AI Readiness
Score Your AI Governance. Fix It in the Right Order.
A structured, framework-aligned assessment of the governance you can actually evidence — scored, tiered by severity, and traceable line by line to the control that produced each finding.
Disclaimer: All of our tools reflect self-reported responses. They are to be used for program improvement, audit readiness, and certification preparation. They are not to be considered legal advice.
Frameworks
Assess Against the One That Applies to You
Every assessment is anchored to a recognized international standard or regulatory framework. Four peer products — NIST AI RMF (Full) for governance baseline, NIST AI RMF 600 for generative AI, EU AI Act for EU market compliance, ISO/IEC 42001 for AIMS certification. Purchase any combination that fits your exposure.
Framework 1
NIST AI RMF (Full)
The U.S. federal voluntary standard for managing AI risks across the full AI lifecycle — no private-sector penalties, but binding on federal agencies via OMB direction and increasingly required in federal contracts and grants. 159 questions across 10 domains: the 4 core NIST functions (Govern, Map, Measure, Manage) plus 6 supplemental measurement maturity spokes. The organizational baseline every other framework assumes. NIST AI RMF 1.0 (AI 100-1), published by the National Institute of Standards and Technology.
See pricing & assessment details →Framework 2
NIST AI RMF 600
The U.S. federal generative AI profile — a standalone assessment for organizations that use generative AI (Deployer) or build or modify it (Provider). 209 questions across 6 domains covering 12 GenAI-specific risk categories: confabulation, harmful bias & homogenization, IP, data privacy, human-AI configuration, value chain integration, and more. Required if your organization uses common enterprise generative AI tools such as Microsoft 365 Copilot, GitHub Copilot, Salesforce Einstein/Agentforce, OpenAI ChatGPT Enterprise, Google Gemini for Workspace, Anthropic Claude for Enterprise, or SAP Joule — or builds, fine-tunes, or integrates any generative AI system. NIST AI 600-1 (Generative AI Profile), published by NIST.
See pricing & assessment details →Framework 3
EU AI Act
The world's first comprehensive AI legal framework — every component is enforceable law. 82 questions across 10 sections covering EU AI Act obligations for providers, deployers, importers, and distributors. AI system classification, conformity obligations, prohibitions, high-risk requirements, transparency, human oversight, and post-market monitoring. Weighted severity gauge with enforcement timelines. Required for anyone with EU market presence or operations. Regulation (EU) 2024/1689, European Union.
See pricing & assessment details →Framework 4
ISO/IEC 42001
The international voluntary standard for AI management systems, increasingly required by enterprise procurement and government contracting — 103 questions across 8 AIMS clauses built around a Plan-Do-Check-Act model. Governance, risk management, impact assessment, data quality, and AI system lifecycle controls. Aligns naturally with ISO 9001 and ISO 27001 management systems. Assessed against the clauses a certification body will examine — outcome path routed by intake questions. ISO/IEC 42001:2023, published by ISO/IEC.
See pricing & assessment details →Try it free · no signup
Our Snapshots. Directional But Real.
14–15 questions each, under 10 minutes, results on screen with a PDF to take away. Every snapshot is a derivative of the corresponding full assessment.
NIST AI RMF (Full) Snapshot
Deployer or Provider governance posture across all 10 NIST AI RMF domains — with measurement discipline built in.
Start SnapshotNIST AI RMF 600 Snapshot
RMF governance plus GenAI-specific 600-1 obligations. Deployer or Provider path routed via intake.
Start SnapshotEU AI Act Snapshot
Prohibitions, high-risk classification, transparency, GPAI. Weighted severity gauge.
Start SnapshotISO/IEC 42001 Snapshot
AIMS certification readiness assessed against all clauses. Outcome path routed via intake questions.
Start SnapshotComing Soon
Snapshots matching the assessments on our roadmap. Compendium content built and verified — activation pending. See the full roadmap for legal-status detail per framework.
U.S. — Multi-State
US State AI Law Snapshot
9 jurisdictions: California CCPA/CPRA + SB 942, Colorado ADMT, Illinois AIVIA, NYC LL 144, Texas TRAIGA, Utah AI Policy Act, Virginia, Connecticut.
U.S. Federal
US Federal AI Policy Snapshot
OMB M-24-10 & M-25-22 obligations for federal agencies and contractors.
United Kingdom
UK AI Governance Snapshot
DSIT five cross-sector principles + ICO/UK GDPR guidance on ADM and AI-driven personal data.
Japan
Japan AI Governance Snapshot
METI/Cabinet AI Guidelines (voluntary) + APPI (hard law) obligations for AI deployments.
China
China AI Governance Snapshot
CAC Algorithm Regulations + GB 45438-2025 AIGC labeling + PIPL AI provisions.
