BEFORE YOU TAKE THE ASSESSMENT, FIVE QUESTIONS.
1. Do we own our AI — or do we rent access to someone else's?
2. Can management prove — with technical evidence, not contracts — where every AI workload executes?
3. If our primary AI provider restricted or revoked access tomorrow, what would operationally happen?
4. Could we produce a complete AI decision audit trail from 18 months ago within 24 hours?
5. Do we control what our AI providers can see — or are we trusting their promises?
If any of these questions does not have a confident answer, the assessment will tell you why — and exactly where your governance gap is.
THE AI ASSESSMENT
STEP 1 — Where is our governance today? The 5×5 Control Matrix — Score: 0–100
The matrix measures your institution's verified ability to own, govern, and audit the AI systems that drive decisions, manage risk, and serve clients. It applies five governance control dimensions — Jurisdictional, Logical, Technical, Operational, and Contractual — independently to each of five AI infrastructure layers: Power, Compute, Data Centers, Models, and Agentic Applications.
The result is 25 specific, answerable governance questions. Each cell scored 1 (Reactive) to 4 (Sovereign). The distribution of scores across the matrix reveals not just how well-governed your AI is overall — but exactly which infrastructure-governance intersections are exposed and where investment will have the greatest impact.
The most urgent finding: Across every institution type, the Models and Agents columns consistently score at Level 1. This is structural, not incidental. External model providers — Anthropic, OpenAI, Microsoft, Google — have ongoing access to your queries, decision logic, fine-tuning data, and inference outputs by design. Every day. In every API call. This is not a legal demand scenario. It is the operational reality of how AI models are served.
"It is somewhat awkward to say this as the CEO of an AI company, but I think the next tier of risk is actually AI companies themselves. The governance of AI companies deserves a lot of scrutiny."— Dario Amodei, CEO, Anthropic, January 2026
STEP 2 — How do we compare to our peers? Sector Benchmarking — Your score vs your peer group
Your matrix score means nothing in isolation. A score of 45 could be strong or it could be alarming — depending entirely on where your peer group sits. Benchmarking transforms a raw score into a governance position.
Compare your matrix score against institutions exactly like yours — same size, same regulatory obligations, same AI use cases. Context transforms a raw score into a governance position. It also creates urgency: a score that feels acceptable in isolation becomes a board conversation when it sits below the peer range.
STEP 3 — Where do we need to go? The 0–160 Strategic Assessment — Your strategic direction
Evaluate your regulatory obligations, AI dependency, risk tolerance, and financial capacity. The output maps to one of four strategies:
- 0–40 — RENT — Managed cloud with standard governance. AI is supplementary.
- 41–80 — RENT + GOVERN — Enhanced contractual controls and BYOK encryption.
- 81–120 — COMPOSE — Hybrid sovereign architecture. Own the critical layer, rent the rest.
- 121–160 — BUILD — Full sovereign infrastructure. Complete institutional independence.
THE GAP BETWEEN STEP 1 AND STEP 3 IS YOUR PROGRAM.
Your matrix score tells you where you are standing. The 0–160 tells you where you need to get to. Your benchmark score tells you how urgently. The distance between them — cell by cell — is the governance program.
WHAT YOU RECEIVE.
A scored, benchmarked, and strategically calibrated governance profile.
THE 5×5 CONTROL MATRIX SCORE. Your institution's score across all 25 governance intersections, with cell-by-cell findings showing exactly where each pillar is at Level 1, 2, 3, or 4.
THE PEER BENCHMARK. Your matrix score positioned against institutions of similar size, sector, and regulatory profile — with peer range data showing where the typical institution sits.
THE STRATEGIC ASSESSMENT. Your 0–160 strategic score and the four-strategy framework recommendation (Rent, Rent + Govern, Compose, or Build) calibrated to your specific regulatory obligations, AI dependency, risk tolerance, and financial capacity.
THE GOVERNANCE PROGRAM. A structured map of the gaps between current state (the matrix) and required state (the strategic recommendation), prioritized by impact and sequenced by dependency.
A CONFIDENTIAL DEBRIEF. A 60-90 minute working session with Institutional AI leadership to walk through findings, answer questions, and discuss next steps.