Free AI Governance Assessment - International Edition

How to Use This Tool ▾

Purpose: This tool is a self-assessment instrument for boards and directors of multinational organisations. It enables the board to assess the maturity of the organisation's AI governance practices against internationally recognised frameworks for board oversight of artificial intelligence.

Who should complete this assessment: This checklist is designed for completion by the board as a collective exercise, facilitated by the company secretary or chair. Alternatively, individual directors may complete it independently and compare scores as part of a board discussion on AI governance.

Scoring: For each of the 30 questions, select one of three responses: Yes - In Place (2 points): the board is satisfied this is comprehensively in place. Partially / In Progress (1 point): some activity exists but material gaps remain. No - Not in Place (0 points): this is not in place or the board cannot confirm it.

Interpreting "Yes": A Yes response should reflect the board's own confident assessment, not management's assertion to the board. If the board cannot independently verify a practice is in place and functioning, the honest response is Partially or No.

After completing the assessment: Review your maturity level and domain scores. Use low domain scores to prioritise the board's AI governance agenda. Once your governance baseline is set, see the strategy counterpart: the AI Strategy Readiness Assessment. For an independent, expert-facilitated evaluation, consider a formal BoardEvaluator™ AI Governance Status Assessment.

Progress: Your progress saves automatically as you work. To return to a partially completed assessment, simply reopen this file - your responses will be restored. Use Save Progress to manually save at any point. Use Reset to start a new assessment (this clears all saved responses).

Reference Frameworks - Verified as at 13 August 2026

Framework	Version / Status	Custodian	Effective Date
OECD Principles on AI	2019, updated 2024	OECD	In force
NIST AI Risk Management Framework (AI RMF 1.0)	January 2023	US NIST	In force
ISO/IEC 42001:2023 - AI Management System	2023	ISO / IEC	In force
ISO/IEC 38507:2022 - Governance implications of AI	2022	ISO / IEC	In force
ISO/IEC 23894:2023 - AI Risk Management	2023	ISO / IEC	In force
EU AI Act	2024 (phased)	European Union	Phasing in from 2025

Note: AI regulation varies by jurisdiction and is evolving quickly. This tool is grounded in internationally recognised frameworks for board oversight of AI rather than any single country's law. Boards should track the AI regulations applicable in each market where the organisation operates, including the EU AI Act and sector-specific rules. For jurisdiction-specific governance codes (for example King V in South Africa), a local edition is available on request.

Important Notice - Please Read Before Using This Tool ▾

What this tool is: T-BG-GL001 is a self-assessment instrument designed to help boards and directors of multinational organisations evaluate the maturity of their board's AI governance practices. It is provided by Celagenix as an educational and governance-development tool.

What this tool is not: This tool is not a legal opinion, regulatory opinion, or formal governance evaluation. Completing it does not confirm compliance with any law, code or regulatory requirement. Scores are based on the board's own self-assessment and have not been independently verified. This tool does not constitute advice of any kind - legal, governance, technical or otherwise.

Framework basis: This tool draws on internationally recognised frameworks for board oversight of AI, including the OECD AI Principles, the NIST AI Risk Management Framework, ISO/IEC 42001 and 38507, ISO/IEC 23894, and the EU AI Act. It is sector-agnostic and multi-jurisdiction; it is not specific to any single country's law.

Local governance codes and law: National corporate-governance codes and data-protection laws (for example King V and POPIA in South Africa, the UK Corporate Governance Code, or the GDPR) impose additional, jurisdiction-specific obligations that this international edition does not address in detail. Boards should obtain advice on the codes and laws applicable in each market where the organisation operates. Jurisdiction-specific editions of this tool are available on request.

Strategy counterpart: Governance is one side of the coin; strategy is the other. For the strategy side, use the companion AI Strategy Readiness Assessment.

Professional advice: Celagenix recommends that boards supplement this self-assessment with formal, expert-facilitated evaluation. For an independently assessed AI governance evaluation producing a consolidated board report and benchmarked recommendations, visit the BoardEvaluator™ AI Governance Status Assessment.

