Q1: Does your organization have a clear, documented AI strategy that aligns with business goals and ethical principles?

No formal strategy; AI use is ad-hoc. Informal discussions or departmental initiatives, not organization-wide. Documented AI strategy with leadership buy-in, includes ethical considerations. AI strategy is deeply integrated into overall business strategy, driven by executive leadership, and regularly reviewed against ethical principles.

Q2: Is there dedicated leadership or a committee responsible for overseeing AI governance?

No specific leadership/committee. Ad-hoc discussions among senior managers. Designated roles or a working group with defined responsibilities for AI governance. A high-level, cross-functional AI Governance Committee/Office with clear authority and resources.

Q3: How systematically do you identify, assess, and mitigate AI-specific risks (e.g., bias, privacy, security, safety)?

Risks are addressed only when problems arise. Informal discussions or project-specific risk logs. Formal risk assessment methodologies applied to AI systems, with documented mitigation plans. Proactive, continuous AI risk management integrated into enterprise risk frameworks, with automated monitoring and incident response.

Q4: Are there clear policies and standards for AI development and deployment that address ethical and regulatory compliance (e.g., GDPR, future AI acts)?

No specific AI policies; general IT policies apply. Awareness of some regulations, but no formal internal policies for AI. Internal policies and guidelines are being developed or in early implementation, referencing relevant regulations. Comprehensive, well-communicated internal policies and standards for AI, regularly updated to reflect evolving regulatory landscapes and best practices, with clear compliance mechanisms.

Q5: How are responsibilities and accountability for AI system performance, fairness, and risk defined?

Unclear or ad-hoc accountability. Some project-level ownership, but no organizational clarity. Defined roles and responsibilities within project teams, with some escalation paths. Clear, organization-wide accountability framework for AI, including designated human oversight mechanisms for high-risk systems, and clear audit trails.

Q6: What documentation and communication efforts exist to explain AI systems' purpose, logic, and limitations to internal and external stakeholders?

Minimal documentation, if any; explanations are ad-hoc. Technical documentation exists, but not easily understood by non-experts. Standardized documentation templates, with efforts to simplify explanations for various audiences. Comprehensive, user-centric documentation (e.g., model cards, impact statements), proactive communication strategies for transparency, and clear mechanisms for users to query or challenge AI decisions.

Q7: How are AI systems continuously monitored for performance, drift, bias, and adherence to policies post-deployment?

No systematic post-deployment monitoring. Basic performance monitoring, but limited to operational metrics. Regular monitoring of key performance indicators, with some checks for fairness and drift. Robust MLOps practices including automated, continuous monitoring for performance, bias, drift, and security, with automated alerts and defined response protocols for issues.

Q8: Are there established feedback mechanisms and review processes to continuously improve your AI governance framework?

No formal process for reviewing governance. Ad-hoc reviews, if prompted by incidents. Periodic reviews of governance policies and processes, with identified improvement areas. Continuous learning loop for AI governance, incorporating feedback from audits, incidents, regulatory changes, and stakeholder input into regular, proactive framework updates.

Q9: How actively does your organization engage with internal (employees) and external (customers, public) stakeholders on AI-related ethical and societal impacts?

Limited or no engagement. Reactive engagement when issues arise. Some formal channels for feedback and discussion (e.g., surveys, public statements). Proactive, multi-directional engagement with diverse stakeholders, fostering trust and incorporating varied perspectives into AI development and governance.

Q10: What training and awareness programs are in place for employees on responsible AI, ethics, and governance policies?

No specific AI ethics training. Ad-hoc or optional webinars on AI ethics. Mandatory basic training on AI ethics and governance policies for relevant teams. Comprehensive, role-specific training programs for all relevant employees, including ongoing professional development in responsible AI practices and ethical considerations.