Module · Five questions on who really draws the line

The Governance Deep-Dive

The core assessment asks whether a governance owner exists. This module asks whether governance actually operates: five questions about the machinery behind the boundary between what AI decides and what a human still decides.

Question 1 of 5 · Decision inventory exists

Do you have a written inventory of the decisions AI systems influence today?

Not the systems: the decisions. Pricing overrides, lead routing, credit flags, content takedowns. If nobody can produce the list, the boundary layer is being drawn implicitly, one deployment at a time.

Question 2 of 5 · Veto exercised in practice

Has your governance owner actually blocked or reversed an AI-driven decision in the last year?

A veto that has never fired is a hypothesis, not a control. The first real block tells you whether the authority holds when it costs somebody a deadline.

Question 3 of 5 · Escalation path is named

When an AI output is wrong, does everyone know exactly where it goes?

Not a ticket queue: a named path from the person who spots the error to someone with authority to change the system, with a feedback loop back to the reporter.

Question 4 of 5 · Boundaries reviewed on schedule

Are the AI-decides versus human-decides boundaries revisited on a fixed schedule?

Boundaries set once fossilise. The system earns scope (or loses it) as evidence accumulates; without a review cadence, yesterday's caution and yesterday's recklessness both persist unexamined.

Question 5 of 5 · Incidents feed back

Are AI misfires recorded and fed back into how the system is governed?

Every organisation has AI near-misses. The question is whether they end as anecdotes in hallway conversations or as entries that change a threshold, a boundary, or a training set.

For the statistics · one click each

Three questions for the public picture

These do not affect your score. They feed the anonymised, aggregated statistics; groups under 8 respondents are never shown.

Does your company have a written AI policy?

No policy

In draft

Published, not enforced

Published and enforced

Has an AI-driven decision already caused damage in your company?

Not that we know of

A near-miss, caught in time

Yes, minor damage

Yes, significant damage

How far along is your EU AI Act preparation?

Not started

Assessing exposure

Use cases classified

Controls implemented

Outside EU scope

Your context

Used to calibrate the report. Company size and sector remain in the anonymized dataset; your email does not.

Company size Sector (optional)

Your corporate email required

We do not accept Gmail, Outlook, GMX, etc. Use your company domain.

Anonymised answers feed aggregated public statistics (groups under 8 respondents are never shown); your email is deleted after confirmation. Details: Datenschutz.

I agree that my anonymized answers (without my email or company name) may be used in Thorsten's published analysis. Tell me when new assessments or question modules go live. One email per launch, opt out any time with one click.