RAISE.AI
THE RAISE METHOD · THE FOUNDATIONS RUNG

AI Exposure Scorecard

Ten questions. Three minutes. One honest number for your board, sent to your inbox with your answers, question by question.

AI does not create access. It reveals access that already exists. Most organisations switched on Copilot or an AI assistant over their own content before anyone checked what it could reach, who owns each assistant, or who could stop one.

These ten questions are what every organisation needs in place before AI goes further. They are what the RAISE Method requires before an organisation leaves the foundations rung of its ladder, so your score here is measured the same way a full assessment would measure it.

Part of the RAISE Method. Read how a RAISE assessment runs.

If you are a charity, there is an edition of this scorecard with your regulators' own words and the red lines a charity board should set. → Charity edition

How to score. For each question: 0 = no, or we don't know · 1 = partly, or it exists but is not written down or not approved · 2 = yes, written, approved by leadership and in use. "We don't know" is a real answer and scores 0; guessing is the only unhelpful option.
1

Is there one written AI policy, approved by your leadership, that says what the organisation will and will not do with AI?

When the answer is no: Three teams each wrote their own rules. They disagree on whether customer data may go into a prompt.

2

Is there a named group that makes the AI decisions the policy leaves open, reporting through one accountable executive?

When the answer is no: A team wants an assistant to send emails on its own. Nobody's job is to say yes or no.

3

Is there one list of every piece of AI in use: the assistants your staff built, the ones you bought, and the AI switched on inside software you already pay for?

When the answer is no: "How many AI systems do we run?" is answered with a guess.

4

Before anyone builds or buys an AI tool, is there a route for asking first, with a short assessment of what could go wrong?

When the answer is no: An assistant that answers customers' questions about their accounts goes live. Nobody wrote down what happens when it gives someone a wrong answer.

5

Is there a written rule saying which kinds of data may reach which kinds of AI?

When the answer is no: A member of staff asks whether they may paste a complaint into the assistant. The answer depends on who they ask.

6

Have you looked for files and sites shared too widely or with no owner (the things an assistant will surface in seconds) and fixed the worst of them?

When the answer is no: A salary spreadsheet shared with everyone in 2019 is found by the assistant in seconds. Nothing was breached; the access already existed.

7

Is AI activity logged, and are the logs kept long enough to answer a complaint?

When the answer is no: A customer complains about what an assistant told them three weeks ago. Nobody can find what it said.

8

Does your incident process say what to do when an AI system goes wrong, including how to switch off one assistant without switching off AI for everyone?

When the answer is no: At 4pm on a Friday an assistant is doing something it should not. Nobody knows who to call or what to do, so it keeps running until Monday.

9

Where an AI tool affects people, whether customers, staff or the people you serve, is there a short written assessment of the effect on them, not only of the risk to the organisation?

When the answer is no: An assistant decides which enquiries to answer first. Nobody checked who it leaves until last, so the people slowest to reply wait longest.

10

Before an AI tool is switched on, do you measure how the work is done today, so you can show later whether anything improved?

When the answer is no: An assistant has run for a year. Is anyone better off? Nobody measured before, so nobody can say.

Where should we e-mail your result?

Your score, the band it falls in, and your ten answers, with the three lowest marked as the ones to raise with your leadership team first.

Your answers and contact details go to RAISE.AI (Gembitz Ltd) so we can send your result. We do not share them with anyone.

About the RAISE Method

A reference model of 60 capabilities an organisation must hold to run AI safely, each traced to a recognised standard (ISO/IEC 42001, the international AI management standard, and NIST's AI Risk Management Framework among them); a nine-rung ladder from foundations to autonomous agents, with a gate before each step; and generated board and technical plans that your board and your IT team can work from.

Built on twenty years of Microsoft enterprise architecture and information governance work. The current version was applied at a large UK charity through 2026. Delivered by RAISE.AI (Gembitz Ltd, est. 2017). Book an intro call or write to ossama@raiseai.co.