Your board is asking about AI. Is the organization ready for the answer?

Fifty-six checks across the seven areas that decide whether AI helps the business or quietly adds risk. Check what is true today, not what is planned. Your section scores update as you go.

Start the AssessmentWhy It Matters Now

Rather work on paper? Download the Blank PDF (PDF, 12 pages).

Why readiness comes before tools

AI is already in use

Staff use public AI tools whether or not there is a policy, and vendors switch on AI features inside software you already own. The first question is not whether to adopt AI. It is what is already happening.

The data decides the outcome

AI works on the data it can reach. Scattered, duplicated, or poorly permissioned data produces confident wrong answers, and sometimes shows people things they should never see.

Attackers adopted it first

Better phishing, cloned voices, and faked video calls are already used to move money. Readiness includes the controls that stop AI being used against you.

Someone has to own it

Without a named owner, AI decisions happen one team and one tool at a time. With one, the organization can say yes to the useful things quickly and no to the risky ones clearly.

Where AI stands now

AI moved from experiment to priority in a year, usually ahead of the policy that should govern it. In our reviews, the most common exposure is simply having no AI policy or owner, and not knowing it. Four facts set the stage.

#1

priority for state CIOs in 2026 is AI, displacing cybersecurity for the first time in twelve years.

NASCIO, State CIO Top Ten 2026
58%

of organizations report employees using generative AI without restrictions.

Deloitte, via AVANT State of Disruption 2025
$670K

in added breach cost for the 20% of organizations that reported a breach tied to unsanctioned AI tools.

IBM Cost of a Data Breach 2025, via AVANT State of Disruption 2025
1 in 4

malicious breaches studied this year were AI-enabled.

IBM, Cost of a Data Breach 2026

How to use this assessment

Quick and practical. About ten minutes if the inventory exists, longer if it does not, which is itself a finding.

1

Answer for today

Check an item only if it is in place now. Planned, piloting, or partly true stays unchecked.

2

Include everyone

AI use in marketing, finance, and HR counts as much as use in IT. Ask around before you answer.

3

Bring IT and one business leader

Several items are settings IT can confirm; others are questions only the business can answer.

4

Use the result

Your weakest sections are the order to work in, and the start of the plan your board asked for.

Section 1 of 7

Strategy and Ownership

Readiness starts with knowing what AI is for and who is responsible. Without both, adoption happens by accident.

0/ 8
Section 2 of 7

Current Use and Shadow AI

The most common finding is that AI is already in use in more places than anyone knew. This section asks whether you can see it.

0/ 8
Section 3 of 7

Policy and Acceptable Use

A short, clear policy lets people use AI confidently. No policy means every employee decides for themselves what is safe.

0/ 8
Section 4 of 7

Data Readiness

AI is only as good as the data it can reach, and only as safe as the permissions on that data. This is the section most organizations underestimate.

0/ 8
Section 5 of 7

Security, Identity, and Access

AI adds new ways in and new ways to deceive. This section checks the controls that keep AI from becoming the weak point.

0/ 8
Section 6 of 7

Vendors and Embedded AI

Much of your AI exposure arrives through vendors, as features you did not ask for. This section asks whether you know what they do with your data.

0/ 8
Section 7 of 7

People, Training, and Measurement

AI changes how work gets done. Readiness includes the people using it and the evidence that it is working.

0/ 8

See your readiness score

Your total, your readiness band, and where to start in your weakest sections are ready. Tell us where to send the results so you have them for the next leadership or board conversation.

0 of 56 items checked. You can go back and change answers before you submit.

No sales sequence. One email with your results, and Will reviews every submission himself. The newsletter comes only if you leave the box ticked.

Want to turn the score into a plan?

We go through your results with you and turn your weakest sections into a short, ordered plan your leadership can act on. No product to sell; if we ever name a supplier, we tell you in writing whether it pays us before you choose.

Start a Conversation Read: AI Governance Starts Before AI

Sources