Where is your organization 
exposed to ungoverned AI?
The Board is going to ask how exposed you are to ungoverned AI. In one afternoon, this workbook shows your leadership team where AI is already running, where it could hurt the business, and what to fix first.
10 pages
Three parts, one sitting
11 areas
Where AI is already operating
90 days
One management action to start
Download the workbook
The PDF opens on the next page, and we send a copy to your inbox so you can share it with your team.
What's inside
Three parts, in the order a leadership team needs them
Each part is a page or two of checkboxes and short prompts, answered with what you already know. No research required.
AI Discovery
Where is AI already in use?
An honest picture of where AI already operates, including the approved initiatives, the AI embedded in software you bought, and the AI employees brought in on their own.
- Eleven categories to mark as known, believed, or unsure (copilots, public GenAI tools, vendor products, agents, shadow AI...)
- Who is accountable for giving management a reliable enterprise view
- How confident you are that management could show the Board that view next week
Exposure Mapping
Where could it hurt the business?
Exposure here means a meaningful business consequence. A governance shortfall is not the exposure itself; it creates or increases it, and the workbook keeps the two apart on purpose.
- Eleven consequence areas rated from low to material (legal, privacy, cyber, financial, reputation, third party, and more)
- Ten management conditions, from ownership and data sensitivity to monitoring and escalation
- How you would find out if an AI capability started producing unacceptable outcomes tomorrow
Prioritization & ROI
What should management do about it?
From exposure to action. You name three exposures, pick the one governance capability to build first, and tie it to a business outcome your CFO would recognize.
- Fifteen governance capabilities rated against your three priority exposures
- Four ROI pillars: risk and liability avoidance, faster deployment, scale enablement, operational efficiency
- A 90-day management response with a sponsor and a Day-90 definition of "different"
Who it is for
The people who answer for AI when something goes wrong
We built it for operations, risk, and technology leaders in regulated industries. It works best as a group exercise, with three people who see the company from different seats.
What you leave with
A written answer to the Board's question, in your own handwriting
By the last page you have moved from discovery to exposure to priority to value to action. Here is what is on the paper when you are done.
An honest AI inventory
Where AI is known to run, where you believe it runs, and where nobody is sure. The third column is usually the longest.
Your most significant exposure
One business consequence, connected to the management condition behind it (ownership, data, monitoring, or something else).
One capability to build first
Chosen from fifteen, rated against your three priority exposures, with the ROI pillar it strengthens.
A 90-day management action
What starts, who sponsors it, and what is observably different by Day 90. One action, one outcome.
Free download
Would your leadership team give the same answers you would?
There is one way to find out. Download the workbook, book a conference room, and give it an afternoon. If you want a second set of eyes on what comes out, we are happy to look at it with you.