South Korea
Korea AI Governance Snapshot
AI Framework Act tiered obligations for high-impact AI + PIPA AI provisions.
India
India AI Governance Snapshot
DPDP Act 2023 fiduciary obligations + MeitY Responsible AI Principles + sector guidance.
Singapore
Singapore AI Governance Snapshot
IMDA Model AI Governance Framework + PDPA (hard law) + CSA Addendum on Securing Agentic AI.
Australia
Australia AI Governance Snapshot
AI Ethics Framework (voluntary) + Australian Privacy Act (hard law) obligations.
Cross-jurisdictional
CSA Securing Agentic AI Snapshot
Cloud Security Alliance framework for securing autonomous AI agents.
Cross-jurisdictional
Berkeley Agentic AI Snapshot
UC Berkeley CLTC Agentic AI Profile of NIST AI RMF 1.0.
Under Consideration
Frameworks not yet fully ratified, enacted, or in force. Reclassifies to Coming Soon upon enactment.
Brazil
Brazil AI Governance Snapshot
PL 2338/2023 (pending Chamber of Deputies) + LGPD Article 20 ADM rights.
Need one of these first? Or one that's not here?
Tell us — customer votes shape the queue.
How it works
Four Steps. No Scoping Call Required.
1
Configure
Choose your framework and invite participants across departments, roles, or sites — individually or by bulk upload.
2
Assess
Maturity-scaled questions surface real practice rather than aspirational policy. No specialist knowledge required — and "I don't know" is a valid, scored answer.
3
Report
Domain-by-domain posture, severity-tiered findings, prioritized remediation, executive narrative — delivered within minutes of completion.
4
Act
Findings link to the controls they address — a clear line from gap to obligation. Share with boards, auditors, or counsel as-is.
If you don't know the answers
That is the finding. A control nobody can describe isn't governed, and two participants who describe the same control differently means it is applied inconsistently — or nobody was trained. Our alignment analysis measures that divergence explicitly. You don't need to arrive with the answers; where you can't answer, we tell you what it means.
What you receive
What Your Report Will Look Like
The full assessment produces a scored posture across all domains, an organizational alignment analysis, severity-tiered findings, and an executive narrative. Sample excerpts below — request a full sample PDF of any framework to see the complete deliverable.
Executive summary
35.6%
Developing
How AI Ready is this Organization?
Retest Company 2 sits in the Developing tier — governance intent is visible but execution is inconsistent across domains. Three domains are performing at Established level; four require immediate attention before the next enforcement milestone.
Sample deliverable
See the full deliverable
Every sample report includes:
- ·Executive summary with maturity tier
- ·Scored posture across all framework domains
- ·Severity-tiered findings register
- ·Framework alignment analysis
- ·Full remediation register with tool guidance
- ·Watermarked, serial-numbered PDF
Choose from 4 frameworks:
NIST AI RMF (Full) · NIST AI RMF 600
EU AI Act · ISO/IEC 42001
Manage
Your organization lacks a formal data retention policy, leaving AI system outputs and logs without lifecycle governance.
Recommendation: Requires focused attention in current planning period.
▶Show 1 individual recommendation
- Establish data retention and disposition schedules covering AI model outputs, prompts, completions, and audit logs.
▶Show tool guidance
You appear to need help achieving the objective using your current approach. In reviewing the responses, respondents had no common view on whether your organization has AI governance platforms in place. Recommend clarifying your current AI governance platforms state before planning remediation. If tools are absent, example vendors in the space include IBM OpenPages, OneTrust AI Governance, Credo AI.
Observed by 10 of 10 participants
Request a sample report
Choose one of our four framework-anchored sample PDFs — real assessment, fictional company. Executive summary, all domain scores, alignment analysis, findings by severity, and the full remediation register. Work email required.
How we score
Maturity, Severity, and Defensibility
Every response feeds a maturity level. Every gap produces a finding at a named severity. Every finding cites the specific control it maps to. That chain — response, level, severity, control — is what makes the report defensible.
Maturity scale
Severity vocabulary
Defensibility
Every finding references the specific control line within the governing framework — not just the domain — and links back to the response that produced it. The question set, scoring model, and analysis catalog are versioned in a compendium, so you can re-run against an updated version as frameworks change. That is what makes the report auditable rather than advisory.
Read the methodology and maturity model →Who this is for
Three People. Three Reasons.
CIO / CTO
You approved the AI rollout. You have to defend it.
Copilot went live months ago. Now the CEO wants to know what you're doing about it, the general counsel is asking about training data, and finance wants to know what the exposure looks like. The assessment gives you a defensible answer — not an opinion — and a remediation plan you can share.
