AI Exposure Audit

Leadership does not have a sufficiently reliable view of AI use, ownership, exposure or control gaps to decide what governance action is proportionate.

The AI Exposure Audit establishes what AI is in use across the organisation, including unapproved use, and assesses relevant governance considerations by system. It identifies gaps between existing controls and the exposure found, then produces prioritised actions and a board-ready summary. Legal and regulatory questions are identified for appropriate specialist review rather than decided within the audit.

• Establish an inventory of AI systems and relevant use
• Classify systems and identify relevant governance considerations
• Assess the gap between existing governance controls and the exposure identified
• Prioritise actions and prepare the executive and board view

Within four weeks, your executive team and board receive an AI-use inventory, governance risk assessment and prioritised actions.

• Inventory of the AI in use across the organisation, including Shadow AI
• Risk classification per system and relevant governance considerations
• Governance gap analysis, with legal and regulatory questions identified for appropriate review
• Prioritised action plan
• Board-ready summary report with risk ratings and recommended next steps

May follow the AI Governance Decision Brief. Typically leads to the AI Accountability Programme. Where supplier exposure is material, the Supplier AI Risk Audit may run first.