You Can’t Govern AI You Can’t See: The Free AI Governance & Risk Exposure Assessment
Nov 5, 2026 · @disc
Ask a leadership team how many AI tools their company uses and you’ll get a confident number. Ask how they know, and the room goes quiet.
That silence is the real AI risk. It isn’t the model you approved last quarter. It’s the meeting recorder a sales rep installed, the copilot your CRM vendor switched on by default, and the agent an engineer wired to production with a shared API key. None of them are in a register. None of them have an owner. And all of them are touching data you’re contractually obligated to protect.
That’s why we built the AI Governance & Risk Exposure Assessment: a free, 8-minute self-assessment that shows where your AI exposure actually sits, before a customer questionnaire, an auditor, or an incident shows you first.
Stop asking whether you need ISO 42001
Most AI governance conversations start in the wrong place: “Do we need ISO 42001?” or “Does the EU AI Act apply to us?” Those are good questions. They’re just not the first ones.
You can’t pick a framework for risks you haven’t found. A certification scoped around three sanctioned tools means little if forty unsanctioned ones are processing customer data. And a policy nobody can enforce is a document, not a control.
The first job is discovery. What’s running, what it touches, who owns it, and what you could prove tomorrow. Frameworks come after you know what you’re governing. This assessment is built to do that first job.
Seven questions your board and your buyers will ask
Every enterprise security questionnaire, board briefing, and regulatory inquiry about AI eventually reduces to seven questions. The assessment is designed to tell you which ones you can answer with evidence today.
- What AI applications and agents are being used? Including AI features inside SaaS tools you already pay for, and agents acting on someone’s behalf.
- Are employees using unauthorized AI tools? Shadow AI is where most confidential data quietly leaves the building.
- Is sensitive or confidential data exposed to AI systems? Prompts, uploads, and retrieval pipelines that ignore the source system’s permissions.
- Are AI vendors and third-party models being assessed? Click-through terms often allow training on your inputs, and on your customers’ inputs.
- Are AI systems subject to appropriate human oversight? Not a checkbox. A reviewer with authority, context, and a logged decision.
- Are AI risks documented and assigned to accountable owners? Unowned risk is unmanaged risk.
- Can the organization demonstrate compliance with applicable AI requirements? “We have a policy” is not evidence. A dated, versioned record is.
When you finish, each question comes back marked Blind spot, Partial visibility, or Demonstrable, along with the specific control dragging it down.
How it works
The assessment asks 25 questions across six areas. Each answer is a concrete description of how things work in your organization today, scored on a five-level CMMI-style scale from L1 Initial to L5 Optimizing.
| Area | Questions | What it uncovers |
| Governance | 5 | AI inventory, policy, accountable owners, risk register, impact assessment |
| Security | 4 | Shadow AI, sensitive data exposure, prompt injection testing, agent permissions |
| Compliance | 4 | Regulatory applicability, audit-ready evidence, AI disclosure, internal audit |
| Third-Party Risk | 4 | Vendor due diligence, AI contract terms, embedded SaaS AI, foundation model risk |
| Human Oversight | 4 | Human review, stop and override, evidence of oversight, AI literacy |
| Model & Agent Monitoring | 4 | Drift, agent action logging, AI incident response, output quality |
Every question shows the controls it maps to, so your team learns the frameworks as they answer:
- ISO/IEC 42001:2023 clauses and Annex A controls, such as A.4.2 for resource documentation and A.10.3 for suppliers
- NIST AI RMF 1.0 subcategories across Govern, Map, Measure, and Manage
- EU AI Act articles, including Art. 4 (AI literacy), Art. 14 (human oversight), and Art. 50 (transparency)
- OWASP Top 10 for LLM Applications and MITRE ATLAS where the risk is adversarial, such as prompt injection and excessive agency
The questions are written for 2026 realities, not 2023 ones. They ask whether your agents have scoped credentials and tool allowlists, whether MCP servers are vetted before use, whether you know when a SaaS vendor switches on a new AI feature, and whether you can reconstruct exactly what an agent did and on whose behalf.
What you walk away with
Results appear the moment you finish. No sales call required to see them.
