AI Risk Management Self-Assessment

What it is

A short self-assessment that shows how your business governs the AI it already uses. It covers policy, data handling, human review, vendor vetting, training, and what happens when something goes wrong. It's organized around the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) and informed by ISO/IEC 42001.

Why it matters

AI rarely arrives as one big project. It shows up inside the email, CRM and agency software you already pay for, and in the chat tools your team opens on their own. Most small businesses have no written rules for it yet. You can't fix what you can't see.

How we think about AI

• Your people train the AI on a real workflow.
• It goes live only once it's proven reliable (about 95% or better).
• A person stays in the loop after that, and reviews are quick and simple.

Humans for purpose. AI for tasks.

What it is not

It's not an audit, a certification, or a validated maturity model. It's a self-reported baseline. It isn't endorsed by NIST or ISO.

How to answer

"AI tools" means chat assistants (ChatGPT, Copilot, Gemini, Claude), AI features inside software you already use (email, CRM, accounting, agency management systems), and any AI built or bought for your business, including tools built inside your company.

Yes

in place and applied company-wide.

Mostly

in place for most people or areas.

Partially

informal, or only in some areas.

No

nothing in place.

Don't know

not sure. Not counted in your score.

Not applicable

offered only where a question may not fit your company. Also left out of your score.

Practices only. Please don't enter client or proprietary details.