AI Governance Gap Diagnostic | Bridges Strategy

Visibility

Policy

Accountability

Board Readiness

Review

Results

Domain 1: Visibility

Does your organization know where and how AI is being used by staff? Visibility is the foundation of governance — you cannot manage what you cannot see.

Does your organization have a clear picture of where AI tools are currently being used by staff?

No awareness of AI tool usage across the organization Anecdotal awareness only — some staff may be using AI but nothing is tracked An informal inventory or partial understanding exists A formal, maintained inventory of AI tools and their uses exists

Are staff expected to disclose when they use AI tools in their work?

No expectation to disclose Informally encouraged but not required A written expectation exists but is not consistently enforced A written expectation exists and is actively enforced

Do you know which AI vendors or platforms have access to your organization's data?

No visibility into which vendors process our data Vague awareness of some platforms being used A partial list of AI vendors is maintained A complete, regularly reviewed vendor list exists

Has leadership discussed how AI is being used across departments in the past six months?

Not discussed at all Mentioned in passing but not formally addressed Discussed in at least one structured conversation Regular, structured discussions occur on this topic

Please answer all questions before continuing.

Domain 2: Policy

Are there written policies governing how AI may and may not be used? Policy provides the guardrails that turn good intentions into consistent practice.

Does your organization have a written policy governing staff use of AI tools?

No policy exists Informal guidelines have been shared verbally or via email A draft policy exists but has not been formally approved An approved, distributed policy is in place

Since your organization does not yet have an AI policy, the remaining policy questions have been skipped. Your report will include recommendations for getting started.

Does the policy address which types of data may or may not be entered into AI tools?

Data boundaries are not addressed at all Mentioned informally but not documented Partially addressed in a written document Clearly defined data boundaries are documented and communicated

Does the policy cover external-facing AI use, such as communications or constituent interactions?

External-facing use is not covered Briefly mentioned but not scoped Partially covered with some guidelines Clearly scoped and enforced for all external-facing uses

Is there a defined process for reviewing and updating the AI policy?

No review process exists Updates happen ad hoc, without a schedule An informal review cycle exists A scheduled review process with clear ownership is in place

Please answer all questions before continuing.

Domain 3: Accountability

Is someone responsible for AI oversight, and are there processes for raising concerns? Accountability ensures that governance is not just aspirational but operational.

Is there a specific person or role responsible for AI oversight in your organization?

No one is assigned to AI oversight Informally assumed by someone but not officially designated A named person exists but is not resourced or empowered for the role A named, resourced, and empowered person or role is in place

Is there a process for staff to raise concerns or report issues related to AI use?

No process exists Concerns are raised informally, word-of-mouth A process exists but is not well known to staff A clear, accessible process is in place and actively used

Are there defined consequences or corrective actions for misuse of AI tools?

No consequences are defined Handled on a case-by-case basis without guidelines Partially defined but not broadly communicated Clearly documented and communicated to all staff

Please answer all questions before continuing.

Domain 4: Board Readiness

Is the board equipped to govern AI adoption and risk? Board engagement is essential for organizational accountability and strategic alignment.

Has the board received a briefing or education session on AI risks and opportunities relevant to the organization?

The board has never been briefed on AI AI has come up informally once One structured briefing has been delivered The board receives regular briefings on AI matters

Does the board have visibility into how AI is being used operationally?

No visibility at all AI use is occasionally mentioned in meetings AI use is included in operational reports AI governance is a standing agenda item

Has the board discussed its own role in governing AI adoption and risk?

This has not been discussed Briefly raised but not formally addressed Discussed once in a structured way The board's governance role is defined and documented

Please answer all questions before continuing.

Review your answers

Please confirm your answers below before generating your report. You can go back to any domain to make changes.

Your AI Governance Gap Report

Generating your personalized gap report...