Benchmark methodology
The AI Governance Implementation Check gives you a snapshot of practices you report. Optional organization details support the 2026 research benchmark and January 2027 report.
Published October 31, 2026 · Questionnaire 1.2 · Scoring 1
Research collection is open. The planned closing date is December 15, 2026.
What you answer
There are 12 implementation questions across six areas. Choose whether your answers cover the whole organization, a business unit, one AI system, or a client you advise. Include purchased AI applications and pilots, not only models you build.
The scale is cumulative: 0 means the practice is absent; 1 means informal or partial; 2 means operating with supporting records; 3 adds evidence of effectiveness and review. Each question gives its specific anchors. “Do not know” is valid. For the questions offering “Has not occurred,” use it only when there has been no relevant activity to assess, not when a needed process is missing.
Inventory and ownership
- Do you maintain an inventory of AI systems and AI-enabled tools in use, including vendor and employee-adopted tools?
- Does each inventoried AI use have an accountable owner?
Risk assessment and approval
- Do you assess AI risks before new deployments or material changes, using a documented method?
- Do consequential AI uses require approval before go-live?
Data and vendor governance
- Do you review which data may enter AI systems, including access, retention, and vendor training use?
- Do procurement and renewals check vendor AI capabilities and required safeguards before approval?
Testing and monitoring
- Do you test AI behavior against intended use and relevant failure risks before deployment?
- Do you monitor live use or pilots for failures or misuse?
Incident readiness
- Is there a documented way to report, triage, and contain AI-related incidents?
- Has the incident process been tested or exercised, in a tabletop or real incident?
Accountability and evidence
- Are AI governance responsibilities and decision authority defined and communicated?
- Can you retrieve records of AI assessments, approvals, controls, and reviews when needed?
How scoring works
Each known answer scores 0–3. An area's score is the mean of its known answers divided by 3, expressed out of 100. The overall score equally weights the six unrounded area scores, then rounds for display. It requires at least 10 known answers and at least one known answer in every area.
Unknown and unobserved answers are excluded, never treated as zero. Fewer than 12 known answers makes the result provisional. The labels Starting, Developing, Operating in part and Broadly operating describe this rubric; they are not certifications or a determination of legal compliance. Submitted research scores are fixed snapshots and do not change when you later edit an action plan.
One benchmark, progressively richer evidence
When collection is open, completed checks add answers, scope, AI-use stage and scores to an anonymous pool without contact or organization details. Its averages provide early directional context across different scopes. It is not a count of verified organizations, a percentile, or a representative estimate of the market. Repeat participation cannot reliably be deduplicated into people or organizations.
The API withholds each average until it has at least five usable scores for that statistic. An area can therefore remain unavailable even when the overall comparison is shown. These anonymous averages are separate from reviewed organization comparisons.
Optional organization contributions are reviewed for the expanded benchmark. Primary inclusion requires a verified work email, role and direct knowledge, whole-organization scope, AI in pilots or production, research permission, at least 10 known answers covering all six areas, and manual organization/duplicate review. One reviewed response per canonical organization counts toward the primary target. Conflicting responses are reviewed rather than automatically merged.
Business-unit, single-system, adviser and other responses can still inform separately labeled findings. Skipped optional questions are reported as unanswered; they do not mean “no blockers” or “no demand.” Each optional question uses its own answered denominator.
What contributors receive
Your snapshot and recommended resources need no email or account. Every respondent who submits and confirms their email receives early access to the January report before public release, whether or not their response qualifies for organization comparisons. The submit action requests this access; there is no separate report checkbox. AI Governance Weekly remains a separate optional signup.
Qualified organization comparisons are not available at launch. Future percentiles require at least 50 reviewed whole-organization responses with all 12 answers known under the same questionnaire/scoring versions, plus an implemented comparison release. No particular industry or peer-group comparison is promised. Small published cells will be suppressed below five organizations.
Limits and privacy
Participation is self-selected and practices are self-reported, not independently audited. Recruitment through this site, the newsletter and LinkedIn can bias the sample. Whole-organization/direct-knowledge requirements may favor smaller or centrally governed organizations. We report the sample, scope, versions and missing answers alongside findings rather than generalizing to all companies.
Individual answers, contact details and organization names are not published without separate permission. Submitting requires research permission and requests early report access. Newsletter consent is separate and optional. Identifiable research responses and linked delivery/attempt records are retained no later than January 31, 2028, then deleted; only suitably aggregated findings are retained thereafter. You can request earlier access, correction or deletion through hello@aigovernance.com. We confirm authority before releasing or deleting identifiable data. Anonymous checks cannot be retrieved by email because no email is attached.
Minimal non-contact attempt markers may remain to prevent a late retry from restoring deleted research. They contain no response ID, answers, contact details or request fingerprint.