References-verified date: All framework references were verified as at 13 August 2026. This tool should be reviewed by August 2027, or earlier if material regulatory changes occur. Scope: Global · Enterprise · Multi-jurisdiction.

Governance Maturity Assessment - Score Dashboard

0% Maturity

Not Yet Started

Complete the checklist below to assess your board's AI governance maturity. Answer all 30 questions across 6 domains to receive your full score and recommendations.

Your AI governance gap requires urgent board attention.

Your score indicates that the board's AI governance practices are at the Ad Hoc or Developing stage - a position of material risk against the board's duty of care and internationally recognised AI oversight expectations. A self-assessment is the right starting point, but it is not sufficient on its own to address a governance gap of this magnitude.

The BoardEvaluator™ AI Governance Status Assessment provides:

Independent, expert-facilitated evaluation across all six AI governance domains
A confidential, board-ready assessment report with scored findings and specific recommendations
Benchmarking against comparable multinational organisations
A prioritised remediation roadmap that the board can act on immediately

Commission a BoardEvaluator™ Assessment →

Strong foundations. Specific gaps remain.

Your score confirms that the board has established a credible AI governance framework that broadly meets internationally recognised expectations. The domain-level breakdown reveals where specific gaps remain. Closing those gaps efficiently and with confidence requires more than a checklist.

The BoardEvaluator™ AI Governance Status Assessment provides:

A formal, expert-evaluated assessment that validates your self-assessment scores and identifies blind spots
Targeted recommendations for each domain gap, with practical implementation guidance
A consolidated board report suitable for presenting to the board, its committees and key stakeholders
Benchmarking data to contextualise your score against peer multinational organisations

Request a BoardEvaluator™ Assessment →

Governance excellence, well evidenced.

Your score indicates that the board is operating at an Advanced level of AI governance maturity, consistent with international leading practice. Achieving this is significant. Sustaining it - as AI technology evolves, AI regulation develops across jurisdictions, and stakeholder scrutiny intensifies - requires ongoing discipline and independent validation.

The BoardEvaluator™ AI Governance Status Assessment provides:

Periodic independent validation of governance excellence, producing externally credible evidence of the board's AI oversight rigour
An updated benchmarking analysis as the global AI governance landscape evolves
A board-ready assessment report that supports the organisation's disclosure obligations
Early identification of emerging governance gaps before they become material risks

Schedule a BoardEvaluator™ Assessment →

0 - 25% · 0-15 pts

Ad Hoc

No formal AI governance structure. Immediate board action required.

26 - 50% · 16-30 pts

Developing

Some awareness but governance is informal and incomplete. Key gaps remain.

51 - 75% · 31-45 pts

Defined

Structured approach broadly in place. Specific domains require strengthening.

76 - 100% · 46-60 pts

Advanced

Robust, integrated AI governance consistent with international leading practice.

Yes - In Place = 2 points

Partially / In Progress = 1 point

No - Not in Place = 0 points

AI Strategy & Policy

Board AI Mandate & Strategic Direction

0/10

▾

AI governance starts with the board: approving the framework, setting the risk appetite, and ensuring AI activity is integrated into - not isolated from - the organisation's strategy. This domain assesses whether the board has established a clear mandate and strategic direction for AI, consistent with the OECD AI Principles and NIST AI RMF (Govern).

T-BG-GL001.1.1

Has the board approved a formal AI governance framework or policy that defines the organisation's approach to the acquisition, development, use and distribution of artificial intelligence?

OECD AI Principles; NIST AI RMF (Govern); ISO/IEC 38507: A board-approved AI governance framework is the foundation of oversight and the anchor of the board's duty of care for AI.

T-BG-GL001.1.2

Does the board have sufficient collective understanding of how artificial intelligence is currently being used - or is proposed to be used - within the organisation and its material third-party relationships to fulfil its oversight obligations?

ISO/IEC 38507; NIST AI RMF (Map): Boards can only oversee what they understand. Sufficient collective knowledge of where and how AI is used is a precondition for effective oversight.

T-BG-GL001.1.3

Is the board's AI governance framework explicitly integrated into the organisation's overall strategy and business model - rather than treated as a standalone technology policy?

