Skip to content

GOVERNANCE SELF-ASSESSMENT · Checklist

AI Governance Maturity Assessment

Answer 18 plain statements about how AI is run in your business. Get a level for each of six areas, the gaps to close first and a short plan you can hand to the right people.

  • Runs in your browser
  • No sign-in
  • Result before any contact step
Illustrative · Example values
SIX GOVERNANCE AREAS · SHARE OF 9 POINTS EACH · EXAMPLE VALUESINVENTORY · 67%ACCOUNTABILITY · 89%POLICY & CONTROLS · 78%EVIDENCE & RECORDS · 22%RISK REVIEW · 56%MONITORING · 33%50% GAP LINEOVERALL 31 / 54 · 57.41%DEFINED ON POINTS ALONECAP → DEVELOPINGWEAKEST: EVIDENCE & RECORDS
INVENTORYROLESPOLICYEVIDENCERISKMONITORING50% LINE
Overall
31 of 54 points · 57.41% · Defined on points alone
Cap
Evidence & records at Initial → overall level Developing

Six areas, 31 of 54 points. Evidence and records at Initial caps the overall level at Developing.

Most businesses already use AI somewhere: a chat assistant, a feature inside software they pay for, a model a team built. This assessment looks at how well that use is governed. It covers a list of the systems, who owns them, written rules, records, risk review and monitoring.

It is not a survey of whether you are ready to adopt AI. It starts from the AI you already have and asks whether the basics around it are in place. Pick one scope, such as the whole business or one team, and answer for that scope only.

Your inputs · worked out in your browser

0 of 18 answered · empty

Everything is worked out in your browser. Anvaylo does not receive the numbers or answers you enter, and nothing is saved when you leave the page. Use estimates and roles, not names, contract text, customer records or credentials.

Answer for one scope, such as your whole business or one named team. For each statement, choose the answer that is true today. Choose Not sure instead of guessing. This is a check of how AI you already use is governed, not a survey of whether you are ready to adopt AI.

What each answer means

  • In place (3 points)
    It is done and people use it in practice, for all the AI that the statement covers.
  • Partly in place (2 points)
    It exists for some systems or teams, or it is not used the same way every time.
  • Planned (1 point)
    It is decided, with an owner or a date, but it is not done yet.
  • Not in place (0 points)
    Nothing exists yet, or it is only an idea.
  • Not sure (0 points)
    You do not know. It scores 0 and is listed as not assessed.
01 · AI inventory

Knowing which AI systems and AI features your business builds, buys or lets staff use.

1. We keep a list of the AI systems and AI features that we build, buy or let staff use.
2. Each entry on the list says what the system is for, what data it uses and who supplies it.
3. We review the list on a set schedule, and we look for AI tools that staff use without telling us.
02 · Accountability and roles

Who answers for AI use, and who decides when a use raises a concern.

4. A named person or group is accountable for AI governance across the business.
5. Every AI system on the list has a named owner who answers for how it is used.
6. Staff know who decides, and how to escalate, when an AI use raises a concern.
03 · Policy and controls

Written rules for AI use, and working steps that apply those rules.

7. We have a written AI policy or use rule that says what staff may and may not do with AI.
8. The rule limits which data may go into AI tools, for example no personal or confidential data in tools we have not chosen.
9. We have set up controls that apply the rule, such as a list of allowed tools, access limits or human review of important output.
04 · Evidence and records

Records that show how AI systems were assessed, bought and approved.

10. We keep a record of how each important AI system was assessed and who signed it off.
11. For AI that we buy, we keep the supplier documents that we relied on, such as contract terms and test results.
12. We can find these records quickly when someone asks, and we keep them for a set time.
05 · Risk review

Looking at what could go wrong with an AI use before it starts, and again when it changes.

13. We review the risks of an AI use before it starts, including effects on people, privacy, security and wrong output.
14. The depth of the review depends on how much the use could affect people or the business.
15. We review a use again when something important changes, such as new data, a new supplier or a new purpose.
06 · Monitoring and improvement

Checking live AI systems, handling problems and reporting to leaders.

16. We check live AI systems on a regular basis, for example output quality, errors and complaints.
17. Staff have a way to report AI mistakes or incidents, and we record what was reported and what we did.
18. Leaders get a regular report on AI use and AI risk, and we act on it, for example by changing a rule or retiring a tool.

0 of 18 answered

Waiting for inputs

Your maturity result

Answer all 18 statements to see your level. 18 left. Choose Not sure when you do not know. It is never counted as done.

What you get

  • An overall level and the share of points behind it
  • A bar for each of the six areas, with the gaps listed lowest first
  • The questions you could not answer, kept open instead of counted as done
  • An action plan with an owner role and a date you can fill in
  • An evidence checklist for each weak area, and exports as text, Markdown and CSV

If you accept analytics cookies, we record only which tool was opened, that a result was shown and which export or service link was used. Inputs, answers and results are never part of that record.

Method version 2026-10-14. Review aid from self-reported answers. It is not legal advice, a regulatory classification, a certification or an audit, and it cannot see or test any system.

How it works

There are 18 statements, three for each of six areas: AI inventory, accountability and roles, policy and controls, evidence and records, risk review, and monitoring and improvement. For each statement you choose the answer that is true today: In place, Partly in place, Planned, Not in place or Not sure.

