Produced by Vector Labs
HOW TO USE THIS ASSESSMENT
Score each statement from 0 to 2:
- 0 = Not in place
- 1 = Partially in place / in progress
- 2 = Fully in place
Complete all 30 questions in your chosen industry track.
Total your score out of 60. Find your maturity stage and recommendations at the end.
Select Your Industry
Section 1 — Data Readiness
We have structured, labelled datasets relevant to our target AI use cases. Our data quality is actively monitored and documented.
We have documented data governance policies. Our data is programmatically accessible to analytics and ML teams without manual extraction requests.
We have active data pipelines (not one-off exports). Data flows automatically from source systems into a centralised platform or data lake in near-real time or on a defined schedule.
We understand exactly which data assets have appropriate consent or legal basis for AI use. We have a clear process for ensuring AI systems only operate on permissioned data.
Our datasets are large enough to train reliable models. They represent the real-world diversity of cases our AI will need to handle (e.g., different subscriber types, patient demographics, fraud typologies).
Section 2 — Infrastructure
Q6. Cloud & Compute Infrastructure
We have a cloud-native or hybrid infrastructure capable of supporting model training, inference, and deployment at scale. We can access GPU or managed AI services when needed.
Q7. MLOps & Model Lifecycle Management
We have tooling and processes for versioning models, monitoring their performance in production, triggering retraining, and rolling back failed deployments. Our models do not "set and forget."
Q8. Integration Architecture
Our AI outputs can connect to the business systems that need to act on them (CRM, EHR, fraud management platform, content management system) via APIs or standard integration patterns — not manual exports.
Q9. Testing & Staging Environments
We have dedicated staging environments where AI models can be tested against real-world conditions before production deployment.
Q10. Security & Access Controls
Our AI infrastructure has appropriate security controls: data encryption at rest and in transit, role-based access, audit logging, and protection against model inversion or data extraction attacks.
Section Total: 0 / 10
We have a cloud-native or hybrid infrastructure capable of supporting model training, inference, and deployment at scale. We can access GPU or managed AI services when needed.
We have tooling and processes for versioning models, monitoring their performance in production, triggering retraining, and rolling back failed deployments. Our models do not "set and forget."
Our AI outputs can connect to the business systems that need to act on them (CRM, EHR, fraud management platform, content management system) via APIs or standard integration patterns — not manual exports.
We have dedicated staging environments where AI models can be tested against real-world conditions before production deployment.
Our AI infrastructure has appropriate security controls: data encryption at rest and in transit, role-based access, audit logging, and protection against model inversion or data extraction attacks.
Section 3 — Talent & Organisation
We have internal data scientists or ML engineers who can own the design, build, and iteration of AI models — not solely dependent on external vendors for every change.
A senior leader (CDO, CTO, or equivalent) actively owns the AI programme, has board visibility, and can make resourcing decisions. AI is not treated as an IT project.
Key stakeholders who will use or be affected by AI outputs (e.g., marketing teams, clinicians, compliance officers) understand what AI can and cannot do, and can interpret model outputs without requiring a data scientist in the room.
We have a defined approach to managing the organisational change that AI introduces: communicating with affected teams, redefining roles, and managing resistance.
We have a clear process for scoping, selecting, and managing external AI partners. We know how to write an AI brief, evaluate proposals, and measure delivery.
TRACK A — MEDIA & PUBLISHING
Section 4 — Subscription AI Readiness
We capture and store granular subscriber behaviour: content engagement by article/topic/format, visit frequency, session depth, device, and time-of-day patterns. This data is linked to subscription status and payment history at an individual level.
We have a working model (or structured process) that generates a real-time or near-real-time churn probability score per subscriber — not just a retrospective report of who cancelled last month.
We have a Customer Data Platform (CDP) or equivalent that unifies subscriber data across devices and products. Personalisation is powered by this unified profile, not by siloed campaign tools.
We know what percentage of our audience has consented to personalised data use. Our AI systems are built to operate on consented data, not assumed permissions.
We use propensity modelling to identify which anonymous or registered readers are most likely to subscribe — and vary our paywall or offer logic based on that prediction.
Section 5 — Media Governance & Explainability
Senior editorial and product leadership trusts and actively uses AI-driven recommendations. There is a defined process for editorial override of algorithmic decisions. AI and editorial work together — the model does not operate in isolation.
Our AI personalisation systems have been reviewed for GDPR and ePrivacy compliance. We have a documented legal basis for each data processing activity that feeds our models.
