Method: how it is calculated

Method: how it is calculated

Scale

Each question has 5 levels: None (0 points), Initial (1), Structured (2), Managed (3), Optimised (4). “I don’t know” counts as 0 and is flagged; from 3 onwards, the diagnostic is marked incomplete.

Axis score

Sum of the axis points ÷ (4 × number of questions) × 100, rounded.

Overall score

Sum of axis scores multiplied by their weight. The weighting profile depends on the context: public sector, then highly regulated, then ambition.

Levels

0-19: 1 · 20-39: 2 · 40-59: 3 · 60-79: 4 · 80-100: 5. In the public sector or a highly regulated activity, the level does not exceed 3 while Security and safeguards is below 60.

12-month targets

Explore: +15 points, floor 35 · Structure: +25, floor 50 · Scale: +30, floor 60 · ceiling 90 · highly regulated: Security and safeguards at least 65.

Work areas

Priority = gap × urgency ÷ effort; the 3 highest are kept. Urgency 1.5 for Skills, for Governance if usage rules are oral or missing, for Data if “scattered data”; 2 for Security and Governance if decisions affect people (or “I don’t know”) or the activity is highly regulated. Effort 1 or 2 depending on the axis, +1 depending on constraints, at most 3.

Actions

30 action cards, 5 per axis. A card is offered if the axis score is within its band and the context fits; 1 card per axis below 50 people or in Explore mode, 2 otherwise. Prerequisites are added first. SEC-01 is added automatically if decisions affect people.

Plan

Capacity over 90 days: 15, 30, 60 or 90 person-days depending on size, × 0.8 with a tight budget or few skills. At most 40% of capacity and 3 starts per period; a prerequisite ends before the action that depends on it; 0.5 person-days reserved to redo the diagnostic in D61-D90.

What is borrowed

The Govern, Map, Measure and Manage functions of the NIST AI RMF 1.0 (a voluntary framework) are used as a grid; continuous improvement comes from ISO/IEC 42001:2023; dates and risk categories come from the AI Act. Everything else (axes, questions, weights, thresholds, targets, actions, plan) is the lab’s own choice.

Weights by profile (%)

Sources

• EUR-Lex, Regulation (EU) 2024/1689 (AI Act), Official Journal
• EUR-Lex, Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689, Official Journal
• NIST AI Risk Management Framework 1.0
• ISO/IEC 42001:2023

EU Official Journal texts consulted on 29/10/2026 (Regulations (EU) 2024/1689 and 2026/1744). Dates to re-check on EUR-Lex before each publication.

Model v1.0 · library v1.0 · revised 2026-10

Glossary

Generative AI

A tool that produces text, images or code from a written request.

Personal data

Any information that identifies a person, directly or indirectly.

High risk

AI Act category for uses such as screening job applications or access to an essential service, subject to stricter obligations.

AI Act

The European regulation on artificial intelligence (Regulation (EU) 2024/1689).

AI literacy

The knowledge and skills needed to use AI in an informed way (within the meaning of Article 3, point 56, and Article 4 of the AI Act).

Non-approved use

An AI tool used without the agreement of IT or management.

Human review

A check by a person before an AI output is sent or used to decide.

AI lead

A person appointed to coordinate AI uses and the related rules.

Indicator

A quantified measure tracked over time, with a starting value.

Person-day

One day of work by one person.

Limits

• Self-reported answers: the result reflects the perception of the person answering.
• Weights, thresholds, targets and actions are the lab’s own choices, with no official reference framework.
• Efforts are orders of magnitude to adjust, not measurements.
• Indicative tool, not legal advice.
• Regulatory references up to date as of 29/10/2026; they may change. Only texts published in the Official Journal of the European Union are authentic.