BEFORE YOU TAKE THE ASSESSMENT
If any of these questions does not have a confident answer, the assessment will tell you why — and exactly where your control gap is.
How ThE AI Assessment Works — Three Steps, One Program.
Most frameworks start by asking where you want to go. This assessment starts by asking where you actually are. The distinction is deliberate.
Strategy without an honest baseline is aspiration. An honest baseline without benchmarking lacks urgency. And both without a strategic direction lack purpose.
The three steps work together — and they work in this order.
THE AI CONTROL ASSESSMENT
STEP 1 — Where is our AI control today? The 5×5 Control Matrix — Score: 0–100
The matrix measures your institution's verified ability to own, control, and audit the AI systems that drive decisions, manage risk, and serve clients. It applies five control dimensions — Jurisdictional, Logical, Technical, Operational, and Contractual — independently to each of five AI infrastructure layers: Power, Computing, Data Centers, Models, and Agentic Applications.
The result is 25 specific, answerable AI control questions. Each cell is scored 1 (Reactive) to 4 (Sovereign). The distribution across the matrix reveals not just how well-controlled your AI is overall — but exactly which intersections are exposed and where investment will have the greatest impact.
\
The most urgent finding: Across every institution type, the Models and Agentic Applications columns consistently score at Level 1. This is structural, not incidental. External model providers process institutional queries in plaintext on their own infrastructure, with interaction logs held in their systems, under terms most institutions have not negotiated against their fiduciary obligations. Enterprise tiers with zero-retention and confidential-inference options exist. Few institutions have negotiated them. Fewer still have validated that what the contract promises is what the architecture actually enforces.
This is not a legal-demand scenario. It is the operational reality of how AI models are served.
STEP 2 — How do we compare to our peers? Sector Benchmarking — Your score vs your peer group
Your matrix score means nothing in isolation. A score of 45 could be strong or alarming — depending entirely on where your peer group sits. Benchmarking transforms a raw score into a control position.
Compare your matrix score against institutions exactly like yours — same size, same regulatory obligations, same AI use cases. Context turns a number into a control position. It also creates urgency: a score that feels acceptable in isolation becomes a board conversation when it sits below the peer range.
STEP 3 — Where do we need to go? The 0–160 Strategic Assessment — Your strategic direction
Evaluate your regulatory obligations, AI dependency, risk tolerance, and financial capacity. The output maps to one of four strategies:
- 0–40 — RENT — Managed cloud with standard controls. AI is supplementary.
- 41–80 — RENT + CONTROL — Enhanced contractual controls and BYOK encryption.
- 81–120 — COMPOSE — Hybrid architecture. Own the critical layer, rent the rest.
- 121–160 — BUILD — Full institutional infrastructure. Complete independence.
THE GAP BETWEEN STEP 1 AND STEP 3 IS YOUR PROGRAM
Your matrix score tells you where you are standing. The 0–160 tells you where you need to get to. Your benchmark tells you how urgently. The distance between them — cell by cell — is the control program.
WHAT YOU RECEIVE
A scored, benchmarked, and strategically calibrated control profile.
THE 5×5 CONTROL MATRIX™ SCORE. Your institution's score across all 25 intersections, with cell-by-cell findings showing exactly where each pillar sits at Level 1, 2, 3, or 4.
THE PEER BENCHMARK. Your matrix score positioned against institutions of similar size, sector, and regulatory profile — with peer-range data showing where the typical institution sits.
THE STRATEGIC ASSESSMENT. Your 0–160 strategic score and the four-strategy recommendation (Rent, Rent + Control, Compose, or Build) calibrated to your specific regulatory obligations, AI dependency, risk tolerance, and financial capacity.
THE CONTROL PROGRAM. A structured map of the gaps between current state (the matrix) and required state (the strategic recommendation), prioritized by impact and sequenced by dependency.
A CONFIDENTIAL DEBRIEF. A 60–90 minute working session with Institutional AI leadership to walk through findings, answer questions, and discuss next steps.