Illustration of a computer screen with four AI tools active and a status message showing 4 tools in use, 0 approved, on a transparent background.

AI Risk & Readiness Assessment

Your Staff Is Already Using AI, Whether or Not Anyone Approved It.

Find out where it's in use, what data it touches (PII, ePHI, and other sensitive data), and what to fix before a board member, customer, or auditor asks.

The AI Risk & Readiness Assessment gives your organization an independent, evidence-based picture of your AI risk in 1-2 weeks, for one flat fee.

Not ready yet? Take the free AI Quick Check →

Schedule Your Assessment

Why This Matters

AI adoption didn’t wait for a policy.

Staff are summarizing documents, drafting emails, and building reports in ChatGPT, Copilot, and Gemini, often in personal accounts that your compliance program can't see.

That's sensitive data leaving your environment, whether that's PII, ePHI, or other confidential information, and your customers, partners, and auditors are starting to ask how you govern it. Either way, the question is coming. The only choice is whether you have an answer when it does.

Most organizations don't have a list of approved tools, an owner for AI decisions, or a way to show anyone what's in use.

The Problem With Waiting to Find Out

“We’re working on it” isn’t an answer.

What Feels Like Preparedness

  • • An AI policy that’s drafted but never approved.
  • • A ban that nobody follows.
  • • Staff using a personal AI account “just for drafting.”

Risk & Impact

  • • A board member, customer, or auditor asks how you govern AI. You have nothing to show.
  • • You can’t govern what you can’t see. And you can’t defend a program you never built.
  • • ePHI, PII, or other sensitive data leaves your environment, and there’s no record of where it went.

What You Get

The assessment measures your organization against the NIST AI Risk Management Framework, the federal standard regulators, auditors, and customers recognize.

You'll receive:

01

Overall AI Readiness Score

02

Leadership & Governance Score

03

Technical Safeguards Score
Sample report excerpt showing AI readiness and leadership scores with weak ratings and summary findings, with overlaid text.
Simple dark blue check mark icon on a white background symbolizing confirmation or approval.

Findings across key AI readiness areas, ranked by likelihood and severity

Simple dark blue check mark icon on a white background symbolizing confirmation or approval.

Your top 3 priorities for the next 90 days

Simple dark blue check mark icon on a white background symbolizing confirmation or approval.

Executive summary and detailed findings report

Simple dark blue check mark icon on a white background symbolizing confirmation or approval.

Findings review session with your leadership team

Large blue number one on a white background

Schedule

Book a call to get started. We’ll confirm your contacts and timing.
Large blue number 2 centered on a white background with no additional elements

Capture

Your leadership team and staff complete a short questionnaire, and we review your Microsoft 365 environment for technical safeguards. Both run through CaptureOps, our compliance platform.
Blue number three on white background, simple bold typography with no additional text elements.

Review

In 1–2 weeks, we walk your leadership through the findings and your top 3 priorities.

What we’ll need from you

A primary contact and an IT/security contact, the leadership questionnaire, Microsoft 365 tenant access, any known list of AI tools in use, and leadership time for the findings review.

Who This Is For

  • Organizations that need to know what AI staff are using and what data it touches
  • Service providers and vendors whose customers are asking how they govern AI
  • Executives and boards responsible for risk oversight
  • Compliance and privacy officers
  • IT leaders who need a defensible starting point for AI governance

Who it’s not for

  • Organizations not on Microsoft 365, or teams looking for an AI tool recommendation rather than a governance review.

Investment

AI Risk & Readiness Assessment

$1,995

one-time • 1-2 weeks

All core deliverables included

Schedule Your Assessment

What happens next: Many clients keep their AI risk and compliance program current through our ongoing compliance and vCISO programs, Continuous Assurance and Elevate. Sign within 90 days and your assessment fee is credited toward your first month.

Getting security questionnaires from your customers or partners? Ask about bundling with our Security Risk Assessment. The two share discovery work.


CaptureOps logo

Powered by CaptureOps

Most security programs live in a drawer. Ours don’t.

Your assessment runs on CaptureOps, the platform behind every Continuous compliance and vCISO program. Your leadership team completes a short questionnaire and your staff answers an anonymous survey. We pair that with your Microsoft 365 settings, so your scores are based on evidence instead of opinion.

If you continue with Continuous Assurance or Elevate, your findings carry straight into your live CaptureOps program. Nothing starts over, and your AI governance stays current instead of going stale in a report.

Schedule a CaptureOps Demo
Compliance tracking
Vendor risk management
Audit-ready security risk assessments
Board-ready reporting
And more

Frequently Asked Questions

How much does an AI risk assessment cost?
Ours is $1,995 flat, with all core deliverables included. AI governance assessments in the market range from free questionnaires to multi-week consulting engagements costing much more. The difference is usually depth and whether you get evidence or just opinions.
How long does it take?
1–2 weeks from kickoff to findings review. Your staff will answer an anonymous survey about their AI usage, your leadership team will answer a questionnaire.
Do we need an AI policy before we start?
No. Most organizations we assess don’t have an approved one. That’s usually one of the first findings.
What’s the difference between this and a free AI readiness quiz?
A quiz tells you what you believe. This assessment checks your actual Microsoft 365 configuration and scores you against NIST AI RMF, so your findings hold up when a board member, customer, or auditor asks.
Can our current IT provider or MSP do this?
Possibly. Ask whether they’ll measure you against NIST AI RMF, rank findings by likelihood and severity, and present them to your leadership. Many IT providers focus on tools and settings, not governance and decision ownership.
Is this a HIPAA assessment?
No. It focuses specifically on AI use, risk, and governance. If you need to answer customer security questionnaires or show HIPAA safeguards, ask about bundling with our Security Risk Assessment.
What happens after the assessment?
You keep the report and your top 3 priorities whether or not you work with us. If you want help acting on them and keeping your program current, that’s what Continuous Assurance and Elevate do.

Ready to See Where You Stand on AI?

The outcome isn’t just a report. It’s evidence your leadership can act on.

Contact
(332) 217-0601
hello@continuous.net

Schedule Your Assessment

We bring structure, coordination, and ongoing oversight so your environment stays aligned and your team always knows what to focus on next.