Control Readiness Assessment
Could you prove it?
If one of your AI agents made a consequential decision tomorrow, could you prove who authorized it, stop it in time, and show the record? The paid Control Readiness Assessment answers that question on one of your real workflows, not on your policy binder.
What it weighs
Seven control domains.
- Authority and Access
- Enforcement and Containment
- Evidence and Provenance
- Human Oversight and Accountability
- Data Governance and Sovereignty
- Regulatory Alignment
- Board and Operating Model
Each area is placed on one maturity scale: 0 None1 Documented2 Implemented3 Enforced4 Proven
- Exposed
- Policy without enforcement
- Developing
- Controls exist, not enforced
- Governed
- Enforced at runtime
- Provable
- Enforced and independently verifiable
Indicative score and paid assessment
A profile is not a test.
The indicative score
- Comes from your answers to the readiness check's six questions, with no login.
- Gives an indicative Control Readiness Score from 0 to 100 and the widest gaps between what your AI policy claims and what your controls can prove today.
- Holds enforcement and evidence low on purpose, because a profile cannot show runtime enforcement or an independently verifiable record. Only testing can.
- Is an indicative score from your profile, not a tested result. It is not an ICA credential.
The paid assessment
- Tests enforcement and evidence directly, the two hardest to reach without a control plane, and gives a separate, tested result. It is not blended with the indicative score.
- Starts from one consequential AI workflow, the one that would hurt most if an agent made the wrong call, or the right call with no evidence to prove it.
- Asks the same three questions of that workflow: who authorized the action, whether it could be stopped in time, and whether the record holds.
Find out where you really stand.
Tell us which AI workflow matters most and we will scope the assessment around it.