AI-readiness quickscan

1. Do you have a written AI-use policy?

   Question 1 / 10

   Do you have a written AI-use policy?

   A document stating what employees may or may not do with AI.

   Yes, recently adopted and shared with everyoneYes, but older than 12 months or not actively sharedDraft, not yet adoptedNo policy
2. Is there a list of allowed and disallowed AI tools?

   Question 2 / 10

   Is there a list of allowed and disallowed AI tools?

   Yes, explicit and up to dateYes, only disallowed tools listedVerbal agreement only, nothing writtenNo list
3. Do employees get training on what they may share with AI?

   Question 3 / 10

   Do employees get training on what they may share with AI?

   Especially around personal and business-sensitive data.

   Mandatory training completed by allOne-off toolbox session or emailPlan to do thisNothing
4. Do you have a DPA or contract with AI vendors that touch personal data?

   Question 4 / 10

   Do you have a DPA or contract with AI vendors that touch personal data?

   With all vendors, legally reviewedWith most, not all reviewedOnly free or consumer tools in use, no DPANo idea
5. Is your data classified and mapped to which AI tools are allowed?

   Question 5 / 10

   Is your data classified and mapped to which AI tools are allowed?

   For example public, internal, confidential, restricted.

   Classified and each class has its allowed AI tierClassified, AI mapping not yet explicitNot formally classifiedI don’t understand the question
6. Are AI prompts that touch personal data logged?

   Question 6 / 10

   Are AI prompts that touch personal data logged?

   We or the tool log it, contractually fixedTool logs, we don’t use those logsWe don’t knowNot applicable
7. Is there a procurement check before adding new AI tools?

   Question 7 / 10

   Is there a procurement check before adding new AI tools?

   Fixed procedure with checklist and sign-offInformal check by one personAnyone procures on their ownNo process
8. Is AI output reviewed before it goes external?

   Question 8 / 10

   Is AI output reviewed before it goes external?

   Four-eyes principle, set in the processAuthor reviews their own work, no four-eyesSometimes yes, sometimes noOutput goes external without review
9. Is there an incident-reporting process for AI errors with impact?

   Question 9 / 10

   Is there an incident-reporting process for AI errors with impact?

   Procedure exists and has been testedProcedure exists on paperGeneric incident reporting, nothing AI-specificNo procedure
10. Do you know which EU AI Act risk class your use cases fall under?

    Question 10 / 10

    Do you know which EU AI Act risk class your use cases fall under?

    Yes, risk class known and we act on itWe looked into it, conclusion still openHaven’t got around to itFirst I’ve heard of it

No marketing emails unless you opt in. Request deletion any time via info@vectel.nl.