Do you maintain a current, complete inventory of every LLM API key, AI licence (Copilot / ChatGPT Enterprise / Gemini), retrieval application, agent, and model endpoint (Azure OpenAI / Bedrock / Vertex / self-hosted) in use across the business?

The single most common gap. Without this, no policy above it holds.

Are proxy and firewall filters set for the major model endpoints, with traffic tagged by business unit?

Set proxy or firewall filters for major LLM API endpoints and tag traffic by business unit.

Do you use a CASB or Defender for Cloud Apps (or equivalent) to surface unsanctioned AI tools employees are pasting data into?

Employees route around bans within a week without a sanctioned path.

Does the inventory include AI features quietly added to tools you already own (CRM, ITSM, analytics, code editors, collaboration)?

Features get switched on without an intake and become part of your estate.

Have you formally defined which data classes (public / internal / confidential / regulated) may be sent to which category of AI tool?

Governance follows data sensitivity, not enthusiasm for a use case.

Do you have DLP inspecting the prompt path to block credentials, source code, and customer information from leaving in a prompt?

The major DLP platforms all inspect the prompt path now.

Do you have zero-data-retention or equivalent retention agreements with your model providers, in writing?

Default APIs often retain data. Close it contractually, do not assume.

Have you reviewed the specific tier and terms for each provider to confirm your inputs and outputs are not used to train their models?

Consumer terms and some enterprise tiers still permit provider use for model improvement.

Is there a sanctioned, logged, DLP-covered Tier 1 tool set (e.g. Copilot for M365, Gemini for Workspace) with no per-use approval friction?

If the sanctioned tool is painful and the public one is easy, you lose.

Do teams building retrieval applications or agents on Azure OpenAI / Bedrock / Vertex have to register through a defined intake process?

Registered use, not ungoverned use.

Do customer-facing systems, autonomous agents, and high-value-decision systems receive a full review (threat model, red team, HITL, kill switch) before launch?

Tier 3 is where the actual damage lives.

Is the sanctioned path measurably easier and faster for employees than routing around it?

Behavioral truth. If the safe path is painful, adoption collapses.

Does the intake capture the use case and its decision authority (advisory vs autonomous)?

Advisory and autonomous systems carry very different risk.

Does the intake capture the data classes touched on input, output, and any fine-tuning?

Fine-tuning bakes data into weights and cannot be unlearned cleanly.

Does the intake capture which model, its hosting location, and its retention terms?

You cannot audit what you did not record.

Does the intake capture where humans review, approve, or override the AI system?

HITL is a control only if it is documented and enforced.

Does the intake capture the failure mode, rollback procedure, and named kill-switch owner?

A kill switch without a named owner is a claim, not a control.

Does the intake determine whether bias and fairness are in scope? (HR, lending, healthcare, legal are automatic yes.)

Automatic yes for HR, lending, healthcare, legal.

Does every agent have its own service principal with least-privilege scopes, using managed identities rather than shared secrets or API keys?

Without this, everything else in this section is unenforceable.

Do agents that can email, delete, spend money, or call external systems operate under an explicit allowlist with rate limits?

Blast radius is set here.

Do you treat any external content (email, web, documents, retrieval results) as untrusted, with structured outputs and output filtering, and design so the blast radius is bounded when injection succeeds?

The right question is: what does the agent lose access to when it happens?

Do you log every prompt, response, tool call, and retrieved document for a meaningful retention window, treating the logs themselves as sensitive with access controls?

The logs will contain the same regulated data as the prompts. Treat them accordingly.

Are per-agent and per-tenant rate and spend limits enforced to bound cost and denial-of-service risk?

Unbounded consumption is both a cost problem and a DoS risk.

Do you refuse to execute model output blindly (no eval on generated code, read-only SQL roles, sanitised rendering)?

Do not eval() model output. Do not run generated SQL without a read-only role.

Does every Tier 2 or Tier 3 system have a regression suite for safety, accuracy, and injection resistance, run on a schedule and before any material change?

A launch red team is a snapshot, not evaluation. Models drift.