Each answer earns points, and the points are added up for every area and for the whole. The share of the possible points sets the level: Initial, Developing, Defined or Managed. The same rules run for every visitor, and the page prints them so you can check the arithmetic.

One strong area cannot hide a missing one. The overall level can be at most one level above the level of your weakest area. When that limit applies, the result says so and names the area that holds the level down.

Not sure is never treated as a pass. It scores nothing, it is counted apart as not assessed, and each one becomes an open question. If more than one third of your answers are Not sure, no level is shown, because a level built on that many unknowns would mean little.

The plan comes from the gaps, the cap rule and the open questions. You can add an owner role and a target date to each action. Those stay in your browser tab and appear only in the file you download.

Formula and rules

Points, levels, gaps and the cap rule
Answer points: In place 3, Partly in place 2, Planned 1, Not in place 0, Not sure 0.
Not sure also counts as not assessed and becomes an open question.
Possible points: 18 statements x 3 = 54 overall, and 9 for each of the six areas.
Percent = points / possible points x 100, rounded to two decimals.
Level by percent: Initial from 0%, Developing from 25%, Defined from 50%, Managed from 75%.
A percent exactly on a threshold counts as the higher level.
Gap: any area under 50% of its points. Gaps are listed lowest first.
Cap rule: overall level = the lower of the level the points give and one level above the weakest area.
Too many unknowns: more than 6 of the 18 answers marked Not sure gives no level.
Ties for weakest area go to the first area in the order shown on the page.

Assumptions

  • You answer for one scope, such as the whole business or one named team, and you use the same scope each time you repeat the check.
  • Your answers are accurate and up to date. The tool cannot check them.
  • Every statement has the same weight. The six areas are a plain-language grouping, not a copy of any standard or law.
  • In place means it is done and people use it in practice, for all the AI the statement covers.

Worked example

Illustrative worked example · example valuesSample

Take a small team that answers like this. AI inventory: In place, Partly in place, Planned, which is 6 of 9 points or 66.67%. Accountability and roles: In place, In place, Partly in place, 8 of 9 or 88.89%. Policy and controls: In place, Partly in place, Partly in place, 7 of 9 or 77.78%.

Evidence and records: Planned, Planned, Not in place, only 2 of 9 or 22.22%. Risk review: Partly in place, Partly in place, Planned, 5 of 9 or 55.56%. Monitoring and improvement: Partly in place, Planned, Not sure, 3 of 9 or 33.33%.

The total is 6 + 8 + 7 + 2 + 5 + 3 = 31 of 54 points, or 57.41%. On points alone that is Defined. But Evidence and records is the weakest area and sits at Initial, so the overall level can rise only one level above it. The result is Developing. One answer is Not sure, which is under the limit of six, so a level is still shown.

Two areas are under 50%. Evidence and records comes first at 22.22%, then Monitoring and improvement at 33.33%. The open question is whether leaders get a regular report on AI use and AI risk.

Evidence to gather

Records that make the result easier to check and act on:

  • An AI inventory register with purpose, data, supplier and a named owner for each system
  • A RACI chart or role note that names who answers for AI governance and who decides on a concern
  • The current AI use policy or rule, with its owner, version and review date
  • Review and sign-off records, and the supplier documents you relied on, with a note of where they are kept
  • Risk review forms for the AI uses that matter most, and the rule for how deep each review goes
  • Monitoring reports, an incident log and a leadership report on AI use and risk

What it does not do

  • The result comes only from your own answers. The tool does not look at any policy, record, contract or system.
  • Every statement has the same weight. The levels and the cap rule are this tool's own rules, not a standard or a legal test.
  • A level shows how far practices have gone. It does not show that they work, or that any law or contract term is met.

Questions

How is this different from an AI readiness or adoption survey?

A readiness survey asks whether you are prepared to start with AI: goals, data, skills and tools. This assessment asks how well the AI you already use is governed: a list of systems, owners, rules, records, risk review and monitoring. Use a readiness check before you begin, and this one once AI is in use.

Is the result an audit or proof that we meet a law?

No. The result is self-reported. It comes only from your answers, so it is not assurance and not proof of compliance. The tool does not read any policy, record or system, and it does not map to a law or a standard. A qualified person can check whether what you marked as in place holds up.

What happens when I choose Not sure?

It scores 0, the same as Not in place, and it is counted as not assessed. The statement then appears in the list of open questions. If more than 6 of the 18 answers are Not sure, no level is shown. Ask the person who knows and check again.

Why is my level lower than my percent suggests?

The cap rule. The overall level can be at most one level above the level of your weakest area, so a strong area cannot cover for a missing one. The result names the weakest area and the level it limits. Raise that area and the limit lifts.

Who should answer the statements?

A small group works best: the person who owns AI governance, someone from IT or security, and someone from the business. One person answering alone can miss what other teams do. Choose Not sure instead of guessing.

Are my answers saved or sent anywhere?

No. The result is worked out in your browser and nothing you choose is saved or sent. If you accept analytics cookies, we record only that the tool was opened, that a result was shown and which export was used. Reloading the page clears everything.

More governance tools

All governance tools