Assess whether your AI governance is ready to scale

The management discipline that keeps AI use safe, lawful and worth the money: knowing what AI you run, deciding who approves it, controlling what data reaches it, checking its outputs, and being able to prove all of that to a board, a customer or a regulator. It is the same discipline organisations already apply to money and personal data, applied to AI.

A structured way of scoring whether an organisation can scale AI safely. This scorecard rates fourteen areas from ownership and board oversight through data protection, human review and supplier controls, and turns the result into a score out of 100, a verdict on scaling, your greatest exposures and a 90 day plan.

Above 70, with none of the three gate areas scoring critically low, means the foundations can carry more AI. Between 40 and 69 is typical for organisations that adopted AI faster than they governed it: scale is possible with guardrails. Below 40, the gap between use and control is where incidents come from, and containment comes before expansion.

The formal version of everything this scorecard measures: documented ownership, an inventory, risk classification, controls, reviews and evidence, run as a system rather than a set of good intentions. It is justified once AI touches products, customer decisions or regulated activity, or once someone external asks for proof.

ISO/IEC 42001 is the certifiable standard for AI management systems. It is worth assessing when customers, regulators or insurers ask you to prove AI is controlled, or when AI sits inside what you sell. If nobody is asking yet, build the management system first and treat certification as a later formality. The scorecard gives you a straight answer for your situation.

It applies when you place AI systems on the EU market, use them in the EU, or their outputs affect people in the EU. Many UK organisations are in scope without realising it through EU customers and group companies. UK data protection law, enforced by the ICO, already applies to AI use on personal data regardless.

Directionally accurate and optimistic. In our experience an independent review lands about one level below the self view, because inventories are less complete and controls less enforced than they appear from inside. Treat your result as an upper bound.

Contain the data exposure first: say what may never enter AI tools and block the obvious routes. Then name an executive owner and build the first inventory. Those three moves cost little, take weeks and remove the exposures that do the most damage. The 90 day plan in your report sequences this for your specific answers.