NormDomain1Score

NormDomain2Score

NormDomain3Score

NormDomain4Score

NormDomain5Score

NormDomain6Score

OverallScore

Domain1Score

Domain2Score

Domain3Score

Domain4Score

Domain5Score

Domain6Score

TotalRawScore

Domain1Avg

Domain2Avg

Domain3Avg

Domain4Avg

Domain5Avg

Domain6Avg

TotalAvg

Safeshield AI Governance Operational Maturity Assessment

https://storage.tally.so/28a4781c-0964-4622-845b-7c5e22d336bc/assessment-cover-page.png

1 - Responsibilities have not been formally defined.

2 - Certain individuals or teams have assumed responsibilities, but ownership is inconsistent.

3 - Governance roles, responsibilities and decision rights are documented for relevant functions.

4 - Responsibilities are consistently exercised through established governance processes and escalation paths.

5 - Accountability is integrated across governance workflows, monitored for effectiveness and periodically improved.

How clearly are responsibilities for AI governance defined across the organization?

1 - No formal AI governance structure exists.

2 - Governance occurs informally or through existing committees on an as-needed basis.

3 - A defined governance structure exists with documented mandates and participation.

4 - Governance bodies operate on established schedules with defined decisions, reporting and follow-up.

5 - Governance structures are routinely evaluated and adapted based on organizational needs and AI risk.

How established is your organization's AI governance structure?

1 - AI-specific governance policies or procedures are largely absent.

2 - Some policies or guidance exist, but significant gaps or inconsistencies remain.

3 - Required policies and procedures are documented, approved and communicated.

4 - Compliance with policies and procedures is monitored and supported by operational evidence.

5 - Policies and procedures are systematically updated based on performance, incidents, regulatory change and emerging risks.

How mature are your organization's AI governance policies and procedures?

1 - Functions operate independently with little coordination.

2 - Coordination occurs primarily when specific problems arise.

3 - Defined cross-functional processes connect relevant business, risk, compliance, legal, privacy, security, data and technology stakeholders.

4 - Cross-functional workflows, handoffs and escalation mechanisms operate consistently.

5 - Coordination is measured and continuously improved, with integrated workflows supporting governance across the AI lifecycle.

How effectively do relevant functions coordinate AI governance activities?

1 - Decisions are generally undocumented or difficult to reconstruct.

2 - Some important decisions are documented, but practices vary.

3 - Defined requirements exist for documenting material governance decisions and approvals.

4 - Decisions, rationale, approvals, exceptions and follow-up actions are consistently recorded and traceable.

5 - Decision records are integrated with governance evidence and routinely analyzed to improve governance effectiveness.

How are significant AI governance decisions documented and tracked?

1 - No reliable enterprise AI inventory exists.

2 - Partial inventories exist within certain teams or functions.

3 - A centralized inventory covers most known AI systems/use cases using defined information requirements.

4 - The inventory is maintained through defined ownership and lifecycle processes.

5 - Inventory maintenance is integrated with organizational workflows and continuously validated for completeness and accuracy.

How complete and current is your inventory of AI systems and use cases?

1 - AI projects can begin without formal governance intake.

2 - Some teams voluntarily submit AI initiatives for review.

3 - A defined intake process exists for relevant AI initiatives.

4 - Intake is consistently connected to classification, risk assessment, approval and accountability.

5 - Intake is integrated or automated across relevant enterprise processes and monitored for effectiveness.

How systematically are new AI use cases identified and brought into governance processes?

1 - No consistent classification methodology exists.

2 - Classification occurs for selected systems or when concerns arise.

3 - Defined criteria are used to classify AI systems/use cases.

4 - Classification consistently determines applicable governance requirements, controls and review levels.

5 - Classification is dynamically reassessed as systems, use cases, regulations and risks change.

How are AI systems classified according to risk and governance requirements?

1 - AI systems can be deployed without formal governance review.

2 - Reviews occur for selected or visibly high-risk systems.

3 - Defined review and approval requirements exist based on risk/classification.

4 - Required approvals and supporting evidence are consistently completed before deployment.