Skip to content
London Royal AcademyBook training
Route 2 · entry step to the full diagnostic

AI Governance Self-Assessment

All 80 questions of the AI Governance Diagnostic’s scored instrument — the same eight dimensions as the free checker, at full depth. Your result is computed the moment you finish: overall score, dimension breakdown, red flags and your priority actions, on screen.

Auto-scored from your answers. No person reviews anything before your result — read the limits below before you rely on it. Not an audit, not legal advice, not a certificate.

£249 per organisation

Your £249 is credited in full against the full diagnostic if you buy it within 90 days. The credit runs for 90 days from your self-assessment order.

Buying for an organisation that pays on invoice? Use the PO / invoice request on the full diagnostic’s page and name the self-assessment in your request.

What you receive instantly

The limits — stated before you start

What stays with the full diagnostic: LRA quality review of your named evidence, the scored report document, the board paper, the AI policy draft, inventory register and risk-tiering guide, the group readout clinic, and one re-score within 12 months.

D1 · Inventory0 of 80 answered · 0 of 3 determinations made

D1 · Inventory

Do we know what AI we actually run? You cannot govern an estate you cannot list. This dimension tests whether the organisation's picture of its own AI use is complete, current and actually used — including the AI that arrived inside other software and the AI staff adopted themselves.

D1.1 — A single register of AI systems exists and is current.

Is there one maintained register (or equivalent single list) of every AI system in use, including AI features embedded in other software?

This tests whether the estate is knowable at all — the precondition for every other dimension.

A score of 3 is evidenced by: the register itself, dated within the last quarter, with a named maintainer; a sample of entries matches reality when spot-checked.

Scoring guidance: a list that exists but has not been updated in over 6 months scores at most 1. Separate departmental lists that are never combined score at most 1.

D1.2 — Every registered system has a named owner.

Does each entry name an individual (not a team) who owns that system?

This tests whether inventory connects to accountability at the level of the individual system.

A score of 3 is evidenced by: owner field complete for all entries; owners confirm, when sampled, that they know they own the system.

Scoring guidance: owners named for the flagship systems only scores at most 2.

D1.3 — The data each system uses is mapped.

For each system, is it recorded what data goes in, what comes out, and where processing happens?

This tests whether the organisation could answer a regulator, a data subject, or its own board about any system.

A score of 3 is evidenced by: data fields completed per entry, including personal-data flags and processing location; maps updated when a system changes.

Scoring guidance: mapping that covers only systems bought as "AI products" — and not embedded features — scores at most 2.

D1.4 — Supplier and model are identified for each system.

Does the register record the supplier, the product/model (and version where the supplier exposes it), and the contract route for each system?

This tests whether vendor change — a model update, a terms change, a deprecation — would be visible.

A score of 3 is evidenced by: supplier/model fields complete; at least one instance in the last year of a vendor change being picked up from this record.

Scoring guidance: "Microsoft", "Google" or similar as the whole entry, with no product or model identified, scores at most 1.

D1.5 — There is a working route for finding unsanctioned AI use.

Does the organisation actively look for AI use it has not approved — staff using personal accounts, free tools, or browser extensions with organisational data?

This tests whether "shadow AI" is treated as a discovery problem, not a disciplinary surprise.

A score of 3 is evidenced by: a discovery method used within the last 12 months (survey, network/proxy review, expense scan, amnesty) with findings recorded and acted on.

Scoring guidance: a policy that merely prohibits unsanctioned use, with no discovery activity, scores at most 1.

D1.6 — AI switched on inside existing software is captured.

When existing suppliers enable AI features in software already under contract, is that detected and assessed before or promptly after activation?

This tests the most common route by which unassessed AI enters an estate — the vendor update.

A score of 3 is evidenced by: a named check in contract management or IT change for AI feature activation; at least one real activation assessed in the last year.

Scoring guidance: "our suppliers tell us" without a check scores at most 1.

D1.7 — The register is maintained on a cycle, with entry and exit gates.

Is the register reviewed on a stated cycle, and must a new AI system be registered before or at go-live?

This tests whether inventory is a process or a one-off project artefact.

A score of 3 is evidenced by: review dates and a go-live gate evidenced in procurement or change records for the most recent additions.

Scoring guidance: a register created once for an audit and not touched since scores 0–1 by age.

D1.8 — Coverage has been tested across all functions.

Has anyone checked the register against what each department actually uses — including operations, frontline and back-office functions, not only head office?

This tests completeness where it usually fails: outside the centre.

A score of 3 is evidenced by: a coverage check within the last 12 months with departmental sign-off or sampling, and gaps found were added.

Scoring guidance: centre-only confirmation scores at most 2.

D1.9 — Retired systems are removed and their records kept.

When an AI system is retired, is it removed from live use, access closed, and the record retained (including what data it held)?

This tests whether the estate shrinks safely as well as grows.

A score of 3 is evidenced by: at least one retirement handled this way, with data disposition recorded.

Scoring guidance: if no system has ever been retired, score on the existence of a defined retirement step (at most 2).

D1.10 — The register is actually used in decisions.

Is the register referenced in procurement, risk, or change decisions — or is it shelfware?

This tests the difference between an inventory and a governance tool.

A score of 3 is evidenced by: minutes, papers or approvals in the last 12 months that cite the register.

Scoring guidance: no recorded use in 12 months scores at most 1, however complete the register looks.