Core message before you can govern AI, you need an honest baseline — one that separates what is evidenced from what is assumed.
Most AI governance programmes start with a questionnaire and end with a slide that says "Developing". VERITRAIL Assess goes further: every finding cites the VERITRAIL control it relates to, carries an evidence label, and becomes a line in a gap register with a severity, an owner and a remediation SLA.
Capabilities
- Organization maturity assessment. 24 questions across eight weighted domains, scored deterministically against the VERITRAIL maturity model. Produces an overall level, domain scores, critical flags and a 30/60/90-day plan.
- Use-case intake and risk triage. A short intake suggests a risk tier — Prohibited-review, High, Medium or Low — with the factors and citations behind it. The tier is labelled Inferred and requires human confirmation.
- Deep-dive assessment modules. Core, data and privacy, security, generative AI, agentic AI, fairness and safety, human oversight, vendor AI, and monitoring modules, selected automatically by the intake profile. See Assessment modules.
- Evidence-aware findings. Each answer can carry attached evidence; findings move from User-asserted to Verified only when a named reviewer accepts the evidence.
- Indicative framework readiness. Readiness indicators grouped by NIST AI RMF function, ISO/IEC 42001 clause and selected EU AI Act themes — clearly labelled as indicative.
Who it is for
- Chief Risk and Compliance Officers who need a defensible view of AI risk across the enterprise.
- AI Governance Leads and AI CoE heads who need a repeatable way to assess new use cases.
- Consultants and internal audit teams who want a structured, citation-backed method for client or internal reviews.
Outputs
| Output | Contents | Evidence status |
|---|---|---|
| Maturity report (PDF / Markdown) | Score, level, domain scores, strengths, gaps, critical flags, action plan, recommended controls | User-asserted until validated |
| Use-case risk profile | Suggested tier, factors, triggers, missing fields, required modules, suggested approval authority and review cadence | Inferred; requires human confirmation |
| Gap register (CSV / JSON) | Finding, control ID, severity, evidence label, owner, SLA due date | Per finding |
| Readiness indicators | Limited / Partial / Substantial readiness by framework group | Indicative only |
Example finding
Finding: Customer-service agent can issue refunds without human approval. Control: IS-13 Human approval for high-impact actions; related IS-11 Least-privilege tool access. Evidence status: Critical gap — the tool manifest shows a payments tool with write access and no approval rule; confirmed in workshop. Severity: Critical (critical-priority control, High-tier system, not implemented). Remediation SLA: 30 days. Recommended action: Add a REQUIRE_HUMAN_APPROVAL rule for refunds above an agreed threshold and restrict the payments tool scope; verify in Observe mode before enforcing.
VERITRAIL controls cited
- GL-01 Intake triage workflowNIST AI RMF: MAP 1.1, MAP 1.6ISO/IEC 42001: 8.1, A.6.1.3EU AI Act: Art. 9
- GL-02 Pre-deployment risk and impact assessmentNIST AI RMF: MAP 1.1, MAP 3.1, MAP 5.1, MEASURE 1.1ISO/IEC 42001: 6.1.4, 8.4, A.5.2, A.5.3, A.5.4EU AI Act: Art. 9, Art. 27
- EI-02 AI risk classification and tieringNIST AI RMF: MAP 1.1, MAP 1.5, GOVERN 1.3ISO/IEC 42001: 6.1.2, A.5.2EU AI Act: Art. 6
- AO-04 AI risk appetite and toleranceNIST AI RMF: GOVERN 1.3, MAP 1.5ISO/IEC 42001: 6.1.1, 6.1.2EU AI Act: Art. 9
- IS-13 Human approval for high-impact actionsNIST AI RMF: GOVERN 3.2, MANAGE 2.2ISO/IEC 42001: A.9.2, A.6.2.6EU AI Act: Art. 14
Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.
How it fits
Assess is usually the first module used, through the free self-assessment or the risk triage tool, and then in depth during a Governance Baseline. Findings feed VERITRAIL Register (tiers and owners), VERITRAIL Control (approval gates) and VERITRAIL Shield (runtime guardrail recommendations).
Limitations
Self-assessment answers reflect the respondent's view and are labelled User-asserted. Suggested risk tiers are calculated from intake answers and can be wrong if the intake is incomplete; VERITRAIL lists missing fields and never finalizes a tier without human confirmation. Readiness indicators are not a substitute for legal review or a formal audit.