We measure the true incremental lift of our AI systems using holdout groups — not just comparing before/after performance. We can isolate what the AI is actually contributing vs. background trends.
We have a defined policy on our content's use by external AI systems (crawlers, LLMs) and on our own use of AI-generated content. Our intellectual property strategy accounts for the AI licensing landscape.
Our AI churn model connects to automated retention workflows in our CRM or marketing platform — triggering personalised interventions without manual campaign management for each at-risk subscriber.
TRACK B — HEALTHCARE & LIFE SCIENCES
Section 4 — Healthcare AI Readiness
Our clinical data is standardised across systems (consistent coding, terminology, and annotation standards). We have addressed the heterogeneity in data formats across EHR systems, imaging equipment, and care settings.
We can build or operate AI models on data that cannot be centralised — either through federated learning, differential privacy, or secure multi-party computation. We are not blocked by data sharing constraints from building effective models.
We have an established pathway for obtaining ethics board approval, clinical governance sign-off, and relevant regulatory clearance (MDR, UKCA, FDA 510k as applicable) for AI-based clinical tools.
AI outputs from our models are integrated into clinical workflows at the point of care — not delivered as separate reports that clinicians must manually consult.
We have processes for monitoring the performance of deployed clinical AI in real-world conditions — including detecting model drift, demographic performance disparities, and updating models as patient populations change.
Section 5 - Healthcare Governance & Explainability
Clinical staff who use AI outputs can understand why a prediction was made. We use explainable AI methods (SHAP, LIME, or equivalent) in production clinical models — not just as a research exercise.
We have documented consent frameworks for each AI use case involving patient data. Consent is granular (not blanket), auditable, and revocable — and our systems enforce it technically, not just procedurally.
We test our clinical AI models for performance disparities across demographic groups (age, sex, ethnicity, socioeconomic status). Bias assessment is part of our model validation process, not a post-hoc check.
We have ISO 27001 certification or equivalent. Our information governance framework covers AI-specific risks including model inversion, membership inference, and data re-identification.
We can execute AI projects that span multiple clinical institutions without requiring centralised data sharing. We have the legal agreements, governance frameworks, and technical infrastructure to support collaborative AI development at scale.
TRACK C — BANKING & FINANCIAL SERVICES
Section 4 — Financial Services AI Readiness
Our transaction data is accessible to fraud and risk models in real time (not batch delays). Event streaming infrastructure is in place so models can act on signals as they occur — not hours later.
Our fraud detection models are retrained regularly on recent fraud typologies. We do not rely on static rule-based systems or models trained on data more than 12 months old as our primary defence layer.
We use ML-based CLV and propensity models to inform product offers, credit decisions, and retention interventions — not just rule-based segmentation or manual analyst processes.
Our AI and ML models go through a formal model risk management (MRM) process before deployment, including independent validation, documentation of assumptions and limitations, and ongoing monitoring against approved performance thresholds.
Our AI models can deliver decisioning outputs within the latency requirements of the business use case — including sub-second fraud scoring at transaction authorisation and near-real-time credit risk assessment.
Section 5 — Financial Services Governance & Compliance
We can explain individual AI decisions (credit decline, fraud flag, pricing offer) to regulators, auditors, and affected customers in plain language. Our explainability documentation satisfies existing regulatory requirements (FCA, PRA, ECB guidelines as applicable).
Our model risk management framework addresses AI-specific risks including concept drift, training data bias, feature leakage, and adversarial inputs. We have documented evidence of independent model validation.
We test AI models used in lending, insurance underwriting, or pricing for discriminatory outcomes across protected characteristics. Fair lending compliance is part of our model development lifecycle — not a retrospective audit.
We have assessed our AI systems for adversarial attack vectors — including model poisoning, adversarial examples in fraud detection, and prompt injection in customer-facing AI tools. Countermeasures are in place and tested.
We apply model risk management standards to third-party AI models and APIs embedded in our products — not just internally built models. We have a documented process for assessing, approving, and monitoring external AI.
TRACK D — PHARMA & DRUG DISCOVERY
Section 4 — AI Strategy, Governance & Compliance
We have a clearly defined AI strategy aligned with overall business objectives (R&D, manufacturing, commercial, pharmacovigilance)
We have an executive sponsor or AI governance board responsible for AI initiatives and prioritization?
Our AI models are developed and validated in accordance with regulatory requirements (e.g., GxP, 21 CFR Part 11, EMA/FDA guidance on AI/ML)?
