AI Governance Analyzer

01 — Governance & Accountability

Does your organization have a named AI governance owner with defined scope and authority — or a title on an org chart? The analyzer evaluates whether accountability is structural: whether governance decisions have a traceable owner, whether policy enforcement has an operational mechanism, and whether the board receives AI risk reporting with demonstrable evidence rather than narrative summaries. Accountability without enforcement authority is documentation, not governance.

02 — Data Governance

Can your organization demonstrate that the data used to train, fine-tune, or prompt AI systems was evaluated for quality, bias, and provenance before use? Training data governance is the domain most consistently absent in organizations that claim AI maturity. The analyzer evaluates data classification coverage, bias review processes, and whether data governance controls apply to AI-specific data flows — not just enterprise data at rest.

03 — Security Controls

AI systems introduce attack surfaces that don’t exist in conventional infrastructure: prompt injection, model inversion, data exfiltration through inference endpoints, and credential exposure through AI toolchains. The analyzer evaluates whether security controls specific to AI deployment — not inherited from general IT security policy — are defined, enforced, and tested. AI-specific threat modeling is the distinguishing marker of genuine security control maturity in this domain.

04 — Operational Controls

Can your organization demonstrate that AI systems in production are monitored for drift, degradation, and output quality — and that incidents have a defined response path? Operational control maturity requires more than deployment: it requires that deployed systems have defined owners, defined performance thresholds, and documented response procedures tested against actual AI failure scenarios. The analyzer evaluates monitoring coverage, incident classification, and operational change management for AI systems.

05 — Vendor Oversight

AI vendor risk looks different from conventional third-party risk. Model behavior is not auditable through standard vendor questionnaires. Data retention and training practices vary by vendor and change without notice. The analyzer evaluates whether AI vendors — including foundation model providers, fine-tuning platforms, and AI-embedded SaaS — are subject to governance review before onboarding, and whether ongoing oversight includes AI-specific contractual and technical controls.

06 — Monitoring & Assurance

Governance without assurance is policy without evidence. The analyzer evaluates whether AI governance controls are subject to independent review — internal audit coverage, external assessment, or regulatory examination — and whether governance metrics are measured against defined targets rather than reported as narrative status updates. Assurance maturity is what separates governance that can withstand scrutiny from governance that exists only in documentation.

AIG-1 — Ad Hoc

AI governance exists informally or not at all — decisions are made without defined policy, accountability, or oversight structure. Most organizations deploying AI tooling at pace without a governance program land here.

AIG-2 — Emerging

Governance policies are being defined, but coverage is incomplete — key domains such as vendor oversight or data governance may be absent, and accountability is not yet enforced operationally.

AIG-3 — Defined

Governance policies are documented and ownership is assigned across most domains, but enforcement is inconsistent and assurance evidence is limited — governance is real but not yet audit-ready.

AIG-4 — Controlled

Governance controls are enforced across all six domains, metrics are tracked against defined targets, and governance posture can be demonstrated with evidence — this is the threshold for regulatory examination and enterprise procurement scrutiny.

AIG-5 — Governed

Governance is continuously measured, independently assured, and integrated into AI system lifecycle decisions — the standard required for regulated industries, sovereign AI programs, and organizations where AI governance is a board-level accountability.

Assumption-Driven Posture

The most common governance failure: organizations assume governance controls are operational because policies are documented. A data governance policy that names owners does not demonstrate that ownership is exercised. An AI security standard that references frameworks does not demonstrate that controls are implemented. Audit scrutiny — regulatory or customer — tests demonstrability, not documentation.

Evidence Concentration

Governance evidence concentrated in one team, one system, or one person creates a single point of failure for every downstream audit or review. The one compliance manager who holds all governance artifacts goes on leave. The one platform that stores governance evidence is inaccessible during an incident. Concentration risk in governance evidence is structurally identical to concentration risk in recovery authority — it surfaces at the worst possible moment.

Control Decay

Governance controls degrade when they are not actively maintained. Vendor lists become stale. Data classification coverage erodes as new AI data flows are introduced without review. Incident response procedures that were tested twelve months ago have not been retested against the AI systems deployed since. Control decay is invisible in point-in-time documentation reviews — it surfaces in operational testing and in the gaps between a policy’s last update date and the environment it was meant to govern.

Shadow AI Adoption

The most pervasive AI governance gap today: Copilot, ChatGPT Enterprise, Claude, Amazon Bedrock, Google Vertex — deployed by business units, embedded in productivity tools, and activated through vendor defaults — operating outside the governance perimeter entirely. An AI system inventory that does not include shadow AI adoption is not an inventory of AI risk. It is an inventory of AI risk the governance team already knows about.

AIG Tier Assignment

AIG-1 through AIG-5 maturity classification, derived from kill switch state and domain scores. The tier is the first output — displayed prominently before domain scores or remediation detail — because the governance question an executive or regulator asks first is not “what is your score?” It is “what tier are you at?” The tier is the answer that drives every conversation that follows.

AIGA Score

0–100 weighted composite across six governance domains. Score and tier are presented as distinct outputs — the score provides precision within a tier, the tier provides the classification that audit and procurement frameworks reference. An organization scoring 58 and an organization scoring 72 are both AIG-3, but the remediation path to AIG-4 is materially different.

Kill Switch Analysis

All triggered kill switches are listed before domain scores — because a kill switch identifies a foundational control absence that caps tier regardless of domain performance. Each triggered switch names the missing control, the domain it belongs to, and the maturity ceiling it imposes. Kill switches are the governance equivalent of a recovery kill switch: the thing that stops the entire system before anything else matters.

Domain Score Breakdown

Individual scores across all six governance domains — Governance & Accountability, Data Governance, Security Controls, Operational Controls, Vendor Oversight, and Monitoring & Assurance — rendered as labeled score bars. Domain breakdown identifies which specific areas are driving the aggregate score and which are the highest-leverage remediation targets.

Remediation Projection

The deterministic path to the next tier: top three remediation actions, exact point gain per control, projected score and tier after implementation. Remediation projection answers the governance question that follows every assessment: “What do we do first?” The answer is not a prioritization opinion — it is the mathematically minimum path to the next tier given the current gap.

Executive Summary Narrative

A generated narrative summary of the governance posture assessment — AIG tier, AIGA score, triggered kill switches, top gaps, and recommended actions — formatted for direct use in a board briefing, audit preparation package, or executive governance review. Most people read the narrative first. It is the output that makes every other finding accessible to the audience that needs to act on them.