Scutoria

Tools

Where does my business stand on AI?

The self-assessment from the annex of the handbook, here to tick off. Per statement: applies, partly, does not apply. At the end a profile per field of action and the sections that go with it. No sign-up, we store nothing.

The problem

Where does my business stand in dealing with AI, honestly?

There is a tool, there are a few rules in people’s heads, and nobody knows whether that is enough. The handbook “AI in the Company” has a self-assessment in its annex for this: twenty statements in five fields of action, from governance to evidence.

What the check does: The short check presents exactly these statements to tick: applies, partly, does not apply. At the end there is a profile per field of action and the sections of the handbook that go with it.

What it does not do: It names no standard and no legal consequence; it places what you say about your own business.

Start the check · 5 min · free

Do I need the handbook to do the check?

No. The statements are here in full; the handbook then explains what is behind each field.

Can I keep the result?

Not without an account; nothing is stored. With Premium every result can be saved and compared later.

Who should fill in the check?

The person who answers for the decisions in the business. A second run with the office manager often shows where the pictures diverge.

Field 1 of 5A · Governance and responsibility

Applies: It exists in the business, and it is done that way. · Partly: There are beginnings, but not throughout or not for everyone. · Does not apply: It does not exist, or you do not know.

1. It is known which AI tools are actually used in the company, including use via private accounts. (Section 7.1)

2. One person is responsible by name for the use of AI and is known within the company as the point of contact. (6.1)

3. The tools in use are obtained under business plans, not via private or cost-free accounts. (2.4)

4. Before a new tool is introduced, a documented examination takes place; contracts are terminable at short notice. (2.4, 6.1)

Field 2 of 5B · Data and data protection

Applies: It exists in the business, and it is done that way. · Partly: There are beginnings, but not throughout or not for everyone. · Does not apply: It does not exist, or you do not know.

5. It is laid down in writing which particulars may not be entered into AI tools, and that determination is known to all involved. (7.2, 7.4)

6. For every tool into which personal data may pass, a concluded data processing agreement is in place. (11.2)

7. The use of AI is recorded in the record of processing activities, and the legal basis is set down for each processing step. (11.2)

8. The necessity of a data protection impact assessment has been examined and the result documented. (11.2)

Field 3 of 5C · Transparency obligations

Applies: It exists in the business, and it is done that way. · Partly: There are beginnings, but not throughout or not for everyone. · Does not apply: It does not exist, or you do not know.

9. It is known in which cases the use of AI must be marked, and the decision chart is applied. (10.8)

10. Any chat system in customer contact points out its machine nature clearly at the first contact. (10.1, 10.7)

11. For published content it is regulated who carries out the examination as to content and bears responsibility. (10.3)

12. The accessibility requirements have been examined; the applicability of the exception for microenterprises is settled. (10.5)

Field 4 of 5D · Security

Applies: It exists in the business, and it is done that way. · Partly: There are beginnings, but not throughout or not for everyone. · Does not apply: It does not exist, or you do not know.

13. A data backup separated from the network exists, and its restoration has been successfully tested at least once. (12.2)

14. Accounts are tied to individuals, secured by two-factor login and blocked immediately upon departure. (12.2)

15. Payments and changes of bank details are approved, without exception, only after a return call to a stored telephone number. (12.3)

16. An established procedure exists for incidents, including the notification period under data protection law. (12.4)

Field 5 of 5E · Competence and rules

Applies: It exists in the business, and it is done that way. · Partly: There are beginnings, but not throughout or not for everyone. · Does not apply: It does not exist, or you do not know.

17. A written internal rule on the use of AI is in place and has been handed out. (7.4)

18. A briefing has taken place; date, participants and content are documented. (7.5)

19. The duty of examination for figures, names, time limits and references is known and is complied with. (3.3, 7.2)

20. Incidents can be notified without consequences under employment law, and this has been expressly communicated. (7.4, 12.4)

The quick check sorts what you yourself say about your business. It names no standard and no legal consequence; what applies to you is in the handbook, with a source and a date.