AI governance readiness checklist

Twenty-one questions, grouped by the seven stages of The Edge AI Governance Cycle™, to see where your business stands on AI governance today.

Edge AI Partners · 13 October 2026 · 3 min read

Answer each question with a plain yes or no. There's no score to submit and nothing is saved. Use it to see where the gaps are.

Identify: know what AI you use

We have a list of the AI tools used in the business, including free tools staff use on their own.

We know which teams use each tool and what for.

We know which of our own products or services include AI.

Assess: understand the risk

We know which AI uses involve personal, client or confidential data.

We know which AI uses reach customers or inform decisions about people.

We've checked what our main AI suppliers do with the data we give them.

Decide: make clear choices

Each AI use has been approved, approved with conditions, or stopped.

Each approved use has one named owner.

Senior leaders know which AI uses carry the most risk.

Control: put proportionate safeguards in place

We have a short written policy on acceptable AI use that staff have read.

Customer-facing AI outputs are checked by a person before they're sent.

Staff know which data must never go into an unapproved tool.

Operate: run AI use day to day

Staff have had basic training on using AI responsibly.

Staff know who to go to with an AI question or concern.

If you sell an AI product: we can explain to a customer how it works, what it shouldn't be used for and who to contact.

Monitor: keep watch

We review AI use when a tool, a use or a supplier's terms change.

We record AI mistakes, complaints and near misses.

Someone checks, at least every six months, that the policy still matches how AI is actually used.

Improve: learn and adjust

We change controls when monitoring shows a problem.

We look for processes where AI is working well and could be extended safely.

Any new automation goes back through Identify and Assess before it's switched on.

What your answers tell you

Mostly yes: you have the foundations. The next step is evidence: records you could show a customer, an auditor or an investor.

A mix: that's normal for a growing business. Start with the gaps in Identify and Assess. Everything else depends on them.

Mostly no: you're not alone, and you don't need a large programme to fix it. A focused health check will show you the three or four things to do first.

This is general information, not legal advice.

Sources

Back to Insights