AI Readiness Assessment Frameworks: A Checklist Traced to NIST, ISO and Government of Canada Sources

A readiness scorecard is only as defensible as the sources behind its questions. Start from frameworks that governments and standards bodies have published, and ask one plain question of every item: could we show evidence of this today?

This guide summarizes seven public frameworks, explains who each is for, and turns them into a readiness checklist in which every item names its source.

If you want a quick, self-serve starting point first, HCC's free AI readiness assessment recommends where to start and explains why; it does not produce a numeric score. The checklist below is the deeper, evidence-based companion to it.

NIST AI Risk Management Framework (AI RMF 1.0). The U.S. National Institute of Standards and Technology (NIST) released the AI RMF 1.0 on January 26, 2023, for voluntary use. NIST describes it as a resource for organizations designing, developing, deploying or using AI systems, and as non-sector-specific and use-case agnostic. NIST organizes the framework's core into four functions, Govern, Map, Measure and Manage, and designs Govern as a cross-cutting function that informs and is infused throughout the other three. As of November 2026, NIST's AI RMF page states that the AI RMF 1.0 is being revised as part of the White House AI Action Plan, without giving a date, so this guide uses version 1.0.

NIST Generative AI Profile (NIST AI 600-1). NIST released the Generative AI Profile (NIST AI 600-1) on July 26, 2024, as a cross-sectoral profile of and companion resource for the AI RMF. NIST defines 12 risks that are novel to or exacerbated by generative AI, including confabulation, data privacy, information security, intellectual property, and value chain and component integration, and suggests actions to help organizations govern, map, measure and manage them.

ISO/IEC 42001:2023. ISO describes ISO/IEC 42001 as an international standard that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within organizations. According to ISO, it is for organizations of any size involved in developing, providing or using AI-based products or services, in all industries. ISO notes that, rather than looking at the details of specific AI applications, the standard provides a way of managing AI-related risks and opportunities across an organization using the Plan-Do-Check-Act methodology. ISO lists ISO/IEC 42001:2023 as published, edition 1, with a publication date of December 2023.

The Directive on Automated Decision-Making and the Algorithmic Impact Assessment. The Government of Canada describes the Directive on Automated Decision-Making as a directive to ensure that automated decision systems used in the Government of Canada are transparent, accurate and fair. According to the Government of Canada's scope guide, the directive applies to departments as defined in section 2 of the Financial Administration Act, and automating non-administrative decisions is not subject to it. The Government of Canada's Algorithmic Impact Assessment (AIA) is the mandatory risk assessment tool that supports the directive: a questionnaire that determines the impact level of an automated decision system, from Level I (little impact) to Level IV (very high impact). According to the Government of Canada, the AIA is composed of 65 risk questions and 41 mitigation questions, and it is available to the public for sharing and reuse under an open licence. That openness makes it a practical template for private organizations, even though the directive itself is written for federal departments.

Guide on the use of generative AI. The Government of Canada's Guide on the use of generative AI provides guidance to federal institutions on their use of generative AI tools, and frames its recommended approach around the FASTER principles: Fair, Accountable, Secure, Transparent, Educated and Relevant.

ISED's Voluntary Code of Conduct. Innovation, Science and Economic Development Canada's Voluntary Code of Conduct for advanced generative AI systems, dated September 2023, lists outcomes that signatory developers and managers of advanced generative systems commit to working to achieve: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness.

OECD AI Principles. According to the OECD, its AI Principles were adopted in May 2019 and updated in May 2024, and as of January 2026 the OECD reports that its AI Recommendation had been adopted by all OECD Members and adhered to by ten partner economies and the European Union. The OECD's five values-based principles include transparency and explainability; robustness, security and safety; and accountability.

Each item is something you should be able to show evidence of, followed by its source.

1. Legal and regulatory requirements for AI are documented. NIST's AI RMF (GOVERN 1.1) calls for legal and regulatory requirements involving AI to be understood, managed and documented.

2. You keep an inventory of AI systems, including generative AI. NIST's AI RMF (GOVERN 1.6) calls for mechanisms to inventory AI systems, and NIST's Generative AI Profile suggests enumerating generative AI systems for that inventory. Include AI features embedded in software you already license.

3. Roles, responsibilities and executive accountability are written down. NIST's AI RMF asks that roles, responsibilities and lines of communication for AI risks be documented (GOVERN 2.1) and that executive leadership take responsibility for decisions about AI risks (GOVERN 2.3).

4. You have an AI policy, objectives and processes, and you review them. ISO describes an AI management system as a set of elements intended to establish policies and objectives, and processes to achieve them, for the responsible development, provision or use of AI systems. NIST's AI RMF (GOVERN 1.5) adds ongoing monitoring and periodic review of the risk management process, with the review frequency decided.

5. Your risk tolerance is defined. NIST's AI RMF (GOVERN 1.3) calls for processes to determine the needed level of risk management activities based on the organization's risk tolerance.

6. You know how you would retire an AI system. NIST's AI RMF (GOVERN 1.7) calls for processes for decommissioning and phasing out AI systems safely.

7. Each use case has a documented purpose and context. NIST's AI RMF (MAP 1.1) calls for the intended purposes, context-specific laws, norms and expectations, and the settings in which the AI system will be deployed to be understood and documented.