- An exposure index from 0 to 100, with an exposure tier and an overall maturity level. The tier is tied to the maturity level, so the headline never contradicts the detail.
- A radar chart of all six areas, with a dashed ring marking L3 Defined. That’s the minimum most enterprise buyers and auditors expect to see evidenced, and it shows at a glance which areas fall inside it.
- The seven questions, answered. Each one marked as a blind spot, partial visibility, or demonstrable, with the weakest underlying control named.
- Your top five priority exposures. Ranked by distance from the L3 baseline and weighted by how often each gap drives incidents, regulatory findings, or stalled deals. Each comes with four specific remediation steps, a typical effort estimate, and its framework references.
- An area-by-area readout of what your scores mean in practice.
- A board-ready PDF report, with a cover summary, the radar, priorities, and a full appendix of your answers mapped to ISO 42001, NIST AI RMF, and the EU AI Act.
The remediation steps are practitioner-level, not generic. “Pull 90 days of SSO, expense, and DNS logs to identify AI tools in use.” “Give every agent its own identity and short-lived, scoped credentials.” “Log what the reviewer saw, what they changed, and why.” Things your team can start on Monday.
Who should take it, and when
The assessment is built for CISOs, CIOs, CTOs, compliance leads, and founders at B2B SaaS and financial services firms. It’s most useful at moments like these:
- An enterprise customer just sent an AI security questionnaire and the deal clock is running.
- The board asked “what’s our AI risk?” and you need a defensible answer, not a guess.
- You’re deploying AI agents and want to know what could go wrong before it does.
- You suspect shadow AI or data leakage but can’t measure it.
- You’re weighing ISO 42001 certification and want to know how far away you actually are.
- EU AI Act transparency duties are already in effect and you’re not sure what applies to you.
It also works as a team exercise. Have security, legal, and engineering answer independently, then compare. Where the answers disagree is usually where the real exposure lives.
My perspective
I’ve taken a client through ISO 42001 certification on the first audit attempt, in a financial data room environment where every control gets tested hard. The lesson I keep coming back to is that the gap is almost never the policy. Most organizations can write a decent AI policy in a week. The gap is visibility and evidence.
In nearly every engagement, the first discovery sweep turns up AI the leadership team didn’t know about. A vendor feature enabled by default. A browser extension with access to every tab. An agent with more access than any human would be granted. And when I ask for evidence of human oversight, I usually get a checkbox. A checkbox captures what the reviewer said they did. It doesn’t show what they saw, what they changed, or why. Regulators and plaintiffs will ask for the second.
That’s why I built this assessment around discovery rather than a framework pitch. If you can answer all seven questions with evidence, you’re in better shape than most, and certification is a short step. If you can’t, you’ve just learned where to start, and that’s worth more than any certificate scoped around the AI you already knew about.
Find your blind spots in 8 minutes
Take the free AI Governance & Risk Exposure Assessment
Take the free AI Governance & Risk Exposure Assessment and get your exposure index, radar, and top five priority exposures instantly, plus a PDF report you can take to your board.
Want help reading the results? Book a 30-minute results review. We’ll walk through your scores, separate real exposures from questionnaire noise, and outline the shortest path to AI governance you can demonstrate. For teams ready to move, the DISC InfoSec AI Governance Quick-Start delivers AI and agent discovery, a shadow AI and data exposure review, a risk register with named owners, and a remediation roadmap in 7–10 days.
DISC InfoSec is a boutique AI governance and cybersecurity consultancy in Petaluma, California, and a PECB Authorized Training Partner. Our team holds AICP, CISSP, CISM, ISO/IEC 42001 Lead Implementer, and ISO/IEC 27001 Lead Implementer credentials. Contact: info@deurainfosec.com | (707) 998-5164.
https://www.deurainfosec.com/disc-infosec-home/aims-iso42001-ai-governance/
- You Can’t Govern AI You Can’t See: The Free AI Governance & Risk Exposure Assessment
- Your ISO 27001 Certificate Has an AI-Shaped Hole in It
- Someone Is Running Your AI Models Right Now. You’re Paying for It
- Your AI Agent Is Only as Secure as Its Harness: The Hidden Layer of AI Risk
- Your AI Is Live. Your Site Is Your Shop. Who’s Answering for Either?
