AI Readiness Check: Is Your Organization Ready to Govern AI Risk?

An organization is ready to govern AI risk when it can show 3 things: where AI is used, who decides whether each use is acceptable, and how it knows its controls still work after approval. In ISACA's 2026 poll, only 38% of organizations had a "formal, comprehensive" AI policy.

The check below asks those 3 questions and scores your answers on this page. It asks for no email address, and your answers are not stored or sent anywhere. Each question maps to the functions of the NIST AI Risk Management Framework 1.0, Govern, Map, Measure and Manage, and your total puts you in one of 3 bands, each with 3 next steps.

What readiness to govern AI risk means

Readiness to govern AI risk is the ability to show where AI is used, who decides whether each use is acceptable, and how the organization knows its controls keep working after approval. It is narrower than AI readiness in general, which asks whether an organization has the data, people and infrastructure to use AI well. An organization can be ready to use AI long before it is ready to govern it.

A written policy is not the same as readiness. EY's September 2026 survey of more than 200 senior AI decision-makers at US public companies with at least $1 billion in revenue found that 98% have formal AI governance policies. In the same survey, 47% said their organization has bypassed its AI governance process for urgent deployments, and 41% said senior leaders cannot see all the AI tools operating in the organization. That is why this check asks what happens after approval as well as whether a policy exists.

What the 2026 research says about readiness

The surveys agree on the pattern: most organizations have started on paper, and fewer can prove that their AI controls work. I have labeled vendor and consultancy research as such.

The gap sits in questions 2 and 3 of this check. Most organizations can now point to a policy, and far fewer can name who accepted an AI risk or show how fast they could switch a misbehaving system off.

The 3 questions

Choose the answer closest to how your organization works today.

What your result means

Add the points for your 3 answers. The total is between 0 and 9.

Early, a score of 0 to 3

Your organization uses AI without a reliable picture of where it runs or who answers for it. None of the next steps needs a new tool.

1. List every AI tool and AI feature in use, with an owner and a purpose for each entry.
2. Name one executive who is accountable for AI risk, and write that down.
3. Publish a short policy for public AI tools that names the data that must never go into them, using the 6-part policy outline.

Developing, a score of 4 to 6

Parts of the foundation are on paper: some inventory, a policy or an owner. The gap at this level is proof that decisions are recorded and that controls keep working after a tool is approved.

1. Put an approval step in front of every new AI use, with the data rules attached.
2. Record every accepted AI risk in a risk register with the name of the person who accepted it and a date to review it.
3. Set a review schedule for each AI tool and system, and agree who can suspend one that misbehaves.

Established, a score of 7 to 9

You can show where AI runs, who decides and how you check. The work now is keeping that evidence current as AI use grows.

1. Move the controls that matter most from scheduled reviews to Continuous Control Monitoring.
2. Map your AI controls once to the NIST AI RMF, ISO/IEC 42001:2023 and, where it applies to you, the EU AI Act.
3. Bring the suppliers of your AI models and AI features into your third-party risk reviews.

How the check maps to the NIST AI RMF

The NIST AI Risk Management Framework 1.0, released in January 2023, organizes AI risk management into 4 functions. NIST designed Govern as a cross-cutting function that informs the other 3, which is why it appears in 2 of the 3 questions. NIST says the framework is intended to build on, align with and support AI risk management efforts by others, and in my view it is the plainest public structure for the basics of AI governance.

Each question also rests on evidence from 2026. The first asks for an inventory, and EY found that 41% of senior AI decision-makers say their leaders cannot see all the AI tools in use. The 2026 AI Index from Stanford HAI found generative AI in at least one business function at 70% of organizations, with the highest year-over-year increases in Europe and one of the most advanced AI markets. An internal register is how an organization keeps track of that spread.

The second question asks who decides, and ISACA found that 20% of digital trust professionals do not know who would be responsible if an AI system caused harm. Why that decision stays with a named person is the subject of my article Will AI replace cybersecurity teams?

The third question asks how you check, and ISACA found that 56% do not know how long it would take to halt an AI system during a security incident. A tested way to switch an AI system off is the simplest proof that the third answer is true. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. The 3-point answer to question 3 describes CCA applied to AI.

How the check connects to DigitalXForce assessments

DigitalXForce assesses how organizations govern AI with its AI TRiSCM module, described below. The public record says very little about how companies govern AI, which is why a check like this one starts with your own answers. Our Security Posture Benchmark 2026, a study of the security answers companies publish, comes out on 15 October.

