How mature is your AI governance program?

See where your organization stands with a free AI Governance Readiness Assessment. Evaluate your program across 30 practices to get your maturity score, tailored guidance on what to prioritize next, and insights into your readiness for ISO 42001, the EU AI Act, and NIST AI RMF.

70%of organizations have reported shadow AI¹

21%of organizations have mature governance for agentic AI²

47%of AI leaders say their organization had bypassed its governance process for AI deployments³

~10 minutes

Take the assessment

Three quick questions about how your organization uses AI, then 30 practices to rate. You’ll get a maturity score, an alignment read against each framework, and a recommended set of next steps.

This is a general assessment, not a compliance review. It gives an indicative read on 30 common AI governance practices, based solely on your self-reported answers, which Vanta does not verify. This tool and its results, including any downloaded report or slides, do not constitute legal, security, or compliance advice, and are not a compliance assessment, a gap analysis, or a substitute for a formal readiness review. Vanta makes no representation that using this tool, or acting on its results, will lead to any particular security or compliance outcome.

Meet the minds behind the assessment

Developed by Vanta’s security, compliance, and AI governance experts, this assessment translates complex governance practices into a clear view of where your organization stands and practical guidance to build a stronger AI governance program.

Khush Kashyap

Sr. Director, GRC Subject Matter Expert, Vanta

Khush works alongside CISO teams to strengthen security governance. A former software engineer, she brings an engineering-first perspective and more than a decade of experience, including leading quantitative risk and security governance teams at PwC and Rubrik. She also hosts The Tabletop, a video podcast dedicated to stress-testing real-world corporate incident response plans.

Justin Pagano

Sr. Director, GRC Engineering, Vanta

Justin helps shape Vanta’s approach to AI governance. Previously Director of Security Risk and Trust at Klaviyo, he brings hands-on experience connecting governance, risk, and compliance with security operations. He is also a co-author of the GRC Engineering Manifesto, championing automation and practical, measurable approaches to managing risk as AI adoption accelerates.

Framework: five AI domains × NIST AI RMF functions (Govern · Map · Measure · Manage). Maturity scale modeled on CMMI. Alignment assessed per requirement against ISO/IEC 42001 and the EU AI Act.

First, how does your organization use AI?

Three questions. These decide which obligations actually apply to you, so your results reflect your real regulatory position rather than a generic one. Company size doesn’t change this. What you do with AI does.

Which best describes your AI footprint?

If more than one applies, pick the last option that fits. Under the EU AI Act, building or selling AI makes you a provider even if you also buy AI tools from others, so the last two options lead to the same set of obligations.

Please choose one.

Does your AI touch any of these areas?

These are the EU AI Act’s high-risk categories. Obligations for them were deferred to 2 December 2027, but scope is worth knowing now. If several apply, pick any one of them. This answer only tells us whether high-risk scope applies to you at all, not which category you fall under.

Please choose one.

Do you offer your product or AI systems in the EU?

Includes customers or users in the EU, regardless of where you’re based.

Please choose one.

Something didn't load

The assessment couldn't start. This is a problem with the page, not with anything you did.

The tag on each question (Govern, Map, Measure, Manage) is its NIST AI RMF function, shown so you can see how the questions spread across the framework. It doesn’t affect your score.

What the numbers mean: 1 Ad hoc / not started · 2 Repeatable but informal · 3 Defined & documented · 4 Managed & measured · 5 Optimizing & automated
Pick where your organization actually is today, not where you intend to be. Level 3 means documented but not yet enforced or measured, which is real progress rather than a failure. The report is only useful if the inputs are honest.
Where a question lists several things, score the weakest one. If you do evals but no red-teaming, score for the red-teaming. And if a practice genuinely doesn’t apply to your organization, use N/A. Those are left out of your scores rather than counted against you.

0 of 30 answered

Your AI Governance Report

Part 1

Your AI governance maturity

How your program looks on its own terms, across five domains and 30 practices. No frameworks in this section.

–

Overall maturity (of 5.0)

Executive summary

Maturity by domain

Your capability across the five AI governance domains.

Where your program is strongest and weakest

The same five domains, ranked, so the order of attack is obvious.

What’s going well

Gaps in your program

Next steps to take

Where Vanta fits

Vanta helps you govern AI as quickly as your organization adopts it. AI Governance by Vanta is in early access today, helping you discover and document AI use, assess risk, and demonstrate responsible AI governance.

You don’t have to wait to get started. Vanta already supports ISO 42001, the NIST AI RMF, and the EU AI Act, so you can begin building the foundation of your AI governance program today.

Part 2

Your readiness against AI frameworks

How the same 30 answers line up against the frameworks your auditors and regulators actually use.

EU AI Act

ISO/IEC 42001

This shows alignment, not conformity. Conformity with ISO/IEC 42001 is a formal judgement made by an auditor: clauses 4–10 are mandatory in full, the Annex A control set is chosen by each organization through its own Statement of Applicability (clause 6.1.3), and a single major nonconformity can fail an audit regardless of any score. A self-assessment can’t produce that. What it can show is how your answers line up with the practices these clauses are concerned with.

NIST AI Risk Management Framework

Your distribution across the four functions, as a reference view. No target line is shown: NIST AI RMF prescribes no maturity levels, and Implementation Tiers were proposed in its 2021 concept paper then deliberately dropped.

Where would you start on AI security?

Your security-domain answers, re-ordered against the OWASP GenAI LLM Top 10 2026, the security community’s published ranking of what actually goes wrong with AI systems. The prioritization is Vanta’s own.

About these figures. ¹ Vanta, Trust Signals: when tokenmaxxing leads to riskmaxxing, 23 April 2026. Based on anonymized data from Vanta’s Third Party Risk Management solution, February 2024 to April 2026. ² Deloitte, State of AI in the Enterprise, 2026. Survey of over 3,000 business and IT leaders worldwide. ³ EY, AI Risk and Governance Survey, 15 September 2026. Survey of 202 senior AI decision-makers at US publicly traded companies with annual revenue of at least $1 billion. Framework references are to ISO/IEC 42001:2023 clause and Annex A control titles, NIST AI RMF 1.0 (AI 100-1) subcategories, and Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. No per-domain benchmark or peer comparison is shown, because no empirical per-domain distribution exists and neither ISO/IEC 42001 nor NIST AI RMF defines maturity levels. Alignment is assessed per requirement at a threshold of 4 of 5. This tool is not legal advice and is not a certification assessment.