Updated 17 October 2026. Instead of repeating a survey percentage, try a simpler exercise: ask the team to produce the evidence behind one important AI governance claim. Earlier numerical claims in this article were not adequately sourced and have been removed.

Run an evidence retrieval exercise

Choose a claim that matters to the system’s use. It might concern permitted actions, human review or recovery after failure. Ask for the current record and the test or observation supporting it. Note how long it takes to find the right version, without turning the exercise into a performance contest.

Check whether the evidence describes the deployed configuration. A test from an earlier model or tool set may still be relevant, but that relevance needs an explanation. Do not assume that a familiar file name establishes continuity.

Ask someone outside the immediate team to read the record. Can they understand the purpose, result and limitation? If they need the author to narrate every sentence, the evidence may be too dependent on private context.

This exercise is not an independent audit or proof of compliance. It is a way to find missing records, stale assumptions and unclear ownership while the stakes are manageable.

Run an evidence retrieval exercise: review map
Question Evidence or action
Retrieve Current record and supporting evidence
Match Evidence describes the deployed system
Explain Result and limitations are understandable
Illustrative decision aid. Adapt it to the actual system and context.

The practical next step

Fix what the exercise reveals and repeat it on another important claim. Readiness should become easier to demonstrate, not merely easier to describe in a presentation.

Keep the resulting decision, its owner and unresolved questions in a short decision record. For claims about agent behaviour, connect the decision to evaluation evidence rather than relying on a successful demonstration alone.

Further primary reading: NIST AI Risk Management Framework. The review map and product recommendations above are my analysis, not a certification or a legal assessment of a particular deployment.