AI Governance readiness quiz

Do you have a written, approved AI use policy that staff have read and acknowledged?

Put an AI acceptable-use policy in writing, get leadership sign-off, and have staff acknowledge it. It is the foundation every AI framework starts from.

Is someone clearly accountable for approving AI tools and handling AI issues?

Name an owner (or a small committee) responsible for approving AI tools and dealing with problems, so decisions are not ad hoc.

Have you defined what company or customer data can and cannot be put into AI tools?

Spell out what data is allowed in AI tools and what is off-limits (personal, confidential, regulated), and make it clear to staff.

Have you checked whether your AI vendors train on or retain the data you put in?

Review each AI vendor data-use terms; prefer business tiers that do not train on your inputs, and record the decision.

For AI that touches personal information, have you considered privacy obligations (PIPEDA / Law 25)?

Assess privacy impact before using AI on personal data; PIPEDA and Quebec Law 25 can apply. Try the privacy readiness quiz.

Do you keep a human in the loop to review important or customer-facing AI output?

Require human review before AI output is used in decisions, code, or anything customer-facing. Treat AI as a draft, not a decision.

Do you have a way to catch AI errors, bias or made-up answers before they cause harm?

Add verification steps for high-stakes AI use and tell staff to fact-check output before relying on it.

Is AI covered in your risk assessment and incident response (a bad output or a data leak)?

Add AI scenarios (data leakage, wrong output, vendor outage) to your risk register and incident plan. See the incident response quiz.

Have staff had basic training on using AI safely and what not to share?

Run short AI-awareness training: which tools are approved, what data is off-limits, and how to sanity-check output.

Do you know which AI tools staff are actually using, including unapproved ones?

Inventory the AI tools in use, including unsanctioned shadow AI, so you can govern what is really happening.

Do you vet an AI vendor security and compliance before adopting it?

Check each AI vendor security posture and certifications (such as SOC 2) before rollout, like any other supplier.

Do your AI contracts make clear who owns the inputs and the outputs?

Confirm in writing that you keep rights to your inputs and outputs and that the vendor liability terms are acceptable.