AI readiness assessment

20 questions, scored against the four functions of the NIST AI Risk Management Framework and read a second time against the UK's five cross-sectoral AI principles. It asks what you can evidence, not what you intend.

Your score is shown on screen and costs nothing. It takes about five minutes, and it shows its own arithmetic.

Step 1 of 60 of 20 questions answered

About your organisation

This is not scored. It decides which use cases and which regulators appear in your result. An answer about AI readiness means nothing without knowing what you already run.

What industry are you in?*

How many people work at your organisation?*

What do you run for finance and ERP?

What do you run for payroll and HR?

What do you run for procurement and supplier management?

What do you run for manufacturing, MES or field operations?

What do you run for CRM, sales and customer service?

Which AI tools are already in use?

Include anything that arrived inside a tool you bought for something else. That is where most organisations undercount.

Industry and size are needed to tailor the result.

Method and sources

Twenty questions, five under each NIST function, every question worth the same. There is no hidden weighting: your score is the number of controls you hold out of a possible sixty points. Anything below "Mostly" is reported as a gap. A small number of questions cover controls with a hard floor, and a "No" on one of those is reported separately rather than averaged into the total.

Framework sources

NIST AI Risk Management Framework (AI RMF 1.0). The GOVERN, MAP, MEASURE and MANAGE functions are used as the scoring structure.
Introduction to AI assurance (DSIT, 12 February 2024), the definition of assurance and the six techniques every recommendation resolves to.
A pro-innovation approach to AI regulation (DSIT, March 2023), the five cross-sectoral principles used as the second lens.

The six assurance techniques

Risk assessment: "Used to consider and identify a range of potential risks that might arise from the development and/or deployment of an AI product/system."
Impact assessment: "Used to anticipate the wider effects of a system/product on the environment, equality, human rights, data protection, or other outcomes."
Bias audit: "Assesses the inputs and outputs of algorithmic systems to determine if there is unfair bias in the input data, the outcome of a decision or classification."
Compliance audit: "Involves reviewing adherence to internal policies, external regulations and, where relevant, legal requirements."
Conformity assessment: "The process of conformity assessment demonstrates whether a product or system meets relevant requirements, prior to being placed on the market."
Formal verification: "Formal verification establishes whether a system satisfies specific requirements, often using formal mathematical methods and proofs."

Limits

This is a self-assessment, so it measures what you believe to be true about your organisation. It is not an audit, not a certification, and not legal advice. A high score is not a defence; the NIST framework is voluntary and non-certifiable by design. Sector guidance across the 21 industries covered here is summarised, not exhaustive. Where a regulator is named, read their guidance rather than ours.