VERITRAILBook Governance Baseline

Tools

AI Governance Maturity Self-Assessment

Reviewed 21 October 2026

An assessment dashboard with a maturity gauge, sliders, a bar chart and a checklist.

Start the assessment

24 questions. 8 domains. About 8 minutes. Find out how mature your AI governance is today, where your critical gaps are, and what to do in the next 30, 60 and 90 days.

What you will be asked

First, five profile questions: industry, organization size, approximate number of AI systems, whether you use AI agents or autonomous workflows, and whether you place AI on the EU market or use AI affecting people in the EU. These tailor the critical flags and recommendations.

Then 24 questions — three in each domain:

Domain Weight
Strategy & Accountability 12%
AI Inventory & Visibility 14%
Risk Management & Lifecycle 14%
Data & Privacy 12%
Security & Resilience 14%
Fairness, Safety & Transparency 12%
Human Oversight & Operations 12%
Assurance, Evidence & Improvement 10%

Answer each on a five-point scale, from 1 — Not started to 5 — Measured, automated and continuously improved. Answer for your organization as a whole, as it operates today, not as policy says it should.

What you get

Immediately, on screen: your indicative overall score, maturity level (Initial, Developing, Defined, Managed or Optimized) and domain scores.

In the full report (business email required):

  • Up to five strengths and five priority gaps, each citing VERITRAIL controls.
  • Critical flags — for example, no reliable AI inventory, untested agents, or no kill switch — labelled Critical gap.
  • A 30/60/90-day action plan.
  • Recommended controls and VERITRAIL modules.
  • Indicative readiness indicators for NIST AI RMF, ISO/IEC 42001 and selected EU AI Act themes.

Read before you start

  • Results are self-reported and indicative. They are labelled User-asserted because no evidence has been reviewed.
  • Readiness is not compliance. The indicators help you prioritize; they do not determine conformity with ISO/IEC 42001, compliance with the EU AI Act or alignment with NIST AI RMF.
  • Your answers stay with you until you choose to share them. The preliminary result needs no personal data. See the privacy notice.

The scoring method, levels and critical flags are published in full on the maturity model page.

After the assessment

The natural next step is to validate the result with evidence. A Governance Baseline turns User-asserted answers into a verified gap register and a remediation roadmap.

Loading the tool…

Frequently asked questions

How long does it take?
About 8 minutes: 5 profile questions and 24 governance questions, 3 for each of 8 domains, each answered on a 1–5 scale.
Do I need to give my email to see a result?
No. You see your indicative overall score, maturity level and domain scores immediately. If you want the full report — strengths, gaps, critical flags, 30/60/90-day plan, recommended controls and readiness indicators — we ask for a business email and your consent.
Is the result a compliance assessment?
No. Results are self-reported and labelled User-asserted. Readiness indicators for NIST AI RMF, ISO/IEC 42001 and the EU AI Act are indicative and do not determine conformity or compliance.
How is the score calculated?
Each domain score is the sum of its answers as a percentage of the maximum. The overall score is a weighted sum of domain scores (weights from 10% to 14%). The method is published on the maturity model page and is identical in your browser and on our servers.

Last reviewed: