DMS AI Governance Assessment

⏱ Estimated time: 15–20 minutes total

Section 1 of 10

Organizational Profile

Provide foundational information about your organization to contextualize the AI risk assessment.

GOVERN · MAP · MEASURE · MANAGE

1.1 Organization Information GOVERN 1.1

Legal Organization Name *

Industry / Sector *

Organization Size (Headcount) *

Annual Revenue Range (Optional)

Primary Operating Jurisdiction(s)

Does the organization operate in regulated industries?

Yes No

Which regulations apply? (select all that apply)

Please specify the regulation(s):

Does the organization have an existing enterprise risk management (ERM) program?

Yes Partial No

Cybersecurity policy framework in place?

Yes — NIST CSF Yes — ISO 27001 Yes — Other No

1.2 Primary Contact Internal

Contact Name

Title / Role

Email Address

Phone (Optional)

Section 2 of 10

AI System Inventory & Classification

Identify and classify the AI system being assessed. Complete one assessment per AI system, or provide consolidated answers for an organization-wide assessment.

MAP 1 — Context & Use Classification

2.1 AI System Identification MAP 1.1

AI System Name / Product Name *

Deployment Status *

Brief System Description *

3–5 sentences describing what the system does, its inputs, outputs, and primary function.

System Type (select all that apply)

Classifier Generative Model Recommender System Predictive Analytics Natural Language Processing Computer Vision Autonomous Decision System Robotic Process Automation Other

Development Source *

Date of Initial Deployment

Vendor Name

Product Name

Version

Has this system undergone a prior risk assessment?

Yes In Progress No

2.2 Purpose and Use Context MAP 1.1, 1.3, 1.4

Stated Business Purpose *

Decisions Supported or Automated

Intended Beneficial Outcomes

Decision-Making Role *

Fully autonomousNo human in the loop; system makes final decisions

Recommends to human decision-makerSystem output is advisory; human reviews and decides

Human makes final decision (AI provides input)Strong human oversight; AI is one input among many

Mixed or context-dependentRole varies by use case or deployment context

Does this system interact directly with end users or customers?

Yes No

Describe the end user population:

Does this system process or output information that directly affects individuals' rights, benefits, opportunities, or access to services?

Yes No Uncertain

Deployment Contexts / Environments

2.3 AI Lifecycle Responsibility GOVERN 1.4

Which lifecycle stages is the organization responsible for? (select all that apply)

Plan & Design Data Collection & Processing Model Build & Use Verify & Validate Deploy & Use Operate & Monitor

For third-party systems: which stages does the vendor control vs. the organization?

Section 3 of 10

Data Governance

Document the data inputs, training data characteristics, and quality controls for this AI system.

MAP 2 — Data Context & Risk

3.1 Training & Input Data MAP 1.1, 2.3, GOVERN 6.1

Does training data include data about individuals from protected classes (race, sex, age, religion, national origin, disability)?

Yes No Unknown

Is the training dataset documented with a data card or model card?

Yes Partial No

Training data refresh frequency

Is data sourced from third parties?

Yes Mixed No

Are data use agreements and licenses in place for third-party data?

Yes Partial No

Are there known gaps in data representativeness (e.g., underrepresentation of demographic groups)?

Yes No Unknown

Is data subject to data residency or sovereignty requirements?

Yes No

3.2 Data Quality Controls MEASURE 2.5

Are data validation and cleaning processes in place and documented?

Yes Partial No

Are processes in place to detect and address data drift or concept drift?

Yes Partial No

Is a data lineage or provenance record maintained?

Yes Partial No

Section 4 of 10

Stakeholder & Impact Mapping

Identify affected populations and characterize the potential harms and benefits of this AI system.

MAP 1 · MAP 5 — Impact & Harm Assessment

4.1 Affected Populations MAP 5.1, 5.2, 1.2

Who are the primary users of this system? *

Who are the secondary or indirectly affected individuals?

Are any affected populations considered vulnerable (e.g., minors, individuals with disabilities, low-income communities, non-English speakers)?

Yes No Unknown

Could this system's outputs affect individuals who never directly interact with it?

Yes No Uncertain

Have affected communities or end users been consulted during design or development?

Yes Planned No

4.2 Impact Characterization MAP 5.1, 5.2

For each harm type, rate the likelihood and severity of that harm occurring due to this AI system.

Harm Type

Likelihood

Severity

Harm to civil liberties or legal rightsRights & Legal

Discriminatory or disparate outcomes across demographic groupsFairness

Financial harm to individuals or the organizationFinancial

Physical safety risk to individualsSafety

Psychological harm to individualsWellbeing

Harm to the organization's reputationReputational

Harm to operational continuityOperational

Environmental or societal harmSocietal

Harm from security breach or data exfiltration via the AI systemSecurity

4.3 Benefits Characterization MAP 5.2

What measurable benefits does this system provide?

Are there established metrics or KPIs for demonstrating those benefits?

Yes In Development No

Section 5 of 10

Trustworthiness Characteristics Assessment

Rate the current implementation maturity of each trustworthiness characteristic for this AI system.

MEASURE 2 — Trustworthiness Evaluation

ⓘRate each item on a four-point scale. These ratings directly inform the risk posture sections of your generated policy.

5.1 Valid and Reliable Section 3.1

Are accuracy metrics defined and documented for this system?