| 1. The board has designated clear ownership of AI oversight (full board, audit, or a technology committee). | Not in place |
| 2. Management has presented a written inventory of AI systems in use and in development. | Not in place |
| 3. Each material AI use case has a named executive owner. | Not in place |
| 4. The company has a written policy governing employee use of external AI tools. | Not in place |
| 5. AI-related risks appear on the enterprise risk register with likelihood and impact ratings. | Not in place |
| 6. The board has reviewed how AI decisions affecting customers or employees can be explained and appealed. | Not in place |
| 7. Data used to train or prompt AI systems has documented provenance and permission. | Not in place |
| 8. Vendor AI claims are validated before contracts are signed, not after. | Not in place |
| 9. The company measures AI initiatives against pre-committed success metrics. | Not in place |
| 10. There is a defined incident-response path for AI failures or model misbehavior. | Not in place |
| 11. The board receives an AI briefing at least quarterly with metrics, not anecdotes. | Not in place |
| 12. Directors have completed at least one substantive AI education session in the past year. | Not in place |