07 / Governance tool

Make shadow AI a visible risk.

Turn twelve practical questions into a prioritised plan for safer AI use.

Private, browser-based calculation
02 / Your resultSample scenario
High risk

60 / 100

Unconfirmed controls count as gaps. Address sensitive data and ownership first.

60exposure / risk
Policy40
40
People40
40
Controls40
40

Your prioritised action list

01 · Hours

Is there a written AI policy

Ask the owner for evidence and record the answer. This closes an unverified policy gap.

02 · Days

Is there an approved tools list

Ask the owner for evidence and record the answer. This closes an unverified policy gap.

03 · Days

Does every tool have an owner

Ask the owner for evidence and record the answer. This closes an unverified policy gap.

04 · Days

Is there an exception process

Ask the owner for evidence and record the answer. This closes an unverified policy gap.

05 · Days

Are sensitive-data rules clear

Ask the owner for evidence and record the answer. This closes an unverified people gap.

Give people a governed way to build.

Weeks · offer an approved environment, clear ownership and a safe route from idea to production.

Keep the reasoning, not just the number.

Assumptions and sources Checked 2026-10-14

Design sample, not a vendor quote. All prices, weights and questions come from the shared model. USD is the base currency; EUR uses an illustrative rate of 0.92. Totals are rounded to whole currency units. Prices exclude tax.

Build rates
Agency $85,000 · AI coding $42,000 · platform $28,000
Recurring costs
Flat platform $1,800/month. Annual seat discount 15%. See the result table for each seat and overage rate.
Questionnaire scoring
Yes 100 · unsure 40 · no 0. Equal question weights; unknowns never count as evidence.
Model provenance
App Build Index illustrative research model · 2026-10-14. Read the method →
Your full-report detail Answers & next steps
Is there a written AI policy?
unsure
Is there an approved tools list?
unsure
Does every tool have an owner?
unsure
Is there an exception process?
unsure
Are sensitive-data rules clear?
unsure
Have staff received training?
unsure
Can people report mistakes safely?
unsure
Do people review AI outputs?
unsure
Can IT see which AI tools are used?
unsure
Is access removed when staff leave?
unsure
Are retention settings reviewed?
unsure
Can staff build in an approved environment?
unsure

Questions for your next conversation

  • Which assumptions change when you quote our exact use case?
  • Can you demonstrate the required controls and a complete export?
  • Who owns support, recovery and the transition at contract end?
30days · inventory tools and assign owners
60days · train staff and close data-control gaps
90days · test the approved building route and review controls
  • Is there a written AI policy? — Request evidence.
  • Is there an approved tools list? — Request evidence.
  • Does every tool have an owner? — Request evidence.
  • Is there an exception process? — Request evidence.
  • Are sensitive-data rules clear? — Request evidence.
  • Have staff received training? — Request evidence.
  • Can people report mistakes safely? — Request evidence.
  • Do people review AI outputs? — Request evidence.
  • Can IT see which AI tools are used? — Request evidence.
  • Is access removed when staff leave? — Request evidence.
  • Are retention settings reviewed? — Request evidence.
  • Can staff build in an approved environment? — Request evidence.

This is the browser-generated report content. Print / PDF includes your result and its assumptions; email delivery is a placeholder.

A useful next step

Send me the full report.

Your results, your assumptions and the questions to take into a vendor conversation.

Design preview · No details are sent and no email is delivered.

Only the details you submit are included. Read our privacy notice.

Questions, answered

Before you decide.

Do I need an account or an email to see my result?

No. Your headline result appears immediately and updates as you change the inputs. Email is optional and only used if you ask for a report.

Are these vendor quotes or procurement advice?

No. This design edition uses clearly marked sample prices and weights. Use the assumptions panel to inspect the model, then get a written quote and verify controls with each vendor.

Where do my inputs go?

Calculations happen in your browser. A share link contains your answers, so share it only with people who should see them. The report form is a preview placeholder; it does not deliver email in this edition.

Sources & assumptions

  1. App Build Index sample research model, 14 October 2026. Prices and scores illustrate the interface and are not verified vendor offers.
  2. European Commission · AI Act framework. Reviewed 14 October 2026. Apply the rules to your exact use case with qualified advice.