VERITRAIL assessments are defined as versioned templates: every question names the domain it scores, the VERITRAIL controls it relates to and — for use-case questions — the evidence an assessor expects to see. That structure is what makes results reproducible and citable.
Available templates
| Template | Version | Scope | Questions | How to use it now |
|---|---|---|---|---|
| AI Governance Maturity Self-Assessment | 1.0.0 | Organization or business unit | 24 questions across 8 domains, plus 5 profile questions | Take it online |
| AI Use-Case Risk & Control Assessment | 1.0.0 | One AI system or use case | Intake fields plus questions in 9 modules, selected by risk profile | Through the VERITRAIL Agent or a Governance Baseline |
Editable spreadsheet and document versions of both templates are coming soon. If you need them now — for example to run a facilitated workshop — contact us and we will share the current version.
Maturity self-assessment at a glance
- Domains and weights: Strategy & Accountability (12%), AI Inventory & Visibility (14%), Risk Management & Lifecycle (14%), Data & Privacy (12%), Security & Resilience (14%), Fairness, Safety & Transparency (12%), Human Oversight & Operations (12%), Assurance, Evidence & Improvement (10%).
- Scale: 1 Not started → 5 Measured, automated and continuously improved.
- Outputs: level, domain scores, strengths, gaps, critical flags, 30/60/90-day plan, recommended controls, indicative readiness indicators.
- Evidence status: User-asserted.
Full method: maturity model.
Use-case question bank at a glance
- Modules: core governance and lifecycle; data and privacy; security and resilience; generative AI and LLM controls; agentic AI and tool use; fairness, safety and transparency; human oversight and operations; vendor and third-party AI; monitoring, incidents and evidence.
- Answers: implemented, partially implemented, not implemented, unknown, not applicable.
- Severity: derived from control priority, confirmed risk tier and answer; mapped to 30/60/90/180-day SLAs.
- Evidence: each question lists expected evidence; answers remain User-asserted until evidence is reviewed by a named reviewer.
Full method: assessment modules and gap analysis.
VERITRAIL controls cited
- EI-12 Use-case intake registerNIST AI RMF: MAP 1.1ISO/IEC 42001: A.5.2, A.6.1.3EU AI Act: Art. 6
- GL-01 Intake triage workflowNIST AI RMF: MAP 1.1, MAP 1.6ISO/IEC 42001: 8.1, A.6.1.3EU AI Act: Art. 9
- GL-02 Pre-deployment risk and impact assessmentNIST AI RMF: MAP 1.1, MAP 3.1, MAP 5.1, MEASURE 1.1ISO/IEC 42001: 6.1.4, 8.4, A.5.2, A.5.3, A.5.4EU AI Act: Art. 9, Art. 27
- SE-01 Control testing programmeNIST AI RMF: MEASURE 1.3, MEASURE 4.1ISO/IEC 42001: 9.1, 9.2EU AI Act: Art. 17
Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.
Using templates responsibly
Templates are a means to consistent evidence, not an end. Adapt wording to your organization, keep a record of the template version used for each assessment, and do not present self-assessment results as verified findings.