Grounded in the NIST AI Risk Management Framework

AI Governance Debt Assessment

Score your AI governance maturity

5 questions, about 2 minutes. Governance Debt is the gap between the questions your board should be able to ask about your AI systems and the questions you can actually answer, on demand, with evidence. Score each dimension honestly: the questions ask what you can prove, not what you intend to do.

Built for

CISOs, GRC and compliance directors, risk managers, and founders who now own AI governance on top of everything else, at any company deploying or building on AI, regardless of industry or EU exposure.

Best used when

You need a fast, honest read before a board question, a customer security review, or a budget conversation, or you just want a quarterly gut-check on where your program actually stands.

1 · Policy Debt

Regulation moves faster than most policy review cycles. A policy that was correct in January can be quietly out of date by October without anyone noticing.

Has your AI governance policy been reviewed against your current regulatory obligations in the last twelve months?

2 · Ownership Debt

Governance infrastructure, registries, dashboards, risk councils, doesn't help if no specific person is accountable for a given system's outcomes.

For your highest-risk AI system, can you name the accountable individual right now, and could they explain why they're accountable for it?

3 · Visibility Debt

You can't govern what you can't see, and most organizations significantly underestimate their own AI footprint, especially AI embedded inside tools they already pay for.

Do you have a current, complete inventory of every AI system in use, including vendor-embedded AI, and when was it last verified?

4 · Evidence Debt

A policy that says a control should operate isn't the same as being able to prove, on demand, that it actually did.

If an auditor asked for proof that a specific AI control operated last month, could you produce it within a day, or would someone need to reconstruct it?

5 · Process Debt

Manual tracking creates "audit sprints": intense activity right before a review, followed by months of neglect where the same gaps quietly reopen.

Is that evidence generated automatically as part of normal operations, or does someone manually assemble it when asked?

Get your Governance Debt profile

0 of 5 answered. Finish the remaining 5 above to unlock your results.

This is a diagnostic tool, not a certification. Your results appear instantly below. No spam, ever.