1. Do you have a written AI use policy that staff have seen?

A policy that names approved tools and prohibited data types.

Yes, published and reviewed in the last 12 monthsYes, but it has not been reviewed recentlyIn draft or informal guidance onlyNo policy

2. Is one named person accountable for AI use across the organisation?

Yes, a named executive or directorYes, a manager without executive sponsorshipShared informally between teamsNobody owns it

3. Do you know which AI tools are actually in use across the business?

Yes, a maintained inventoryPartly — the main tools onlyNo, staff use whatever they choose

4. Is personal or confidential data entered into AI tools?

No, it is prohibited and technically restrictedOnly in approved enterprise tools with a DPIAProbably, but it is not controlledWe do not know

5. Have you completed a data protection impact assessment for your AI use?

Yes, for each significant use caseFor some use casesNo

6. Do your AI contracts prevent your data being used to train vendor models?

Yes, contractually, on enterprise plansOnly via product settingsNo — consumer or free accounts are usedWe have not checked

7. If your main AI provider was unavailable for a week, what happens?

We have a documented fallbackWe revert to manual work with some disruptionA critical process would stop

8. Is AI output reviewed by a competent person before it is used externally?

Always, with a named reviewerUsually, but it is not enforcedRarely — output is often used as produced

9. Does AI influence decisions that materially affect individuals?

For example clinical, legal, credit, hiring, disciplinary or assessment decisions.

NoYes, advisory only with human decision-makersYes, and some decisions are effectively automated

10. Can you reconstruct how an AI-assisted output was produced?

Yes, prompts and outputs are retainedPartly, in individual accountsNo audit trail

11. Have staff been trained on safe and effective AI use?

Yes, role-based training with refreshersA one-off session or self-guided materialNo training

12. Do customers or service users know when AI is involved?

Yes, it is disclosed publiclyOnly if they askNo

13. How is access to AI tools managed?

Central identity management with SSO and offboardingManaged accounts without SSOPersonal or shared accounts

14. Is there a route to report and act on an AI failure or misuse?

Yes, part of the incident processInformally, via a managerNo route

Free AI risk scan for UK organisations