Move from AI experimentation to governed deployment.

Has a customer, tender team, insurer, auditor or board member asked about your AI controls?

Does any AI system use tools, access connected services, retain working memory or perform actions?

Do staff use ChatGPT, Copilot, Gemini, Claude, meeting assistants or other AI-enabled tools for work?

Could staff be using personal or free AI accounts for business activity?

Does the organisation maintain a current list of approved AI systems, embedded features and use cases?

Has the organisation actively checked for unapproved or previously unknown AI use?

Is there a simple route for staff to request, disclose or report a new AI tool or use case?

Could confidential, commercially sensitive, personal or special-category information enter an AI system?

Is AI used to score, recommend, prioritise or influence decisions affecting people?

Are material outputs checked by a trained person before being relied upon or communicated externally?

Have supplier data use, retention, model-training, hosting and subprocessor terms been reviewed?

Are access, identity, leaver and least-privilege controls applied to approved AI services?

Does every approved AI system or agent have a named business owner?

Are systems and agents tested against documented acceptance criteria before live use?

Are errors, harmful outputs, unexpected actions, incidents, complaints and human overrides recorded?

Are performance and control effectiveness reviewed against defined thresholds?

Does a material change to a model, prompt, knowledge source, integration, permission or supplier term trigger reassessment?

Does each system have a scheduled review date and a route to restrict, suspend or retire it?

Is AI included in acceptable-use, incident-response and business-continuity arrangements?

Have staff received role-appropriate AI literacy and safe-use training?

Could the organisation provide current evidence supporting its answers today?

Does leadership periodically review AI risks, incidents, exceptions and overdue actions?