How exposed is your organisation’s AI use?

1. Staff use public AI assistants such as ChatGPT, Copilot, Gemini or Claude.

2. Staff may use personal or free AI accounts for work.

3. The organisation does not maintain a complete list of approved AI tools.

4. Confidential customer or business information may enter AI systems.

5. Employee, candidate, patient or other personal information may enter AI systems.

6. AI scores, recommends, prioritises or informs matters affecting people.

7. Material AI outputs are not always checked by a trained person.

8. AI supplier data-use, retention and location terms have not all been reviewed.

9. The organisation does not have a written AI acceptable-use policy.

10. Staff have not received role-appropriate AI literacy or safe-use training.

11. AI is not clearly included in incident reporting and response.

12. The organisation could not immediately evidence its answers to a customer or tender team.