How to use this template
An AI risk assessment has two layers. The organization layer asks whether governance controls exist: policy, inventory, ownership, vendor review, identity controls, logging, and incident response. The system layer asks, for each AI tool or agent, what data it touches, what it can do, how autonomously, with which credentials, and under what vendor terms.
Work through Part 1 once. Work through Part 2 for each AI system. Then use Part 3 to rate and prioritize findings. Answer "Not sure" honestly — an unconfirmed control is not a control, and gaps in knowledge are findings in their own right.
Part 1: Organization-level questions
| # | Question | Answer (Yes / Partial / No / Not sure) | Why it matters |
|---|---|---|---|
| 1 | Do you have an approved, published AI acceptable-use policy? | Defines what employees may share and use | |
| 2 | Have employees acknowledged it? | Demonstrates awareness in audits and disputes | |
| 3 | Do employees receive AI security training? | People are the main path for data into AI | |
| 4 | Do you maintain an inventory of AI tools and agents? | Every other control depends on it | |
| 5 | Is a named person accountable for AI risk? | Someone must decide approvals and exceptions | |
| 6 | Are AI vendors reviewed before adoption? | Retention, training use, and contracts vary widely | |
| 7 | Are unapproved AI tools blocked or monitored? | Shadow AI is the most common exposure | |
| 8 | Do AI tools use SSO? | Central offboarding and visibility | |
| 9 | Is MFA required for AI tools? | Protects conversation history and connected data | |
| 10 | Is AI access reviewed periodically? | Permissions only grow without review | |
| 11 | Is AI activity logged centrally? | Needed to investigate incidents | |
| 12 | Does incident response cover AI scenarios? | AI incidents need specific playbooks | |
| 13 | Are AI data-retention settings configured? | Retained data increases breach impact |
Part 2: Per-system assessment
Copy this table for each AI tool, agent, embedded AI feature, or custom model integration.
| Field | Options / guidance |
|---|---|
| Name and vendor | e.g. "Sales email agent — built on Vendor X API" |
| Type | Assistant · Coding assistant · Agent/automation · AI feature in another product · Custom API integration |
| Owner | Named business owner |
| Purpose | What it is for, in one sentence |
| Plan / deployment | Enterprise/business · Consumer · Developer API · Self-hosted · Not sure |
| Approval status | Approved · Under review · Not approved · Not sure |
| Data it can access | PHI · Personal info · Financial · Payment card · Legal/confidential · Source code · Credentials · Customer records · Internal docs · Public only |
| Capabilities | Read/send email · Publish · Read/write/delete files · DB read/write · Execute code · Repo read/write · Production access · Cloud admin · Payments · Modify permissions · Browse web · CRM write |
| Autonomy | Suggests only · Human approves each action · Acts within limits · Acts without limits · Not sure |
| Credentials | SSO/scoped OAuth · Dedicated service account · Shared key · Personal credentials · Embedded in code/prompts · None · Not sure |
| Logging | Full · Partial · None · Not sure |
| Vendor terms | DPA · BAA · No training on our data · Zero/limited retention · Security review done |
| Number of users | 1 · 2–10 · 11–50 · 51+ · System only |
Part 3: Rate and prioritize
Use consistent severity definitions so findings are comparable across systems and over time:
| Severity | Definition | Examples |
|---|---|---|
| Critical | Plausible path to serious data exposure, irreversible action, or regulatory breach | PHI in a vendor tool without a BAA; unrestricted agent that can delete or pay; key embedded in code |
| High | Significant weakness likely to contribute to an incident | No MFA on AI tools; agent sends email without review; unapproved tool with customer data |
| Medium | Control gap that increases likelihood or impact | No DPA recorded; partial logging; broad permission scope |
| Low | Hygiene issue | No named owner for a system; policy not acknowledged |
| Informational | Context or visibility gap | Many answers unknown; no systems listed |
Prioritize Critical findings within days, High within 30 days, and Medium within a quarter. When the same issue repeats across many systems (for example, shared keys everywhere), fix it as one systemic remediation rather than many individual tickets.
Automate this template
The FlashTower Scan applies this model automatically with a published, versioned ruleset, and shows exactly how the overall score was calculated. It is free to start.
Part 4: Build the 30-day plan
- Days 1–3: Contain Critical findings. Stop sensitive data flowing to consumer accounts or tools without required agreements; rotate exposed credentials; add approval gates to unrestricted agents.
- Days 4–10: Identity controls. Enforce SSO and MFA on AI tools; revoke unapproved OAuth grants; restrict user consent.
- Days 11–20: Governance. Approve an AI acceptable-use policy; name an accountable owner; start the vendor review process.
- Days 21–30: Visibility and response. Enable logging; add AI scenarios to incident response; schedule the next quarterly review and re-assess.
Keep evidence
For every remediated finding, keep evidence: a screenshot of the setting, the signed agreement, the policy approval record, or the access review output. Evidence is what turns an assessment into something a board, auditor, insurer, or enterprise customer can rely on.
Worked example
A 40-person accounting firm completes Part 1 and answers "No" to vendor review, MFA, and incident response, and "Partial" to inventory. In Part 2 it lists three systems: a business-plan AI assistant used firm-wide with SSO; a free AI transcription tool one partner uses for client calls; and a bookkeeping automation that uses an AI model to categorize transactions and can post journal entries without review.
Rated with Part 3, the transcription tool is Critical (confidential client financial information in a consumer account with no agreement), the bookkeeping automation is High (write access to financial records without human approval), and the organization-level gaps are High (no MFA, no AI incident response) and Medium (partial inventory). The 30-day plan: move call transcription to an approved tool the same week, add an approval step to the automation, enforce MFA, and draft an incident response addendum.
Common mistakes
- Assessing only the approved tools and skipping the ones employees chose themselves.
- Recording intended data access rather than effective access.
- Treating "Not sure" as "Yes" to make the result look better.
- Rating every finding High, which makes prioritization impossible.
- Running the assessment once and never repeating it after tools and permissions change.