Tools

AI Governance Readiness Assessment

The AI Governance Readiness Assessment is a 65-question maturity diagnostic across five pillars: Data Trust, Model Governance, Agent Autonomy, Enterprise Operations, and Responsible AI. Each control is scored on a five-level maturity ladder, from non-existent to optimized, mapped to frameworks including NIST AI RMF, ISO 42001, and the EU AI Act. It shows where governance holds and where it doesn't, before a board review, regulator, or acquirer's diligence team asks the same questions.

Questions

Common questions

What does this assessment map to?

The five pillars and their maturity ladder are built to track the control areas covered by the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act's risk-based obligations, and the Digital Asset Security Framework's (DASF 3.0) approach to AI-specific controls, including the Responsible AI pillar's coverage of fairness, transparency, explainability, and human oversight. It's a fast read on where you'd stand if asked, not a certification against any one of them.

Who should run this?

CISOs and CTOs preparing for a board AI-risk review, and PE deal or operating teams sizing up AI posture at a portfolio company or a target in diligence. Anyone who needs a defensible answer to how governed their AI is, faster than a formal audit can produce one.

How is this different from a full engagement?

This is a self-scored, self-reported diagnostic: sixty-five questions, twelve to eighteen minutes, no evidence collected. CCA's full assessment verifies each control against actual evidence (configs, logs, registries, policies) and produces a report a board or buyer can rely on. Treat this as the honest first read, not the final answer.

What are the limits of a self-scored result?

It's only as accurate as the honesty of the answers, and self-assessment tends to score generously: a team rates a policy that exists on paper higher than one that's enforced. Use it to find where to look first, not as evidence in its own right.

Does the EU AI Act apply to us?

If you have EU customers or process data on EU residents, likely yes. The Act applies extraterritorially, and its high-risk obligations (risk management, human oversight, logging, technical documentation) map closely to this assessment's Model Governance, Enterprise Operations, and Responsible AI pillars. The first context question in the assessment flags this directly.

How does the 0-100 scoring work?

Each question is scored on the same five-level maturity ladder (non-existent, reactive, defined, managed, optimized) mapped to 0, 25, 50, 75, and 100. Your pillar score is the average across its questions; your composite band weights all five pillars equally.