OECD AI Principles; NIST AI RMF (Govern): AI governance must be integrated with strategy and the business model, not treated as a standalone technology policy.

T-BG-GL001.1.4

Has the board approved a defined AI risk appetite statement that sets the boundaries within which management may develop, deploy or procure AI systems - and is this statement reviewed at least annually?

ISO/IEC 23894; NIST AI RMF (Manage): A defined AI risk appetite sets the boundaries within which management may build, deploy or procure AI, and should be reviewed at least annually.

T-BG-GL001.1.5

Does the board receive at least one dedicated briefing per year on artificial intelligence developments - including new AI deployments, material risks, regulatory updates and industry trends - to maintain the competence required for effective AI oversight?

ISO/IEC 38507: Directors must maintain the competence to oversee AI. A dedicated annual briefing keeps the board current on deployments, risks and regulatory change.

Risk & Assurance

AI Risk Oversight & Assurance Framework

0/10

▾

AI systems introduce risks that conventional enterprise risk management may not capture. This domain assesses whether the board has the oversight structures, information flows and assurance mechanisms to identify, evaluate and govern AI risk effectively, aligned with the NIST AI Risk Management Framework and ISO/IEC 23894.

T-BG-GL001.2.1

Are AI-specific risks - including model failure, algorithmic bias, data quality failures, AI supply chain risk and reputational harm - explicitly included in the organisation's risk register and reported to the board at least quarterly?

NIST AI RMF (Map, Measure); ISO/IEC 23894: AI-specific risks - model failure, bias, data-quality and supply-chain risk, reputational harm - must be on the risk register and reported to the board.

T-BG-GL001.2.2

Has the board assigned clear oversight responsibility for AI governance to a specific board committee - such as the risk committee, audit committee, or a dedicated technology governance committee - with a defined mandate that includes AI?

ISO/IEC 38507; NIST AI RMF (Govern): Clear committee-level oversight responsibility for AI, with a defined mandate, prevents accountability gaps.

T-BG-GL001.2.3

Does the board receive structured assurance - from internal audit, external audit, or another independent assurance provider - on the effectiveness of the organisation's AI risk controls, at a frequency appropriate to the level of AI adoption?

ISO/IEC 42001; NIST AI RMF (Measure): Independent assurance over AI risk controls gives the board confidence that oversight is effective, not just asserted.

T-BG-GL001.2.4

Does the organisation have a documented AI incident response protocol - including defined escalation thresholds, board notification triggers, and a post-incident review process - and has this been tested in the past 24 months?

NIST AI RMF (Manage); ISO/IEC 42001: A tested AI incident response protocol with board-notification triggers is essential to contain AI failures.

T-BG-GL001.2.5

Has the board satisfied itself that the organisation's enterprise risk management framework is sufficiently sophisticated to identify and assess AI-specific risks - and, where it is not, has it directed management to close identified gaps?

ISO/IEC 23894; NIST AI RMF (Map): The board should confirm the enterprise risk framework can actually identify AI-specific risks, and direct management to close gaps where it cannot.

Ethics & Accountability

Responsible AI & Ethical Governance

0/10

▾

Internationally recognised frameworks identify a set of values - human centricity, accountability, transparency, explainability, security, privacy, fairness and robustness - that should govern an organisation's AI. This domain assesses whether the board has embedded these values and can demonstrate accountability for them, consistent with the OECD AI Principles and the EU AI Act.

T-BG-GL001.3.1

Has the board approved a set of AI ethics principles - covering the internationally recognised responsible-AI values of human centricity, accountability, transparency, explainability, security, privacy, fairness and robustness - that govern all AI development, procurement and deployment within the organisation?

OECD AI Principles; EU AI Act: Board-approved AI ethics principles covering human centricity, accountability, transparency, explainability, security, privacy, fairness and robustness govern all AI activity.

T-BG-GL001.3.2

Does the organisation have clearly defined accountability structures for AI decisions, outputs and outcomes - including named individuals accountable for each material AI system - and is this accountability structure reported to and overseen by the board?