Step 3 of the Established band brings AI suppliers into third-party reviews rather than relying on the answers they have published, since a published answer describes the day it was written.

Where DigitalXForce fits

In the DigitalXForce platform, AI is one of the seven sub-postures of the Digital Trust Score. The Digital Trust Score is DigitalXForce's composite score from 300 to 850, computed continuously from live control evidence across seven sub-postures: security, compliance, audit, resilience, third-party, AI and risk.

We built AI TRiSCM™, the AI module of our Trust, Risk, Security and Compliance Management platform, for organizations whose AI is spreading faster than their register can track. It discovers AI assets across cloud, code, pipelines, containers, model endpoints and RAG stores, assesses LLMs, copilots, agents and models, and maps them to the NIST AI RMF, ISO/IEC 42001, the EU AI Act, the OWASP LLM Top 10 and MITRE ATLAS. The glossary defines it, the AI TRiSCM and AI Risk Governance page has the module details, and what TRiSCM is explains the category. For the wider argument, read why AI in cybersecurity needs a balance of innovation, security and trust and how DigitalXForce approaches AI-powered risk governance and security posture management.

Margareta Petrovic on AI readiness

"The first sign that an organization is ready to govern AI is a list. Write down every AI tool you use, the person who owns it and the data it is allowed to see. If you cannot produce that list, start there, before any framework and before any software."

Margareta Petrovic, Chief AI Officer, DigitalXForce

Where DigitalXForce is not the answer

If your score is Early, you do not need a platform yet. The first steps are a named owner, a written policy and an inventory in a spreadsheet, and none of them needs a new tool. If your score is Developing and your team is small, DigitalXForce Lite is the full DigitalXForce platform hosted in the cloud, with the same functionality, for any organization that prefers cloud hosting, and it makes sense only once the spreadsheet stops keeping up.

Questions about the AI readiness check

What does it mean to be ready to govern AI risk?

It means the organization can show where AI is used, who decides whether each use is acceptable, and how it checks that controls keep working after approval. Those 3 abilities map to the Govern, Map, Measure and Manage functions of the NIST AI RMF 1.0. A policy shows readiness only once someone owns it and its controls are checked.

How is AI readiness different from readiness to govern AI risk?

AI readiness asks whether an organization has the data, people and infrastructure to use AI well. Readiness to govern AI risk asks whether it can show where AI runs, who decides whether each use is acceptable and how controls are checked after approval. An organization can be ready to use AI long before it is ready to govern it.

What is an AI governance maturity model?

An AI governance maturity model describes the stages an organization moves through, from ad hoc AI use with no formal oversight to governance that is measured and improved over time. CMMI Institute, an ISACA enterprise, launched its CMMI AI Maturity model in July 2026, and a 2025 matrix for boards published in California Management Review at UC Berkeley uses three stages across five dimensions. This check is a lighter self-assessment with 3 bands, meant to show where to start.

How do you build an inventory of AI systems?

Start with one register that lists every AI tool and AI feature in use, including AI inside software you already buy, with its owner, purpose, provider, the highest class of data it may see and the date it was approved. Then compare single sign-on and web proxy logs against the register each month to find AI that nobody declared. The NIST AI RMF asks for mechanisms to inventory AI systems, resourced according to organizational risk priorities (Govern 1.6).

Who should own AI risk in an organization?

One named executive should be accountable, with the work shared across security, risk, legal and the business owner of each AI use. The NIST AI RMF expects executive leadership to take responsibility for decisions about AI risks (Govern 2.3), and ISACA found in 2026 that 20% of digital trust professionals do not know who would be responsible if an AI system caused harm. Write the name down before the next AI tool is approved.

Is anything I enter stored or sent?

Your answers are not stored or sent anywhere. The check runs in your browser, there is no form, and neither your answers nor your score are saved or used for analytics. Reloading the page clears them.

Does a high score mean we comply with the EU AI Act or ISO/IEC 42001?

A high score does not show compliance with any regulation or standard. The check covers 3 basics of AI governance, while compliance with the EU AI Act, Regulation (EU) 2024/1689, or certification to ISO/IEC 42001:2023 is established against the regulation or the standard itself. Use the result to decide where to start.

What should we do after an Early result?

