This runs entirely in your browser. Nothing is submitted, nothing is stored, and there is no form at the end. The point is the answer, not the lead.
Score the organisation as a whole. Scoring your strongest system is the most common way to get a comfortable and useless result.
We hold a current inventory of every AI system in use, including the ones bought as a feature of something else.
For each system we can say whether it touches personal data, and under which jurisdiction.
We can name the person who approved each system running in production.
We can produce the information that person had at the time they approved it.
Every system that acts without asking has a written limit and somebody who reads the log.
We have halted an AI system on purpose, in production, and know how long it took.
Model or system performance has been tested on our own data, not the vendor’s benchmark.
Someone outside the team that built or runs the system has tested whether it works.
We could assemble an evidence pack for our main obligation in under a week.
The last governance review changed something we can point at.
Each statement is either true of your organisation today or it is not. Partly counts as half — and in practice partly is where most of the risk lives.
A low score is the normal result, and it is the useful one.
Every organisation we assess has policies. Far fewer can produce the artefacts on this list at speed. If you scored below five, you are in ordinary company and you now know which three statements to fix first.
The Trust Maturity Model sets out what exists at each level and the single move that gets you to the next.