An AI Governance Assessment Checklist For Workplace AI Risk

Key takeaways

• A written AI policy shows intent. Technical enforcement at the point of use is what separates a policy from governance.
• Start the assessment with discovery. An organization can't govern AI tools it hasn't found yet, so visibility comes before any policy rewrite.
• Agent actions belong in the same governance review as human prompts. By our read of the trend, agent-initiated activity already makes up a growing share of enterprise AI use, and much of it runs without a human prompt to review.

Most security leaders already know employees are using AI tools, whether or not an acceptable use policy has caught up. The harder problem is proving it: naming which tools touch sensitive data, which prompts carry client records, and which approvals never happened. A policy document answers the first question. It rarely answers the rest.

A workplace AI governance assessment answers the rest by walking through the AI tools in use, enforcement at the point of use, data exit points, agent identity controls, and incident reconstruction. Each area produces a decision rather than a slogan: expand monitoring here, add enforcement there, assign an owner by Friday.

The sections below walk through each area in the order we'd run the assessment ourselves. We start with visibility, because nothing downstream works without it.

Start with visibility into what AI is running

Most organizations have far more AI activity than their sanctioned tool list suggests. Compliance Week and konaAI's 2026 AI & Compliance Survey found 83 percent of organizations already use AI tools, yet only about a quarter have implemented a strong governance framework to match. That distance between adoption and oversight is where workplace AI risk lives, and it's the first thing the assessment needs to close.

The cost of skipping this step keeps climbing. IBM's 2026 Cost of a Data Breach Report, summarized by Baker Donelson, found "shadow AI" incidents more than doubled, from 20 percent to 43 percent of breached organizations, and breaches involving unsanctioned AI tools averaged $5.39 million against a $4.99 million global average. One enterprise we worked with found 243 distinct AI products in active use against just six formally sanctioned. That ratio makes clear why a written policy can't function as governance when nobody can see most of what it covers.

We've argued AI tools deserve the same scrutiny as any other new entry point into the business, and a visibility pass is where that scrutiny starts. The first move is straightforward: commission a discovery pass across the browser, extensions, and agent traffic before touching a single policy line, because every later section of this assessment depends on knowing what's currently in use.

Check whether policy reaches the point of use

A policy is only as strong as its enforcement. The National Institute of Standards and Technology organizes AI oversight into four functions, Govern, Map, Measure, and Manage, through its AI Risk Management Framework. Those four functions work as a mental map, and we've written separately about how an AI governance framework for workplace AI pulls them together into something an organization can run day to day. This checklist covers something more specific: the moment-by-moment checkpoints that prove a policy survives contact with real work.

Compare automatic enforcement of the AI acceptable use policy against reliance on an employee's memory of what they signed months earlier. Most organizations we talk with can point to the document. Fewer can point to the control that blocks a disallowed action the moment it happens.

The useful test is a control that catches a policy violation without a person noticing. The document's existence on paper assumes too much. The assessment should surface the distance between the policy's language and actual browser, desktop, and agent-platform enforcement. Once that distance is visible, the decision is simple: close it with enforcement at the point of use, or accept the risk explicitly and document why.

Assess data protection across browser, desktop, and agents

Data protection used to mean controlling file transfers and email attachments. AI tools add new exits: a prompt pasted into a chatbot, a document summarized by an agent, a browser extension with broad read access to the page. Our approach to data protection built for AI and modern work extends inspection down to the prompt and the clipboard, not the file alone, because a sensitive record can leave an organization without ever touching a traditional upload control.

Many enterprises already run endpoint protection and want AI governance to extend it rather than replace it, a question our piece on layering AI governance onto existing endpoint protection addresses directly. The answer sets the split between new tooling this part of the assessment requires and a configuration change to tools already deployed.

The decision at this stage names the data protection controls that already cover AI pathways and the ones that need to extend to prompts, uploads, and agent-initiated transfers. Mapping those exits for your own environment turns this section from a review into a plan: the exit points for sensitive data and the controls still missing.

