Two ways to find out where you actually stand.

The situation

AI arrived in your business the way it arrives in most — one person tried something useful, it spread, and nobody ever decided it. It works well enough that stopping feels silly, and nobody has had the time to ask what it is actually touching.

What this usually means in practice

• Staff pasting client information into free AI accounts, because it saves twenty minutes and nobody said not to.
• Nobody who can say no to a new tool — not because the authority is disputed, but because it was never assigned.
• No record of which decisions the AI influenced, so a complaint six months from now cannot be traced or defended.

What the assessment checks for you

• Whether one named person owns AI use — and whether they could actually stop a tool if they needed to.
• Whether the people using AI know what they are allowed to use it for.
• Which tools can reach your business and customer data, and whether anyone has a list.
• Whether anything has already gone wrong, and whether anything changed as a result.

What you get

A Readiness score and a Governance score, each in a named maturity band, an inventory prompt of what is actually in use, the findings that matter most for a business your size — and one recommended next step.

The situation

You are used to being inspected, and you are good at it — but the AI question is new and nobody has told you what good looks like yet. The absence of a specific rule is being read, across your sector, as the absence of an obligation.

What this usually means in practice

• An AI note-taker or triage tool processing patient or client information with no completed data protection assessment behind it.
• No named regulator identified, so nobody has read the guidance that already exists for your sector.
• No evidence trail — so if an inspector asks how a specific AI-assisted decision was made, the answer is a description rather than a record.

What the assessment checks for you

• Whether you can name the regulator that would take an interest, and whether anyone has read their guidance.
• Whether AI tools touching personal data have been assessed against UK GDPR — formally, informally, or not at all.
• Whether a person always reviews or can override AI output before it takes effect.
• Whether an AI-assisted decision could be evidenced to a regulator, not just described.

What you get

Both scores and bands, findings framed against what your named regulator actually expects, the gaps most likely to be asked about at inspection — and one recommended next step.

The situation

You are past the point where one person could list what is in use, and several departments have bought their own tools without anybody joining it up. The problem is no longer whether to use AI — it is that nobody can currently answer what you are running, on whose data, and with whose approval.

What this usually means in practice

• Shadow AI — free accounts and personal logins that never appear on an invoice, so procurement has no visibility of them at all.
• Tools that update themselves, changing behaviour in production with nobody checking the impact before it takes effect.
• A real operational dependency on at least one tool that has no documented fallback if it stops working tomorrow.

What the assessment checks for you

• Whether a maintained inventory of AI tools exists — including the free and personal ones.
• Whether there is a defined approval step before a new tool starts being used, and whether a record is kept.
• Whether tool changes are impact-checked before they go live.
• What AI actually costs you, all in, and whether a business number was ever named for it to move.

What you get

Both scores and bands, the inventory and approval gaps written up in a form you can take to a management meeting, the areas where findings cluster — and one recommended next step.

The situation

A questionnaire has landed, and it asks things nobody in the business has ever been asked before. You are not looking for a maturity journey — you are looking for defensible answers, and a date by which you can give them.

What this usually means in practice

• Questions that assume a written AI policy exists, when what exists is a shared understanding nobody has put on paper.
• A request to evidence how a specific AI-assisted decision was made — where the honest answer today is that you could describe it, not show it.
• Supplier terms accepted without close reading, so how your data is handled by the AI vendors you buy from is genuinely unknown.

What the assessment checks for you

• Whether an AI-assisted decision could be produced as a record on request.
• Whether a written, current, followed AI policy exists — and whether risk appetite has ever been decided rather than discussed.
• How your AI suppliers handle your data, and whether that is covered in a contract.
• Whether AI use is reported to a board, owners or a management meeting on any regular basis.

What you get

Both scores and bands, the specific gaps a diligence questionnaire will land on, an honest read on which answers you can already evidence — and one recommended next step.

The situation

You have decided this needs an owner, a structure and a calendar rather than a one-off piece of work. The open question is not whether to build the function, but how much function your organisation can actually carry — and appointing too much, too early, is as damaging as appointing nobody.

What this usually means in practice

• Governance work that starts as a project and quietly stops when the person driving it moves on to something else.
• A policy written and circulated, but no approval gate behind it — so the policy describes a process nobody has to follow.
• Certification named as the goal before anyone has established the baseline it would be measured from.

What the assessment checks for you

• All eight dimensions, across both scores — this is the group that needs the whole picture, not a slice of it.
• Whether ownership is written into somebody’s role, or merely understood.
• Whether there is budget or leadership backing for governance work in the next twelve months.
• Whether incidents and near misses lead to a recorded change, which is the difference between a function and a filing cabinet.

What you get

Both scores and bands across all eight dimensions, a maturity profile you can baseline against later, the sequence the work should happen in — and one recommended next step.