use.

You track AI features that vendors add to the software you already use.

Every AI use has a named business owner.

Every AI use has a named business owner.

2.Decision rights

Someone in leadership answers for AI and its risks.

Someone in leadership answers for AI and its risks.

A short AI acceptable use policy is in force and known to employees.

A short AI acceptable use policy is in force and known to employees.

A request for a new AI tool gets an answer within a known time frame.

A request for a new AI tool gets an answer within a known time frame.

AI uses are tiered by risk, with proportionate requirements.

AI uses are tiered by risk, with proportionate requirements.

3.Data and AI vendors

Employees know which data must never go into a prompt.

Employees know which data must never go into a prompt.

Your vendor contracts state whether your data is used to train a model.

Your vendor contracts state whether your data is used to train a model.

You know where the prompts and outputs of your AI tools are hosted.

You know where the prompts and outputs of your AI tools are hosted.

AI projects touching personal information go through a privacy impact assessment.

AI projects touching personal information go through a privacy impact assessment.

4.Control and proof

You keep an audit trail of AI use (who, which tool, which data, which decision).

You keep an audit trail of AI use (who, which tool, which data, which decision).

Important decisions supported by AI get human review.

Important decisions supported by AI get human review.

Your incident plan covers an AI incident (a leak through a prompt, an agent acting on its own).

Your incident plan covers an AI incident (a leak through a prompt, an agent acting on its own).

Teams using AI have had short, practical training on its risks.

Teams using AI have had short, practical training on its risks.

Answer every statement to reveal your score.

FAQ

What is AI governance?

It is the set of decisions and controls that say which AI is used, by whom, with which data, and who answers for it. It is not just a policy: it can be proven.

Why now?

AI is already in your tools, approved or not. Customers, insurers and prime contractors are starting to ask for proof of control, not a promise.

Isn't banning AI tools enough?

No. A ban moves use to personal accounts you no longer see. A request that gets a fast answer protects better than a ban.

Canada has no AI law: does this apply to me?

Yes. Quebec's Law 25, privacy laws, your contracts and your sector obligations already apply to the AI you use.

Is this assessment a full audit?

No. It is a starting point to gauge your governance and prioritize your actions, not an audit or legal advice.