01
Existence
Do the instruments needed to govern your actual AI use exist at all?
This assessment evaluates the written governance instruments that are supposed to govern your AI use, the policies, standards, and procedures. It tests them on six dimensions: existence, coherence, compliance, coverage, enforceability, and alignment to practice. A policy that exists but is unenforced, contradictory, or ignored is worse than no policy because it creates a documented standard the organization is demonstrably failing to meet.
Each instrument is assessed against the six tests below, with specific defects recorded by location and severity rather than as general impressions.
Do the instruments needed to govern your actual AI use exist at all?
Are they internally consistent, mutually consistent, and free of contradiction or dangerous ambiguity?
Do they reflect current regulatory, contractual, and ethical obligations?
Do they address the AI uses you actually have, not a generic template that ignores real practice?
Are they specific enough to be followed and enforced, with clear ownership, consequences, and review cycles?
Do they match what the workforce actually does, as evidenced by skills, Shadow AI, and interview findings?
Most policy reviews stop at reading what is written. This one tests what is written against what is happening, and records both the divergence and its direction.
Collect all documents governing AI use, including relevant sections of acceptable-use, data-protection, procurement, HR, and security policies.
Compare the instrument set against a reference model of what a comparable organization should have, identifying absent and underdeveloped instruments.
Assess against the six tests, recording specific defects with location and severity rather than general impressions.
Triangulate documented standards against actual behavior. Where policy and practice diverge, both the divergence and its direction are recorded.
Recommendations are specific, often including drafted language for the gaps that matter most, so policy remediation is a workplan rather than another committee.
A focused review of your existing AI policies and procedures, tested against the six tests and against actual practice.