We have formal data governance frameworks in place to ensure data quality, lineage, traceability, and audit readiness?
We have a standardized framework for AI risk assessment, validation, documentation, and ongoing model performance monitoring (including bias detection and drift management)?
Section 5 — Data, Technology & Operationalization
Our organization have scalable, secure data infrastructure (e.g., cloud, data lakes, real-world data integration) to support AI use cases?
Our clinical, manufacturing, safety, and commercial datasets are integrated and accessible through standardized formats and APIs?
Our AI use cases are deployed across multiple value chain functions (e.g., drug discovery, clinical trial optimization, supply chain forecasting, pharmacovigilance)?
We have an established MLOps framework for model deployment, version control, validation, retraining, and lifecycle management?
Our AI are models validated, documented, and seamlessly integrated into GxP-regulated production environments (e.g., clinical systems, manufacturing execution systems, pharmacovigilance platforms) with clear audit trails and traceability?
TRACK E — MANUFACTURING
Section 4 — Data, Technology & Operational Deployment
Our manufacturing systems (MES, SCADA, ERP, PLCs, IoT sensors) are integrated into a centralized, scalable data platform (cloud or hybrid)?
Is production, quality, and maintenance data accurate, standardized, and available in near real-time for AI applications?
Have AI solutions been deployed in key areas such as predictive maintenance, demand forecasting, quality inspection (vision AI), energy optimization, or process control?
There is an established process for deploying models into production, monitoring performance, handling drift, and retraining models?
Can AI solutions developed in one plant or production line be standardized and scaled across multiple facilities?
Section 5 — Strategy, Governance & Leadership
There is a clearly defined AI strategy aligned with manufacturing goals such as OEE improvement, cost reduction, quality enhancement, and safety?
There is a clear leadership ownership (e.g., CIO, COO, Digital/Industry 4.0 head) responsible for AI roadmap prioritization and funding?
There are formal governance processes for AI project selection, model validation, documentation, and lifecycle management?
AI systems are evaluated for operational risk, cybersecurity vulnerabilities, regulatory compliance, and safety impact?
There is a structured change management approach to ensure frontline workforce adoption and trust in AI-driven recommendations?
TRACK F — EDUCATION
Section 4 — AI Vision & Institutional Alignment
There is a defined AI strategy aligned with institutional goals such as student success, operational efficiency, research excellence, and personalized learning?
There i a formal governance body (e.g., CIO office, academic council, AI task force) overseeing AI initiatives, policies, and prioritization?
Clear policies are in place regarding ethical AI use, academic integrity, bias mitigation, transparency, and responsible use of generative AI tools?
AI systems are compliant with relevant data protection and education regulations (e.g., FERPA, GDPR, COPPA), with strong student data privacy safeguards?
Structured training and change management programs are in place to support faculty and administrative staff in adopting AI tools effectively?
Section 5 — Data, Technology & Implementation
Sstudent information systems (SIS), learning management systems (LMS), assessment platforms, and CRM systems are integrated into a centralized, accessible data environment?
Student performance, engagement, attendance, and operational data is standardized, clean, and available for analytics and AI applications?
AI solutions are actively deployed in areas such as personalized learning pathways, early warning systems for at-risk students, automated grading, enrollment forecasting, or chatbot-based student support?
Our institution has scalable infrastructure (cloud, APIs, analytics platforms) capable of supporting AI model development and institution-wide deployment?
Our AI systems are monitored for performance, bias, accuracy, and impact on student outcomes, with processes for regular review and improvement?
Section 6 — Strategy
Our AI programme is driven by specific, measurable business outcomes — with agreed KPIs, baselines, and measurement methodology defined before development begins. We do not describe success in terms of model accuracy alone.
AI has genuine executive sponsorship (not just endorsement). Budget is committed for a 12+ month programme — not a single project. Leadership understands that AI is an ongoing capability, not a one-time implementation.
We have a documented AI roadmap with prioritised use cases, sequenced by business value and technical feasibility. The roadmap is reviewed quarterly and connected to our overall business strategy.
We have a clear and consistently applied framework for deciding which AI capabilities to build internally, which to license as tools, and which to develop with an external partner. We do not make these decisions on a project-by-project basis without a consistent rationale.
AI performance, risk, and return are reported to board or senior leadership on a regular cadence — with metrics that connect AI activity to business outcomes, not just technical performance indicators.
