Prepared using Triance, Draita’s AI Governance Navigator.
All figures below are illustrative sample data for a fictional organization.
Executive summary
Ready for a controlled pilot, not for organization-wide deployment
Northbridge Group has clear executive intent and a mature security baseline, which places it ahead of most organizations of similar size. Readiness is constrained by governance foundations rather than technology: there is no maintained inventory of AI tools, permissions across document repositories have not been reviewed for assistant-scale access, and generative AI is not yet covered by an approved policy.
These are addressable within one quarter. We recommend proceeding with a scoped pilot in parallel with remediation, then reassessing before broad rollout. Four material questions were answered Unknown, and each should be resolved before licences are extended beyond the pilot group.
Overall readiness
62%
Pilot ReadyClassification bands: Not Ready (0-39), Foundation (40-54), Pilot Ready (55-74), Deployment Ready (75-100).
Where you are strong
Strongest areas
Security
78%Identity controls, MFA enforcement and endpoint baselines are mature and consistently applied.
Strategy and ownership
74%Leadership intent is clear and AI objectives are recognised at board level.
People and adoption
68%Staff appetite is high and early champions have emerged in operations and marketing.
Where you are exposed
Highest-priority gaps
AI inventory
41%High riskNo maintained register and no measurement of unsanctioned tool usage.
Data and access
48%High riskPermission hygiene and data classification are not ready for assistant-scale access.
Operations and evidence
55%AttentionControls are informal and cannot currently be evidenced to auditors or customers.
Risk and compliance
57%AttentionPolicy coverage and vendor assurance are incomplete for regulated data.
Recommendation
Deployment recommendation
Proceed with a controlled pilot of up to 40 Microsoft 365 Copilot licences, limited to departments whose repositories have completed a permissions review. Defer ChatGPT Enterprise procurement until vendor data residency and sub-processor terms are assessed. Do not extend licences organization-wide until the AI inventory, policy and retention controls are in place and evidenced.
- Recommended scope
- Pilot — 40 licences, 3 departments
- Reassessment point
- Day 90, before wider rollout
- Blocking conditions
- Inventory, permissions, policy
Priorities
Top five actions
- 1Assign a named executive owner for AI adoption and governance.
- 2Complete a permissions and oversharing review on all repositories in scope for assistants.
- 3Approve and communicate the AI acceptable-use policy with an acknowledgement record.
- 4Establish the AI tool register and run a first discovery sweep for unsanctioned tools.
- 5Define retention rules for prompts, outputs and chat histories.
Basis of assessment
Assessment methodology and disclaimer
The assessment covers seven governance areas — strategy and ownership, AI inventory, data and access, risk and compliance, security, people and adoption, and operations and evidence. Each area contains structured questions answered as Yes, Partially, No, Unknown or Not applicable. Responses are scored, weighted by the organization profile (size, industry and regulatory exposure), and normalised to a percentage per area. The overall readiness score is the weighted mean of the seven area scores, and the classification band is derived from that score.
Unknown responses are treated as unresolved risk rather than neutral, because unverified controls cannot be evidenced to an auditor, insurer or enterprise customer. Not applicable responses are excluded from the denominator of their area.
Disclaimer: this report is based on self-reported responses and has not been independently verified through technical testing or document review. It is provided for management planning purposes and does not constitute legal, regulatory or audit advice. Figures shown in this prototype are illustrative sample data.