8. Benefits and costs are written down, including non-monetary costs. NIST's AI RMF asks that potential benefits be examined and documented (MAP 3.1), along with potential costs, including non-monetary costs from AI errors (MAP 3.2).

9. Each system that affects people has an impact rating. The Government of Canada's AIA organizes its risk questions into project, system, algorithm, decision, impact and data areas, and its mitigation questions into consultations and de-risking and mitigation measures. Use those headings to rate your own systems that make or support decisions about people.

10. The assessment is done early and repeated. The Government of Canada says the AIA should be completed at the beginning of the design phase, completed a second time before the system goes into production, and updated when the system's functionality or scope changes.

11. Human oversight is defined. NIST's AI RMF (MAP 3.5) calls for processes for human oversight to be defined, assessed and documented.

12. There is an explicit go or no-go decision. NIST's AI RMF (MANAGE 1.1) calls for a determination of whether the AI system achieves its intended purposes and whether its development or deployment should proceed. For structuring that decision in a pilot, see Designing an AI Pilot Program That Actually Scales.

13. Privacy risk is assessed for each system. NIST's AI RMF (MEASURE 2.10) calls for the privacy risk of the AI system to be examined and documented. NIST's Generative AI Profile describes data privacy risk as impacts due to leakage and unauthorized use, disclosure or de-anonymization of personal or sensitive data.

14. You have rules for which information may go into which tools. The Government of Canada's generative AI guide tells federal staff to ensure that infrastructure and tools are appropriate for the security classification of the information, and states that public servants must not input personal information into publicly available online generative AI tools. The same question applies to any business: which data may go into which approved tools?

15. Supplier and third-party AI risk is covered. NIST's AI RMF calls for policies that address AI risks associated with third-party entities, including infringement of intellectual property (GOVERN 6.1), and contingency processes for failures in high-risk third-party data or AI systems (GOVERN 6.2). NIST's Generative AI Profile names value chain and component integration as a risk, including improper supplier vetting across the AI lifecycle.

16. AI-specific security threats are in your security plan. NIST's Generative AI Profile lists information security as a risk, including an increased attack surface that may compromise the confidentiality or integrity of training data, code or model weights.

17. Systems are tested before deployment and while running. NIST's AI RMF states that AI systems should be tested before their deployment and regularly while in operation.

18. Fairness and bias are evaluated. NIST's AI RMF (MEASURE 2.11) calls for fairness and bias to be evaluated and the results documented.

19. There is a post-deployment monitoring plan. NIST's AI RMF (MANAGE 4.1) calls for post-deployment monitoring plans that include capturing user input, appeal and override, decommissioning, incident response, recovery and change management. ISED's Voluntary Code of Conduct sets a similar outcome for generative systems: system use is monitored after deployment, and updates are made as needed to address risks that materialize.

20. Incidents can be identified and reported. NIST's AI RMF (GOVERN 4.3) calls for organizational practices that enable AI testing, identification of incidents and information sharing.

21. People who use or manage AI are trained. NIST's AI RMF (GOVERN 2.2) calls for personnel and partners to receive AI risk management training to perform their duties. The Government of Canada's Educated principle asks users to learn about the strengths, limitations and responsible use of the tools.

22. Outputs are reviewed by an accountable person. NIST's Generative AI Profile defines confabulation as the production of confidently stated but erroneous or false content by which users may be misled or deceived. The Government of Canada's Accountable principle asks users to take responsibility for the content generated by these tools and the impacts of their use.

23. Over-reliance is planned for. NIST's Generative AI Profile names human-AI configuration as a risk, which can result in automation bias or over-reliance on generative AI systems.

24. AI-generated content is labelled where it matters. The Government of Canada's Transparent principle asks users to identify content that has been produced using generative AI.

25. Each use supports a real need. The Government of Canada's Relevant principle asks users to make sure the use of generative AI tools supports user and organizational needs. If tools are being bought before the problem is named, read Why Business AI Fails Without Strategy.

NIST itself cautions that the actions in its framework do not constitute a checklist, nor are they necessarily an ordered set of steps. Treat the 25 items above as a way to gather evidence, not a pass mark. For an audit, record against each item whether evidence exists, where it lives, who owns it and what is missing. For a scorecard, a status per item (in place, partial, not started) keeps each rating traceable to a document.

If you do need an impact score, the Government of Canada's AIA is a published model of one: its questionnaire assigns a system an impact level from Level I to Level IV.

Choose your anchor framework by need: the NIST AI RMF and its Generative AI Profile set out outcomes and suggested actions item by item; ISO/IEC 42001 suits organizations that want AI governance run as a management system; the Canadian federal instruments show impact assessment and generative AI rules in practice.

A practical sequence: take the free AI readiness assessment to identify where AI should start, then work through this checklist for the systems you already run or plan to run. HCC's AI governance and compliance service can help you map your evidence against these frameworks, and its AI transformation consulting can turn the gaps into a prioritized plan.

NIST — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 NIST — AI Risk Management Framework (overview page) NIST — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1 ISO — ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system Government of Canada — Algorithmic Impact Assessment tool Government of Canada — Automated decision-making Government of Canada — Guide on the Scope of the Directive on Automated Decision-Making Government of Canada — Guide on the use of generative artificial intelligence Innovation, Science and Economic Development Canada — Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems OECD — AI Principles OECD — The OECD.AI Index: Technical paper (2026)