Eqwitty AI ReadinessAI Governance & Security readiness
Governance is the pillar that determines whether an organization can scale AI safely, and it is also the pillar boards ask about first. The questions cover who signs off before an AI system goes live, whether risk is tiered so low-risk tools move fast, how security handles AI-specific threats, and how prepared the organization is for AI regulation.
The behaviorally anchored answers run from "whoever builds it switches it on" to "a risk-tiered review board with monitoring after launch". You pick the one that matches reality.
What this pillar measures
Policy, ethics, compliance, security, and risk management for AI.
AI Governance & Security is weighted at 10% of the overall AI Readiness score, which makes it the 6th heaviest of the nine pillars. 4 scored questions feed its maturity score. See how the weights combine.
What we ask
Every scored answer describes a recognizable state of the world rather than an agree/disagree rating. These are the questions behind this pillar.
- Before a new AI tool goes live, who has to sign off on it?Who gives the go-ahead before a new AI tool is switched on for real users.
- In the last year, has AI caused a problem? (For example: it treated people unfairly, confidently gave wrong answers, went down, or drew a regulator's attention.)Honest answers help us help you — these problems are normal.
- How do you make sure your AI is used fairly and responsibly?How you make sure AI treats people fairly and is used responsibly — not just that it works.
- How do you keep your AI on the right side of the rules (data-protection laws, the EU AI Act, and any rules specific to your industry)?How you keep AI within the law — privacy rules, the EU AI Act, and anything specific to your industry.
What each level looks like
Each answer maps to a maturity score from 0 to 4. Reading down a column shows what an organization at that level typically says.
| 1Awareness | No sign-off — whoever builds it switches it on |
| 2Active | A technical lead takes a look |
| 3Operational | A couple of teams review it (e.g. data plus legal or security) |
| 4Systemic | A dedicated AI review group |
| 5Transformational | It depends on how risky it is — bigger risks get more review |
| 2Active | Yes — and it caused real damage |
| 3Operational | Yes — but minor, with no wide impact |
| 4Systemic | None that we know of |
| 5Transformational | No — and our monitoring has caught and stopped issues early |
| 1Awareness | No set approach |
| 2Active | We're aware of the risks but have no process |
| 3Operational | Written guidelines, but applied unevenly |
| 4Systemic | A review for important AI, with written checks |
| 5Transformational | Built-in checks, including automatic tests for bias and fairness |
What a strong score unlocks
A strong score lets governance enable speed rather than replace it. Low-risk tools ship in days, high-risk systems get the scrutiny they need, and the organization can answer a regulator or a customer without scrambling.
Other pillars
All nine pillars, their weights and the scoring math are on the methodology page.
Find out where you stand
A 15-minute diagnostic, then your nine-pillar score, peer benchmarks and a 90-day plan you can act on Monday. One-time payment of CA$19.80 per report.