How it is calculated
Each pillar is the average of its active tasks. The overall score is the average of the five pillar percentages, so every pillar counts equally regardless of how many tasks it holds.G, Governance
- AI policy adopted. Your current policy version has been adopted.
- Material impact recorded. At least one signed materiality determination.
- Org details complete. Firm name, address and contact email all present.
U, Use
- AI register set up. At least one tool on the register.
- Tool suitability assessed. Signed appropriateness assessments divided by number of tools.
A, Accountability
- Output checks logged. Oversight Log entries divided by number of tools.
- Spot-checks on automated tools. Locked.
- Client explanations ready. Locked.
R, Risk
- Risk register populated. Risks with a residual likelihood, residual impact and risk response, divided by number of tools. Scores zero unless your firm’s risk appetite is set.
- Supplier checks complete. Tools with supplier due diligence recorded, divided by number of tools.
- Risk register reviewed quarterly. Locked.
D, Documentation
- Staff trained. Recorded against your firm.
- Client terms updated. Your current client disclosure statement has been adopted.
- Audit trail active. Shown for information and excluded from the calculation.
Three things to understand about the number
Three tasks are locked and never count
Three tasks are locked and never count
Spot-checks, client explanations and quarterly review are shown but not yet built, so they contribute nothing.Two of them are real obligations. Clause 4.2 requires randomised dip samples for automated or high-volume use, and clause 3.3 requires quarterly review. You can score 100% while having done neither.
Several tasks are measured per tool
Several tasks are measured per tool
Output checks, tool assessments, populated risks and supplier checks are all divided by the number of tools on your register.That has an odd consequence. Add a tool and your score falls, until you assess it, log a decision against it, and record a risk. That is arguably the right incentive, but it means the number moves for reasons that have nothing to do with your firm getting less compliant.It also means “output checks logged” is a proxy. Five tools needs five Oversight Log entries to score full marks, whether or not five decisions were actually called for.
Risk appetite is a gate
Risk appetite is a gate
If your firm’s risk appetite is not set, the risk register task scores zero no matter how many risks you have recorded and scored. Set it and the score changes immediately.

