AI security check

Tick each statement that is fully true today. Be honest: “partly” counts as not yet. Your score updates as you go, and nothing is sent anywhere. It all stays in your browser.

0 / 20

Early stage

1Governance

A named person owns AI use in our organisation.We keep a list of approved AI tools.Staff have a written AI acceptable-use policy.Higher-risk uses have had a risk or data protection assessment.Leadership reviews AI risks at least twice a year.

2Data

We know which data must never go into AI tools.Supplier contracts say how our data is used, kept and deleted.Our data is not used to train third-party models unless we decided so.Retention periods are set for prompts and outputs.Staff know how to report an AI mistake or data exposure.

3Systems

Assistants have only the tools and permissions they need.Access rules are enforced in code, not only in prompts.Irreversible, external or financial actions need human approval.Spend and rate limits are set, with alerts.Secrets such as API keys are kept out of prompts and rotated.

4Operations

AI interactions are logged, as far as policy allows.We test AI features for injection and wrong answers before launch.Staff have had short AI security training.Our incident plan covers AI incidents.We re-test after any model or supplier change.

Your result

Start with these

Get the free guide Book a free call

This is an indicative self-check, not an audit or a certification.