Evaluate identity and access controls for agents

Agents complicate identity because they act instead of a person, often across multiple systems inside a single workflow. Governing the credential an agent holds matters less than governing the action it takes while holding that credential, an argument we make in our piece on agent governance: oversight has to follow the action rather than the key alone.

IBM's research on AI-related breaches found 92 percent of affected organizations lacked proper AI access controls. That number lines up with our own least-privilege reviews: agent credentials, once issued, often carry more access than the task requires and remain active well after the task ends. A credential built for one workflow becomes a standing door into several systems because nobody scoped it down after the first use.

The decision for this section is specific. Either agent identities get the same per-task, least-privilege treatment human accounts increasingly get, or they stay the easiest path into sensitive systems for an attacker who only needs one static credential to succeed.

Confirm audit readiness before an incident forces the question

Audit readiness is the area most organizations discover they're missing only after an incident, when a regulator or an internal investigator asks for the specific prompts, approvals, and account history as a single record rather than scattered logs across five systems.

TaskUs, a company with more than 60,000 employees, built its AI governance program by gaining visibility first, making an informed policy decision next, and enforcing it after that. We walk through that path in AI Protect gave its security team the visibility to say yes to AI adoption instead of defaulting to blocking it outright.

The practical test for this section is a single, prompt-to-action record for any AI-assisted decision, pulled today rather than assumed to exist because the tools are modern. If the answer is no, audit readiness is the next investment, ahead of anything else on this list that assumes logging already works.

Set a review cadence and assign ownership

A governance assessment that runs once and sits in a drawer ages out quickly, because the AI tools employees adopt change faster than most review cycles do. We've argued shadow AI exposure persists less because you ignore the rules and more because the environment makes the easy path the unsanctioned one.

A fixed quarterly review catches drift from new tools and new regulations. An incident-triggered review catches everything the calendar misses between those fixed dates. Both need a named owner, not a committee, drawn from security, legal, and the business units generating the AI activity being governed.

Picking that cadence and naming those owners this quarter is the last item on the checklist, and it's the one that keeps the first five from going stale.

FAQs

Who owns an AI governance assessment inside the organization?

One named owner, not a committee, pulled from security, legal, and the business unit generating the most AI activity. Spreading ownership across a committee is the fastest way the review cadence above stops happening after the first quarter.

How is an AI governance assessment different from writing an AI acceptable use policy?

The AI acceptable use policy states the rules. The assessment checks for automatic enforcement of those rules at the point someone opens an AI tool, instead of relying on an employee's memory of onboarding paperwork. A policy without that enforcement check is a document, not governance.

Does the assessment need to cover AI agents, not just employee chatbot use?

Yes. By our read of the trend, agent-initiated activity already makes up a growing share of enterprise AI use, often holding credentials across multiple systems inside one workflow. Our piece on agent governance makes the case oversight has to follow the action an agent takes, not just the credential it holds, which is why identity and access get their own section in this checklist rather than folding into the policy-enforcement step.

What's the biggest blind spot most companies have in AI data protection?

Coverage stops at the file. Prompts, clipboard content, and agent-initiated transfers carry sensitive data out of an organization just as easily as an email attachment, and most data loss prevention programs were never extended to inspect them. Mapping where data can leave through an AI tool, by browser, desktop, and agent, is the fastest way to find that blind spot.

How should agent identities be governed differently than human accounts?

Per task and least privilege, the same direction human account governance has been moving for years. IBM's research found 92 percent of organizations with an AI-related breach lacked proper AI access controls, which tracks with what we see when a credential issued for one workflow stays active, and over-scoped, long after that workflow ends.

What's the fastest way to see unsanctioned "shadow" AI tools already in use?

Commission a discovery pass across the browser, extensions, and agent traffic rather than asking teams to self-report what they use. One enterprise we worked with found 243 distinct AI products active against just six formally sanctioned, a discrepancy that self-reporting alone would never have surfaced.

How often should the assessment be repeated?

Quarterly at minimum, plus an incident-triggered review whenever a breach, a new regulation, or a newly discovered tool changes the picture. The AI tools employees adopt change faster than most governance calendars, so the fixed cadence and the incident trigger need to run together, not as a substitute for each other.