OECD AI Principles (accountability); NIST AI RMF (Govern): Named accountability for each material AI system, overseen by the board, is a core governance control.

T-BG-GL001.3.3

Are human oversight and override mechanisms in place for all AI systems that make or materially influence decisions affecting stakeholders - and are these mechanisms calibrated to the level of risk posed by each AI system?

OECD AI Principles (human-centred); EU AI Act: Human oversight and override for AI that affects stakeholders must be calibrated to each system's risk.

T-BG-GL001.3.4

Has the board received assurance that the organisation's AI systems are regularly tested for bias, fairness and discriminatory outcomes - particularly in AI systems that affect employees, customers or communities?

OECD AI Principles (fairness); NIST AI RMF (Measure): Regular testing for bias and discriminatory outcomes, especially for systems affecting people, is a board-level assurance item.

T-BG-GL001.3.5

Is the board satisfied that the organisation can explain, in terms accessible to affected stakeholders, how its material AI systems arrive at decisions or recommendations - and that this explainability is maintained as AI systems evolve?

OECD AI Principles (transparency, explainability); EU AI Act: The organisation should be able to explain how material AI systems reach decisions, in terms stakeholders can understand.

Data & Cybersecurity

AI Data Governance & Cyber Risk

0/10

▾

Boards are accountable for the effective, compliant and ethical management of data, and for the cyber risks that AI introduces. Data-protection laws in each jurisdiction create additional obligations for AI systems that process personal data. This domain examines whether the board is governing the data and cyber dimensions of AI, aligned with ISO/IEC 42001 and 27001.

T-BG-GL001.4.1

Has the board approved policies and standards governing the quality, integrity and provenance of data used to train, validate and operate the organisation's AI systems - including controls over biased, incomplete or unauthorised data?

ISO/IEC 42001; NIST AI RMF (Map): Approved standards for the quality, integrity and provenance of AI training and operating data guard against biased or unauthorised data.

T-BG-GL001.4.2

Is the board satisfied that the organisation's AI data practices comply with the data-protection laws applicable in each jurisdiction where it operates (such as the GDPR or equivalent) - particularly for AI systems that process personal data - and that a named data-protection lead has the mandate and resources to oversee this in AI contexts?

Data-protection law (e.g. GDPR); ISO/IEC 42001: AI data practices must comply with the data-protection laws of each jurisdiction, overseen by a mandated data-protection lead.

T-BG-GL001.4.3

Does the board receive regular reporting on cybersecurity threats specifically associated with AI systems - including adversarial attacks, model poisoning, data manipulation and AI-enabled cyber intrusions - and has the organisation's cyber security strategy been explicitly updated to address AI-specific threats?

ISO/IEC 27001; NIST AI RMF (Manage): AI introduces new cyber threats (adversarial attacks, model poisoning). Cyber strategy and board reporting must address them explicitly.

T-BG-GL001.4.4

Has the board approved data lifecycle governance standards that address the full lifecycle of AI-related data - from acquisition and use through to archiving and disposal - including cross-border data transfer considerations where AI services are hosted or processed in other jurisdictions?

ISO/IEC 42001; data-protection law: Data lifecycle governance, including cross-border transfer considerations, must cover AI data from acquisition to disposal.

T-BG-GL001.4.5

Is the board satisfied that the organisation maintains adequate data minimisation and purpose-limitation practices in its AI systems - ensuring that AI is not used to process personal information beyond the scope for which consent or another lawful basis was obtained?

OECD AI Principles (privacy); data-protection law: Data minimisation and purpose limitation ensure AI does not process personal data beyond its lawful basis.

Procurement & Deployment

AI Acquisition, Oversight & Performance

0/10

▾

Organisations increasingly depend on AI procured from third-party vendors. This domain examines whether the board maintains effective oversight across the full AI lifecycle - from procurement through deployment, monitoring and decommissioning - including the risks of outsourced AI services, consistent with ISO/IEC 42001 and NIST AI RMF (Govern: third parties).

T-BG-GL001.5.1

Does the board's delegation of authority framework include defined thresholds for board approval of material AI procurement decisions - ensuring the board is not bypassed when AI systems with significant strategic, risk or ethical implications are acquired?