Start with the list of every AI tool and AI feature in use, with an owner and a purpose for each. Then name the executive accountable for AI risk and publish a short policy for public AI tools. Take the check again once those 3 steps are done.

Methodology

This is a self-check. It records what you say about your organization, and it does not test your environment, verify your answers or compare you with other organizations. The questions, the points and the band thresholds are my judgment of what the NIST AI RMF functions ask for at a basic level; they are not part of the framework, and NIST has not reviewed them. The check runs in your browser with no form, and no answer or score is stored, sent or used for analytics. Version 1.0, published 14 October 2026.

This check is the Day 14 quiz of the DigitalXForce Cybersecurity Awareness Month 2026 series. Every figure on this page was read at its source on 25 September 2026.

Sources

• ISACA, "AI Use Accelerates, While Governance and ROI Lag, Says New ISACA Research", published 5 May 2026, on the 2026 AI Pulse Poll of more than 3,400 digital trust professionals. https://www.isaca.org/about-us/newsroom/press-releases/2026/ai-use-accelerates-while-governance-and-roi-lag-says-new-isaca-research, read 25 September 2026.
• ISACA, "New ISACA Research: 56% of Digital Trust Pros Don't Know How Fast They Could Shut Down AI After a Security Incident", published 23 March 2026. https://www.isaca.org/about-us/newsroom/press-releases/2026/digital-trust-pros-dont-know-how-fast-they-could-shut-down-ai-after-a-security-incident, read 25 September 2026.
• ISACA, "Only 8 Percent of Organizations Conduct Regular AI-Specific Response Exercises, ISACA Research Finds", published 22 September 2026, on the 2026 State of Cybersecurity survey of more than 1,800 cybersecurity professionals. https://www.isaca.org/about-us/newsroom/press-releases/2026/only-8-percent-of-organizations-global-enterprises-conduct-regular-ai-specific-response-exercises, read 25 September 2026.
• ISACA, "CMMI Institute Launches New CMMI AI Maturity Model to Strengthen AI Governance", published 17 July 2026. https://www.isaca.org/about-us/newsroom/press-releases/2026/cmmi-institute-launches-new-cmmi-ai-maturity-model-to-strengthen-ai-governance, read 25 September 2026.
• World Economic Forum, Global Cybersecurity Outlook 2026, January 2026, a survey of 804 qualified participants from 92 countries run from 25 August to 1 October 2025. https://reports.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2026.pdf, read 25 September 2026.
• EY, "AI governance has entered its next phase: closing the confidence gap", on the EY US AI Risk and Governance Survey of more than 200 senior AI decision-makers, published 15 September 2026. This is consultancy research. https://www.ey.com/en_us/insights/assurance/ai-governance-has-entered-its-next-phase-closing-the-confidence-gap, read 25 September 2026.
• Stanford HAI, The 2026 AI Index Report, Responsible AI chapter. https://hai.stanford.edu/ai-index/2026-ai-index-report/responsible-ai, read 25 September 2026.
• IBM, "IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls", published 30 July 2025, on the 2025 Cost of a Data Breach Report. This is vendor research. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls, read 25 September 2026.
• California Management Review, UC Berkeley Haas School of Business, "AI Governance Maturity Matrix: A Roadmap for Smarter Boards", published 22 May 2025. https://cmr.berkeley.edu/2025/05/ai-governance-maturity-matrix-a-roadmap-for-smarter-boards/, read 25 September 2026.
• Stanford HAI, The 2026 AI Index Report, Economy chapter, April 2026, on organizational use of generative AI in 2025. https://hai.stanford.edu/ai-index/2026-ai-index-report/economy, read 25 September 2026.
• NIST, AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1), released 26 January 2023, intended for voluntary use and to build on, align with and support AI risk management efforts by others. https://www.nist.gov/itl/ai-risk-management-framework, read 25 September 2026.
• NIST Trustworthy and Responsible AI Resource Center, AI RMF Core, section 5: the Govern function as cross-cutting, the Map function description, Govern 1.6, Govern 2.3, Measure 2.4, Manage 1.3 and Manage 2.4. https://airc.nist.gov/airmf-resources/airmf/5-sec-core/, read 25 September 2026.

What this looks like in practice.

Reading about continuous evidence is one thing. Watching a control get tested against live data from your own stack is another. A 30 minute walkthrough on your frameworks shows the difference.

Request a demo