Most teams cannot answer a simple question: who here is using which AI tool, on what data, and who is accountable for the output. This checklist turns that into forty specific yes-or-no statements, grouped into six sections. Work through it in an hour with the two or three people who know how the work really gets done, and you will have an honest picture instead of an impression.

The six sections

  • Tools and accounts — do you know which tools are in use, on which account tiers, and who pays for them. Includes the questions to ask about data retention and whether your content may be used to improve a provider's models on the tier you are actually on.
  • Data — whether you have classified what may and may not be pasted into an external tool, whether people anonymise before pasting, and whether anyone has checked the position on personal data you hold.
  • Accountability — whether every AI-assisted deliverable has a named human who has checked it, and what checking means for each type of output in your business.
  • Client obligations — whether anyone has read your client contracts for AI clauses, whether you keep a register of client-by-client restrictions, and what you disclose and when.
  • Skills — whether the people using these tools have been trained or are improvising, whether anyone can evaluate whether output is good, and where the single points of knowledge sit.
  • Governance — whether a written policy exists, whether it names tools rather than gesturing at them, who owns it, when it was last reviewed, and whether people can report a mistake without consequence.

Sample statements

  • We can name every AI tool currently used for company work, including tools on personal accounts.
  • We know, for each tool, whether our content may be used to train the provider's models on the plan we are on, and when we last checked.
  • There is a written list of what must never be pasted into an external tool, and it uses examples from our own work.
  • Every deliverable produced with AI assistance has one named person who has read and verified it.
  • Somebody has read our top five client contracts for clauses covering AI use.
  • A person who thinks they pasted something they should not have knows they can say so without being disciplined for reporting it.

How to score it

Count the statements you can answer yes to honestly, then ignore the total and look at the pattern. A team that scores well on tools and badly on accountability has a different problem from a team that scores well on policy and badly on skills, and the fixes are not interchangeable. The last page turns the gaps into a short action list with an owner and a date against each.

This is a self-assessment, not legal advice, and it does not tell you what any particular regulation requires of your organisation. Use it to find the gaps, then take proper advice on the ones that involve personal data or contractual obligations.

Enter your email below and the checklist will be sent to you.