A 25-question self-assessment to figure out where your organization stands on AI adoption. Five domains, five questions each, scored 0–2. Total possible: 50. The total matters less than seeing which domain scores lowest — that’s where to spend the next 90 days. Last reviewed: May 25, 2026.

How to Score

For each question, score:

• 0 — No. We do not do this, or we don’t have it written down.
• 1 — Partial. Some practice exists, but it’s inconsistent, undocumented, or known only to one person.
• 2 — Yes. This is written, broadly known, and we could show evidence of it on demand.

One person can fill this out, but the assessment is more accurate if at least two people score separately and compare. Differences in scores are themselves useful data.

Domain 1: Governance

1. We have a written AI Use Policy adopted by our board (or equivalent governing body).
2. One named person is accountable for AI decisions in our organization.
3. Staff know who to ask before using a new AI tool for organizational work.
4. We have a written list of AI uses that are prohibited under any circumstances.
5. Our board reviews AI use at least annually and is informed of incidents.

Domain 1 subtotal: ___ / 10

Domain 2: Data

1. We can name our data classes (Public, Internal, Confidential, Sensitive / Regulated) and which kinds of organizational data fall into each.
2. Staff know what they may and may not paste into a consumer-tier AI tool.
3. Any AI tool used for Sensitive / Regulated data has a written data-handling commitment (BAA, DPA, or equivalent) on file.
4. We have a documented retention period for AI inputs and outputs used in our work.
5. If a participant asked us to delete all records that involved AI processing, we could identify and act on them.

Domain 2 subtotal: ___ / 10

Domain 3: Capacity

1. At least one person on staff has used AI tools long enough to know their failure modes (hallucinations, plausible-but-wrong outputs, format drift).
2. Staff who use AI in their work have received training on our AI Use Policy within the past year.
3. We have a small prompt or workflow library (even informal) that another staff member could pick up and use.
4. When something goes wrong with an AI output, staff know how to escalate.
5. We have a defined human-review step for any AI-assisted work product that leaves the organization.

Domain 3 subtotal: ___ / 10

Domain 4: Compliance

1. If we charge AI tool costs to a federal award, we have a written allocation methodology in place before the first charge (per 2 CFR 200.405).
2. Any AI use that touches HIPAA, FERPA, or other regulated data has been reviewed against the applicable rule.
3. We have a disclosure standard for telling participants when AI is used in work that affects them.
4. If a monitor or auditor asked how an AI tool subscription benefits a specific funded activity, we could produce documentation within five minutes.
5. We have a written incident-reporting procedure for AI-related issues.

Domain 4 subtotal: ___ / 10

Domain 5: Tool Selection

1. We have a written list of approved AI tools, by use case and data class.
2. Before approving a tool, we evaluate its data-handling commitments (training-on-inputs, retention, deletion, subprocessors).
3. We have a written process for staff to request approval of a new tool, including timing expectations.
4. We review vendor agreements with attention to AI-specific terms (training data, retention, deletion, indemnity).
5. We periodically review whether tools on the approved list are still meeting their commitments.

Domain 5 subtotal: ___ / 10

Total Score: ___ / 50

Add the five domain subtotals.

Interpreting Your Score

• 0–15: Pre-readiness. AI is in use, or about to be, with no written guardrails. Start with the Board Brief and the Staff Handbook. Don’t approve a new AI tool until those are adopted.
• 16–30: Foundational. Some practices exist. The lowest-scoring domain is where the gap will hurt first. Pick that one and aim to get it to a 6+ within 90 days.
• 31–40: Operational. The basics are in place. You’re in a position to expand the scope of approved uses thoughtfully and to begin publishing field reports.
• 41–50: Mature. Strong governance posture. The next move is depth — deeper integration with specific program workflows, deeper documentation of impact.

90-Day Action Plan

Take the lowest-scoring domain and use the matching plan below.

If Governance scored lowest

• Days 1–30: Adapt the Board Brief. Add it to the next board agenda using the Board Briefing Pack.
• Days 31–60: Adopt the policy. Issue the Staff Handbook and run the all-staff training.
• Days 61–90: Stand up the Approved-Tool List. Process the first round of Tool Approval Worksheets.

If Data scored lowest

• Days 1–30: Document your data classes. Inventory the regulated and contractual constraints on your data (HIPAA, FERPA, funder data-use terms).
• Days 31–60: Map current AI use to data classes. Identify anything that’s out of bounds and stop it. Sign appropriate vendor agreements for tools you want to keep.
• Days 61–90: Update the Staff Handbook with your data-class definitions and brief staff on them.

If Capacity scored lowest

• Days 1–30: Run a 30-Day AI Pilot on one safe workflow.
• Days 31–60: Capture working prompts and review patterns into a small internal library.
• Days 61–90: Train one additional staff member on the workflow. Document what worked and what didn’t.

If Compliance scored lowest

• Days 1–30: Read the Federal Grants & AI Compliance Quick Reference and Federal Compliance and AI: Five Questions.
• Days 31–60: Complete the per-tool documentation template from Documenting AI Costs in Federal Grant Reports for every AI tool currently charged to a federal award.
• Days 61–90: Adopt the disclosure standard from the Staff Handbook in your funder reports and participant-facing communications.

If Tool Selection scored lowest

• Days 1–30: Take an honest inventory of the AI tools currently in use across the organization (including the unofficial ones).
• Days 31–60: Run each through the Vendor Evaluation Checklist. Decide what stays, what goes, what needs an enterprise upgrade.
• Days 61–90: Stand up the Approved-Tool List. Sunset any tools that didn’t pass.

After 90 Days

Re-score the assessment. Compare to your starting score. The point isn’t a perfect 50 — it’s a board, a staff, and a process that all match. Then pick the next lowest domain and repeat.

---

Use this assessment with the full Resources hub. Templates only — not legal advice.