Security leader
You inherited a rollout you didn't approve.
The tools arrived before the policy did. Your team is running a governance program built for the pre-GenAI world, and the questionnaire on your desk asks about AI. The assessment maps what's already in place, what's missing, and what your team can realistically fix first.
GRC lead
The audit is on the calendar.
You need to walk in with something more than a policy document. Findings tied to specific control lines, prioritized remediation with owners, and a re-run capability so the auditor sees improvement next year — that is what the assessment produces, on your timetable.
Open pricing
Fixed Price. Published.
No scoping call to find out what something costs. All assessments are available now — fixed price, published, no surprises.
Framework 1
NIST AI RMF (Full)
NIST AI RMF 1.0 (AI 100-1) · NIST
The U.S. federal voluntary standard for managing AI risks across the full AI lifecycle. Governance + measurement across all 10 domains — no private-sector penalties, but binding on federal agencies via OMB direction.
- ·159 questions across 10 domains
- ·4 core NIST functions + 6 measurement maturity spokes
- ·Deployer/Provider path routed by intake
- ·Scored, prioritized executive report
- ·35 participant licenses included
Framework 2
NIST AI RMF 600
NIST AI 600-1 (Generative AI Profile) · NIST
The U.S. federal generative AI profile — 12 GenAI-specific risk categories (confabulation, harmful bias & homogenization, IP, data privacy, human-AI configuration, and more). Required for organizations that use or build generative AI.
- ·209 questions across 6 domains
- ·4 core NIST functions + GenAI Deployer + GenAI Provider sections
- ·Covers Copilot, ChatGPT Enterprise, Gemini, Claude, and other enterprise GenAI tools
- ·Scored, prioritized executive report
- ·35 participant licenses included
Framework 3
EU AI Act
Regulation (EU) 2024/1689 · European Union
The world's first comprehensive legal framework governing AI — every component is enforceable law. Providers, deployers, importers, and distributors in the EU market. Penalties up to €35M or 7% of global annual turnover.
- ·82 questions across 10 sections
- ·Provider, deployer, importer, and distributor role coverage
- ·Prohibitions, high-risk classification, transparency, GPAI, governance
- ·Weighted severity gauge with enforcement timelines
- ·35 participant licenses included
Framework 4
ISO/IEC 42001
ISO/IEC 42001:2023 · ISO/IEC
The international voluntary standard for AI management systems, built around a Plan-Do-Check-Act model. Increasingly required by enterprise procurement, government contracting, and cyber insurance underwriting.
- ·103 questions across 8 AIMS clauses
- ·Governance, risk, impact assessment, data quality, lifecycle controls
- ·Aligns with ISO 9001 / ISO 27001 management systems
- ·Outcome path routed by intake questions
- ·35 participant licenses included
Charter Client Program
Help Us Build the Case for
AI Compliance Readiness
Our first 25 charter clients receive 50% off the regular $9,000 price — $4,500 flat — in exchange for sharing their experience with us. Charter pricing applies to the first 25 completed purchases across all four assessments; regular pricing applies thereafter. Applying does not reserve a slot — the 25 slots are claimed at checkout, first-come-first-served. Your discount code is valid until the 25th purchase closes the program.
Required Commitment
Feedback Interview
A 30–60 minute interview after your assessment to share what worked, what could be improved, and where the methodology added value. Can be split between two participants to reduce individual time commitment.
Includes permission to use at least one quote on the Data Defenders website — with attribution you choose, and the opportunity to review the specific text before it is posted.
Optional · Appreciated
Logo Participation
Permission to display your company logo on our website as a Charter Client. Appreciated but not required — clients in regulated industries can participate without granting logo permission.
Logo authorization often requires marketing or legal approval — you can participate in the program without it.
How Quote Attribution Works
Before any quote is published, you review and approve the specific text and choose your preferred attribution format:
- ·Industry-only: "Sarah, VP of Operations, Manufacturing"
- ·Company-attributed: "Sarah K., VP of Operations, Acme Corp"
- ·Decline: No quote published — you remain a charter client without public quotes.
Full Charter Client Program terms are provided as part of your purchase. Participation is voluntary at every step — you can decline quotes, decline logo use, or withdraw consent for either at any time.
Limited to first 25 completed purchases total · Work email required · Applying does not reserve a slot
Talk to a Human
Before You Buy
Twenty-five minutes, no obligation. Bring your framework questions and your snapshot result — we'll tell you honestly whether a full assessment is the right next step.
Available for domestic & international engagements
©2026 Data Defenders, LLC (a Delaware company). All rights reserved. · Home · Privacy Policy
AI Governance Assessments · Fractional CISO · Cybersecurity Programs · GRC