DIAGNOSTIC · FROM $7,500

AI Governance Assessment

A documented answer to the question your board, your regulator or your insurer will eventually ask: who authorized this use of AI, and what evidence do you have?

What it establishes

An AI governance assessment produces the baseline an organization cannot assemble from memory: what is in use, under whose authority, with what data, reviewed by whom, disclosed to whom, and recorded where. Everything after that — policy, training, vendor terms, board reporting — depends on getting that baseline right.

What is examined

Tool inventory: sanctioned, tolerated and shadow use
Data exposure: what information reaches which systems
Authority: who approves tools, uses and exceptions
Human review: where judgment is required and whether it happens
Disclosure: what clients, staff, funders and regulators are told
Records: what evidence of decisions the organization can produce

What you receive

A written governance baseline of current practice
A gap list ranked by exposure, not by effort
A decision owner matrix for every open question
A 90-day remediation plan with sequencing
A board-ready readout and executive summary

The situation

The exposure is rarely the technology. It is the absence of a record.

By the time leadership commissions a governance assessment, AI is usually in daily use across several functions. Someone is drafting client correspondence with it. Someone is summarizing meetings that include personnel matters. Someone pasted a contract into a free tool to understand a clause. None of it was authorized, none of it was prohibited, and none of it was written down.

That is a governance problem rather than a technology problem, and it does not resolve itself with a policy drafted in isolation. A policy adopted on top of unexamined practice simply documents a gap between what the organization says and what it does — which is a worse position than having no policy at all.

The assessment establishes the facts first. It is deliberately uncomfortable reading in places: the interviews surface uses leadership did not know about, and the document review usually shows that vendor agreements already contain terms nobody has read against AI use. From there, the remediation plan is short, specific and sequenced by exposure, so the first month of work removes the largest risks rather than the easiest ones.

How it works

Four phases over three to four weeks.

Your people are needed for interviews. Everything else is my work.

01 · Inventory

What is actually in use

Tooling, accounts, integrations and informal practice across every function, including the uses nobody has reported. Existing policies, vendor terms and prior decisions are reviewed against them.

Deliverable

A current-state inventory of AI use with data-flow notes.

02 · Interviews

How decisions are really made

Confidential conversations across leadership, operations, client-facing staff and whoever holds compliance duties. The question is never whether people use AI; it is what they believe they are allowed to do, and who told them.

Deliverable

Findings by function, with authority gaps identified.

03 · Gap analysis

Exposure, ranked

Each gap is assessed for likelihood and consequence against your sector obligations, contracts and professional duties, then ordered so remediation starts where the organization is most exposed.

Deliverable

Ranked gap register and decision owner matrix.

04 · Readout

Decisions, not a report to file

A leadership or board session that walks through the findings, takes the decisions that can be taken in the room, and leaves the organization with a 90-day plan it can execute without further advisory support.

Deliverable

Board-ready readout, written findings and 90-day plan.

Scope & investment

From $7,500, fixed fee.

Quoted in writing after a short fit call, based on organization size and the number of functions in scope. No hourly billing, and no obligation to continue into ongoing advisory work.

If what you need is the first set of decisions rather than an evidence base, say so on the call. The Executive AI Governance Session does that in 90 minutes for $1,500, and the fee is credited toward the assessment if you later commission one.

Book a fit call

Want to see what gets assessed? Download the free AI governance policy template — every bracketed field in it is a decision this assessment answers.

Questions leaders ask

What is an AI governance assessment?

A structured review of how artificial intelligence is actually authorized, used and supervised inside an organization: which tools are in use, what information goes into them, who approved them, who reviews the output, what is disclosed, and what evidence exists that any of it was decided. It ends in a written baseline, a gap list ranked by exposure and a remediation plan with named owners.

How is a governance assessment different from an AI readiness assessment?

Readiness asks whether the organization is prepared to adopt AI well. Governance asks whether the AI already in use is authorized, supervised and defensible. Most organizations need both, and SAGAZ runs them as one engagement: the AI Readiness & Governance Assessment.

What does an AI governance assessment cost?

The assessment starts at $7,500 and is quoted as a fixed fee after a short fit call, based on the size of the organization and the number of functions in scope. There is no hourly billing. Organizations that only need the first decisions made can start with the $1,500 Executive AI Governance Session instead.

How long does it take?

Three to four weeks from kickoff: one week of document review and tool inventory, one to two weeks of interviews across functions, then the written findings and the leadership readout.

Who needs one?

Organizations in regulated, accredited, publicly funded or professionally licensed environments — health, education, financial services, government contractors, law and nonprofit boards — where someone will eventually ask who authorized a given use of AI and expect a documented answer.

Is this legal advice?

No. The assessment is executive advisory work, delivered by an attorney who understands regulated environments, but it does not create an attorney-client relationship and does not substitute for counsel licensed in your jurisdiction.

The decision underneath all of this is simple to state and hard to make: retrain or replace.

Find out what you would have to prove.

A short conversation about your sector, your obligations and what is already in use.

Ask about an assessment Email about this assessment