ISO/IEC 38507; NIST AI RMF (Govern): Delegation-of-authority thresholds ensure the board is not bypassed on material AI procurement decisions.

T-BG-GL001.5.2

Does the organisation's AI procurement process require pre-deployment assessment of AI systems for ethical risk, bias, explainability limitations, and alignment with the organisation's AI ethics principles - before any material AI system is approved for production use?

ISO/IEC 42001; EU AI Act: Pre-deployment assessment for ethical risk, bias and explainability should gate any material AI system before production use.

T-BG-GL001.5.3

Has the board satisfied itself that material AI vendor contracts include: minimum assurance requirements from the vendor; the organisation's right to audit AI system performance; provisions governing the vendor's data processing practices under applicable data-protection law; and liability and indemnity provisions that address AI-specific failure scenarios?

ISO/IEC 42001 (third parties); data-protection law: Material AI vendor contracts should include assurance, audit rights, data-processing terms and AI-specific liability provisions.

T-BG-GL001.5.4

Does the board receive performance reporting on material AI systems - including accuracy metrics, error rates, fairness outcomes and user complaint volumes - at a frequency appropriate to the risk profile of each system?

NIST AI RMF (Measure); ISO/IEC 42001: Performance reporting on material AI systems (accuracy, error rates, fairness, complaints) lets the board oversee outcomes.

T-BG-GL001.5.5

Does the organisation have a defined process for decommissioning AI systems - including data deletion, model retirement, vendor contract termination and stakeholder notification where required - and has the board received assurance that this process is consistent with the organisation's data management obligations under applicable data-protection law?

ISO/IEC 42001; data-protection law: A defined decommissioning process (data deletion, model retirement, vendor exit) closes the AI lifecycle responsibly.

Reporting & Disclosure

AI Transparency & Stakeholder Reporting

0/10

▾

Boards have a growing obligation to disclose their AI governance practices in a manner that is transparent and useful to stakeholders, and emerging regulation such as the EU AI Act adds specific transparency duties. This domain examines whether the board is discharging its AI transparency and disclosure responsibilities effectively.

T-BG-GL001.6.1

Does the board's annual governance disclosure - whether through an integrated report, sustainability report, or another corporate reporting framework - include meaningful disclosure of the organisation's AI governance practices, including how board oversight of AI has been applied?

OECD AI Principles (transparency); corporate reporting frameworks: Meaningful disclosure of AI governance practices in annual reporting demonstrates board oversight to stakeholders.

T-BG-GL001.6.2

Has the board considered how to communicate the organisation's AI ethics stance and AI risk posture to shareholders and other key stakeholders - and are AI-related risks and opportunities disclosed in the organisation's material risk reporting?

OECD AI Principles; NIST AI RMF (Govern): The board should consider how to communicate the organisation's AI ethics stance and risk posture to shareholders and stakeholders.

T-BG-GL001.6.3

Where the organisation uses AI in decision-making processes that materially affect customers, employees or communities, does it disclose the existence and general nature of such AI use in relevant communications, terms of service, or regulatory filings?

EU AI Act (transparency); OECD AI Principles: Where AI materially affects people, its use should be disclosed in relevant communications, terms or filings.

T-BG-GL001.6.4

Has the board approved a framework for managing reputational risk arising from AI-related incidents - including a communication protocol for public-facing AI failures, regulatory disclosures and stakeholder notifications - and has this framework been tested?

NIST AI RMF (Manage); ISO/IEC 42001: A tested framework for AI-related reputational risk, including a public-failure communication protocol, protects the organisation.

T-BG-GL001.6.5

Is the board regularly updated on the global AI regulatory landscape - including the EU AI Act, sector regulations, and emerging national AI policies in the markets where it operates - so that it can anticipate and prepare for regulatory change?

EU AI Act; OECD AI Principles: The board should be kept current on the global AI regulatory landscape across its markets, so it can anticipate change.

AI Governance Oversight Checklist

Your AI governance gap requires urgent board attention.

Strong foundations. Specific gaps remain.

Governance excellence, well evidenced.