Frequently Asked Questions

A structured, framework-aligned evaluation of your AI governance posture, produced by inviting stakeholders across your organization to answer maturity-scaled questions against a named standard (NIST AI RMF, EU AI Act, ISO/IEC 42001, or a combined stack). Results include a scored posture, severity-tiered findings, and a remediation register — all traceable to the specific control they map to.

Question count is calibrated to organization size (85 to 144 questions for NIST AI RMF; 90+ for EU AI Act; 56 to 110 for ISO/IEC 42001). Each participant needs 1-3 hours; the full engagement typically runs across several days as stakeholders respond.

The snapshot is 14-15 questions, directional only, and takes under 10 minutes. It tells you whether you are trending in a good direction or a bad one. The full assessment is a multi-stakeholder engagement that produces the defensible, auditable report.

If you use AI tools others built, start with NIST AI RMF (Full). If you build, fine-tune, or deploy generative AI, choose NIST AI RMF 600. If you are subject to EU market obligations or pursuing ISO 42001 certification, choose those directly. The framework router walks through it.

Someone with cross-functional visibility — typically a CIO, CISO, GRC leader, or program manager. They configure the assessment, invite participants, and receive the final report.

Ten licenses at the Small tier, 25 at Medium, 35 at Large. Additional seats can be requested.

No. Questions are worded for the person best positioned to answer, and "I do not know" is a valid and scored response.

Individually or by bulk CSV upload. Each participant gets an email invite with a unique link.

The question set is anchored to the governing framework and versioned in the compendium — customization on the questions themselves would break defensibility. But you choose the framework, the tier, the participants, and the response window.

Yes. Progress is saved as they go.

"I do not know" is valid. The alignment analysis measures where responses diverge across participants — divergence is itself a finding.

Yes, up until submission. The Assessment Lead can add, remove, or replace participants.

Yes. Participants receive automated reminders as the response window approaches.

The assessment itself, all participant seats for your tier, and the scored report.

The first 25 charter clients per product receive a significant discount in exchange for a 30-60 minute feedback interview and permission to publish an approved quote. See the charter program.

Once an assessment has been launched to participants it is generally non-refundable. Contact us before launch for pre-launch changes.

In a secured PostgreSQL database hosted by Railway (US-based). Encrypted at rest, TLS in transit. See our Privacy Policy for the full detail.

The Assessment Lead sees aggregated results. Individual responses are anonymized in the alignment analysis. Data Defenders staff only access data for support or with your explicit permission.

Assessment data is retained for two years plus any regulatory retention obligations. You can request deletion at any time.

Log in and edit your profile. Contact us if you need to transfer ownership between people.

Yes — the interactive report is a browser view; the deliverable is a watermarked, serial-numbered PDF.

Check spam. If still missing, resend from the Assessment Lead dashboard or contact support.

Refresh; if the issue persists, contact support with your assessment ID.