Self-assessment

How ready is your organisation for private AI?

Fifteen questions, about 5–8 minutes. Your score, maturity level and priority gaps appear immediately — no email address required. Answers stay in your browser and are not transmitted to us.

This is a self-assessment: a preliminary, non-binding readiness review to structure your internal conversation. It is not an audit, a certification, or legal or regulatory advice.

01 / 15 Do you know which AI tools your teams actually use today?

No visibility — we assume public AI tools are used but cannot see it Anecdotal awareness only Partial visibility through network or endpoint controls Documented inventory of sanctioned tools, but shadow use likely Monitored visibility with a sanctioned alternative in place

02 / 15 Could sensitive operational data (tickets, configs, subscriber data) reach external AI services today?

Yes — nothing prevents it Policy prohibits it, but nothing enforces it Some technical controls (DLP, blocking) on managed devices Enforced controls plus an approved internal alternative

03 / 15 Where would your organisation be able to run AI workloads for sensitive operations?

Only public SaaS AI is realistically available Public cloud with contractual controls Private cloud / dedicated tenancy On-premises infrastructure available On-premises including air-gapped segments where required

04 / 15 Do you have data-residency or sovereignty obligations that constrain where AI processing may happen?

Unknown — not assessed Obligations exist but are not mapped to AI usage Obligations mapped; AI usage partially assessed Obligations mapped and reflected in AI architecture decisions

05 / 15 If an internal AI answered questions from company documents, could you say which documents it should be allowed to use?

No — knowledge is scattered with no approval concept We know where knowledge lives, but nothing marks it approved Some repositories are curated and could serve as approved sources Approved-source concept exists with owners and review

06 / 15 Would a human approval be required before new knowledge or a new model version goes live in an AI system?

No approval concept for AI changes Informal review by whoever runs the system Documented approval for major changes only Documented human approval gates for knowledge and model changes

07 / 15 How would you decide whether an AI model or configuration is fit for operational use?

We would rely on vendor claims or general reputation Ad-hoc testing by the team Structured testing against sample questions before rollout Versioned evaluation sets with defined pass criteria and re-testing after changes

08 / 15 Could an internal AI system enforce your existing roles and permissions when answering questions?

We have no central identity provider Central identity exists, but document permissions are inconsistent Identity and coarse permissions could be enforced Identity plus source-system ACLs could map through to AI answers

09 / 15 What stops credentials and secrets from ending up inside an AI knowledge base?

Nothing — secrets appear in tickets and documents routinely Policy tells staff not to store secrets in documents Some scanning exists in parts of the estate Deterministic secret detection would block ingestion outright

10 / 15 If an AI system produced a harmful answer or leaked data, would your incident-response process cover it?

No — AI is not in our IR scope IR exists but has no AI-specific scenarios AI scenarios discussed but not exercised AI incidents in IR scope with a way to stop the system immediately

11 / 15 Could you reconstruct, after the fact, what an AI system knew and why it gave a specific answer?

No — no logging concept for AI interactions Basic logs, but no link between answers and source knowledge Answers could be traced to sources with some effort Full lineage: answer → sources → knowledge version → approvals

12 / 15 If a bad knowledge update or model change landed, could you roll it back?

No versioning concept — we would rebuild Manual restore from backups, untested for AI content Versioned content, rollback possible but not drilled Versioned knowledge and models with tested rollback

13 / 15 Who would own a private AI system operationally?

Nobody identified An enthusiast or innovation team, informally A named team, but without defined responsibilities Named owner with defined responsibilities across IT, security and the business

14 / 15 Could you explain your AI usage to a regulator or auditor today?

No — we would be starting from zero We could describe intentions but show little evidence Partial documentation exists Documented usage, controls and evidence we could present

15 / 15 Could you name one measurable operational use case for a private AI pilot?

Not yet — interest is general Several vague candidates One or two candidates with an owner A specific use case with an owner, a baseline and a success measure

How ready is your organisation for private AI?

Your readiness result

Category breakdown

Your three priority gaps

Recommended next steps