The AI Governance Readiness Diagnostic: Ten Questions Every CIO Should Answer

Most enterprises are deploying AI faster than they are governing it. The gap rarely announces itself in a strategy deck. It shows up in the questions a CIO cannot quite answer when the board finally asks — who approved that agent, who is accountable for that decision, what happens if we need to stop it.

So I wrote down ten of those questions.

This is a one-page diagnostic for senior leaders: ten questions every CIO should be able to answer about how their enterprise governs AI. It is deliberately short and, in places, deliberately uncomfortable. Mark each one honestly — yes, no, or uncertain. Not as a test, but as a baseline. Then count your "no" and "uncertain" answers. That number is your governance gap.

What the ten questions cover

The diagnostic moves through four areas, from foundations to the boardroom:

• Foundations — whether you can inventory every AI agent in your environment (including the ones teams stood up without approval), name the human accountable for each AI-driven decision, and whether your governance review cycle actually keeps pace with how fast your systems change.
• Authority and containment — whether you have defined, in writing, what each agent is and is not trusted to do; whether a human can halt or reverse an agent's action in a timeframe that matters; and whether your backups and recovery systems are isolated from the same authority an agent could use to disable them.
• Operational discipline — human-in-the-loop thresholds, shadow AI, and whether you can attribute AI compute and API costs to the decisions they enabled.
• Board-level resilience — the question that defines the decade: does your board receive AI resilience metrics with the same regularity and rigour as financial or cybersecurity ones?

How to read your score

Count the questions you answered "no" or "uncertain." Zero to three gaps is a strong foundation. Four to six points to structural exposure an incident would surface fast. Seven or more means you are running adaptive systems with controls built for predictable ones — a gap no new tool will close on its own.

The full one-page diagnostic is below. Download it, run it with your leadership team, and revisit it after every major AI deployment — the gaps move./file