From decision to production, how long does a governed change to an AI system take?

Measure the whole path including approval, not just the engineering. The approval queue is usually the longer half.

Could you change a cryptographic algorithm, or swap a model provider, without a code change?

This is the abstraction question. It decides whether the next forced change is a configuration task or a programme.

Can funded work be reprioritised mid cycle without waiting for the next planning round?

Threats do not arrive in line with the planning calendar. This measures whether the calendar governs you or you govern it.

How quickly can a change to a governance policy reach enforcement in production?

A policy that takes a quarter to enforce is a document. This is the distance between deciding and binding.

When a new obligation or threat appears, how long before you know which of your systems it touches?

Agility is worth little if the first two months go on working out the scope.

Do you know what AI systems and cryptographic dependencies exist across the estate?

Anticipation begins with an inventory. Everything downstream of this question depends on it.

For your highest autonomy system, can you stop it, and has that been timed by someone other than its author?

An untested containment path is a documented intention. The author testing their own work does not count.

Do your AI systems operate against reliability objectives and error budgets set by autonomy level?

Chapter 15’s reliability contract. The same technology at a higher autonomy level should face a stricter gate, because a failure executes rather than being reviewed.

Do you know which obligations come into force in the next twelve months, each with a named owner?

Anticipation is the word in the definition. A register nobody owns is a list.

Have you rehearsed an AI incident end to end, including the communications and the reversal?

Response is the third word in the definition. Containing an agent is the easy part; reconciling what it did is the long part.

Of the multi year technology programmes you started three or more years ago, how many finished as intended?

The least comfortable question here, and the most predictive. Count them rather than estimating.

Would a multi year programme survive its executive sponsor leaving?

Sponsorship that depends on one person is a single point of failure with a notice period.

Has this class of work survived a budget cycle with its funding intact?

Multi year governance and migration work competes with immediate priorities every year, and loses quietly.

Do the teams who must adopt these changes have the capacity to absorb them?

Change saturation is the most under diagnosed cause of stalled value. The technology works; the organization had nothing left to give.

Are the named owners from a year ago still in place, and is there succession?

Owner churn without succession is how a governed system becomes an unowned one without anybody deciding.

How were these scores arrived at?

The single biggest determinant of whether the result survives a challenge.

Who took part in the assessment?

A single function scoring itself produces a predictable answer.

Is there a prior assessment to compare against?

A single reading is a position. Two readings are a trend, and a board will ask for the trend.