Free tool
AI Risk Assessment
Built for a business without a compliance department. Questions adapt to your answers, every finding explains why it was produced, and requirements are screened against a verified dataset (ruleset 2026.10.14-1, sources verified 2026-10-14). Your answers stay in your browser until you choose to save them.
Free AI risk assessment
Fifteen to twenty-five questions. About eight minutes.
The questions adapt to your answers: a four-person firm using one assistant will not see the questions meant for a company running autonomous agents across three countries. Nothing is sent to our servers until you choose to save your results.
Part 1
Your organization
Where you operate and who your AI affects determines which rules can apply.
Part 2
AI usage
Every tool counts, including the free assistant someone on your team uses quietly.
Part 3
Data exposure
What goes into AI systems is usually the biggest driver of obligations.
Part 4
Governance
Unknown answers are not treated as safe answers.
How the assessment works
The assessment collects organization context (jurisdictions, industry, size, whether you build or deploy AI, who is affected), AI usage (from public assistants to autonomous agents), data exposure, and ten governance practices. It then does three things.
- Produces findings. Each finding is generated by a transparent rule, states why it was produced from your answers, and carries a priority score: severity (1–5) × likelihood (1–5) × exposure (1–3, from personal data and affected individuals). "Not sure" answers are scored as likely, because unknowns are not safe.
- Screens requirements. A versioned rules engine compares your profile with structured provisions from Canadian, EU, US and international instruments and reports potentially applicable, likely not applicable, insufficient information, or requires specialist review. Proposed legislation and voluntary standards are labelled as such.
- Suggests next actions and reassessment triggers. Every meaningful finding links to a specific action and the evidence that would show it is addressed.
What it does not do
It does not produce a compliance percentage, decide legal classification for you, or replace a privacy impact assessment. The maturity level is an internal prioritization model with its dimensions shown. For regulated or unusual uses, obtain qualified professional review.