How ready are you?

1. Do you have a list of every AI tool and model in use, including tools employees chose themselves?

2. Is a named person or board accountable for AI decisions?

3. Does each AI system have a written description of its data, access and human oversight before it goes live?

4. Is there an approval step before an AI system reaches production, with a record of who approved it?

5. Can you say what a failure of your most important AI system could cost the business?

6. Do you have a documented way to quarantine an AI system quickly if something goes wrong?

1. Do you have written security policies (access, encryption, incident response, change management) approved in the last 12 months?

2. Do you know which frameworks your customers or regulators require, such as SOC 2, ISO 27001 or HIPAA?

3. Is every control you rely on assigned to a named owner?

4. Could you show evidence for your key controls (access reviews, change approvals, backups) without a scramble?

5. Have you checked that your controls are designed correctly (a test of design) before an auditor asks?

6. Do you track gaps with owners and dates in one place?