Has your vendor questionnaire been updated to ask which model, which provider, whether your data trains their model, retention terms, sub-processors, evaluation and red-team results, and change-notification commitments?

Every SaaS vendor now claims to be AI-powered.

For any self-hosted models, do you pin versions, establish provenance, and scan artefacts for malicious payloads?

HuggingFace pickle exploits are real. This is a documented supply chain vector.

Do your provider contracts require notice of material model changes, a rollback window, and the right to re-evaluate before a new version becomes the default?

Providers rev their models. Your paper should keep pace.

Does every deployed AI system have a single named accountable owner in the business?

This is the Govern function of NIST AI RMF in one sentence.

Do you have identified AI champions in each business unit who surface real use cases and act as the local governance touchpoint?

They know the real use cases before central governance does.

Do you train all staff on safe usage, developers on secure agent patterns, and executives on the risk vocabulary needed to make decisions?

Same skill areas, three different depths.

Have you determined whether the EU AI Act applies (extraterritorial reach if your AI touches anyone in the EU), and mapped your obligations for prohibited practices, GPAI, and any high-risk (Annex III) systems?

Prohibited and GPAI rules are already enforceable. High-risk timing may shift under the Digital Omnibus package; verify current status.

Have you aligned your AI program to the NIST AI RMF core functions (Govern, Map, Measure, Manage) and the Generative AI Profile?

Voluntary framework, but de facto US baseline and often required in federal contracts.

Have you mapped the sector-specific and state rules that apply (HIPAA, GLBA, banking model risk (SR 11-7), SEC AI disclosure, Colorado AI Act, NYC AEDT, CA AB 2013, etc.)?

The state-level list grows quarterly. Map only what touches you.

Have you decided whether to pursue ISO 42001 certification of an AI management system?

Worth pursuing if you want a certifiable AI management system.

Do you have written incident playbooks for: production jailbreak, prompt-injection exfiltration, harmful hallucination, agent acting outside scope, poisoned retrieval corpus?

Assume something will go wrong and rehearse it.

For every autonomous agent, is the kill switch documented and has it been pulled in a drill?

An untested kill switch is a claim, not a control.

Have you tabletopped an AI incident jointly with legal and communications?

The response is as much legal and reputational as it is technical.

On incident, do you snapshot model version, system prompt, tool configuration, and the offending session log at the time of the event?

Providers roll models forward. If you did not capture state, you cannot reconstruct what happened.

Do you track: percentage of AI use cases inventoried vs discovered, time to approve an intake, percentage of agents with dedicated identity and logging, and red-team / evaluation findings closed within SLA?

Activity metrics tell you the program is running.

Do you track: DLP interventions on outbound prompts (and what would have leaked), count of near-miss and actual incidents with mean time to contain, and cost per business unit?

Outcome metrics tell you the program is working. Cost per BU makes finance an ally.

Have you completed the weeks-1-to-4 baseline (discovery, egress logs, shadow AI surfaced, named executive sponsor, interim acceptable-use rule)?

The foundation that everything else assumes.

Have you completed the months-2-to-3 milestones (DLP on prompt path live, Tier 1 tools rolled out with training, intake live for Tier 2/3)?

The point at which the program becomes operational.

Have you completed the quarter-2 milestones (technical baseline on every registered system, first tabletop)?

The point at which the technical controls become the enforced default.

Do you have an ongoing rhythm (vendor process updated, board metrics quarterly, regulatory posture reviewed twice a year)?

The bit programmes forget to build.

Have you published policy without first mapping the estate?

A published policy over an unmapped estate is decoration.

Have you relied on a ban of public AI tools without offering a sanctioned path?

Employees route around bans within a week.

Is your AI vendor assurance a one-time purchase gate rather than a continuous process?

AI features ship monthly. Assurance has to keep pace.

Are you treating a launch red team as ongoing evaluation?

Models drift. A one-time review ages out in weeks.

Are any of your kill switches undrilled?

If no one has pulled it in a drill, it does not exist.

Are you spending disproportionate effort on prompt engineering the model rather than the identity, logging, and allowlists around it?

Prompt engineering does not compensate for missing identity, logging, or allowlists.