For the board and executive committee
Executive AI Readiness Scorecard
One maturity level for the organisation, seven dimensions beneath it, and the binding obligations still unmet.
Signed, versioned and verifiable
AI governance your board can defend, line by line.
Aegis interviews every department, scores your AI governance against Ghanaian law and international standards, and produces signed policy documents. Every number traces to an answer, a document and a clause of law.
Now enrolling pilot organisations for 2027
Why is data governance at level 2?Illustrative example
- Score2of 5, capped by a rule
- FindingGap Registration as a data controller
- Answer“We haven’t registered with the Data Protection Commission. I think IT may have looked into it.”
- EvidenceNo registration certificate uploaded
- LawData Protection Act, 2012 (Act 843): a data controller that processes personal data must register with the Data Protection Commission.
Pilot programmeEnrolling a small group of Ghanaian organisations for 2027.
Led by RAMSYSLegal and governance practitioners review every engagement.
Built in GhanaGhanaian law first, with a sovereign Ghana-hosted option.
What you get
A score the law is allowed to overrule.
Most governance tools average their way to a number, so a serious legal breach disappears into a good overall result. Aegis scores each dimension from the answers, and then applies the obligations that bind this organisation. Where one is unmet, it sets a ceiling the rest of the score cannot climb past.
A board sees the ceiling the law imposed and the clause that imposed it — not just a low number somebody will argue about.
2.0of 5, organisation-wide maturity
| Dimension | Maturity bar | Level |
|---|---|---|
| Strategy and leadership | 3.5 | |
| Data governance and privacy | 2.0 (capped by a rule) | |
| Security | 2.0 (capped by a rule) | |
| Risk and compliance | 1.0 | |
| People and AI literacy | 2.5 | |
| Technology and tooling | 3.0 | |
| Use-case management | 2.0 |
Capped at 2.0Not registered as a data controller with the Data Protection Commission. The rules engine applied the ceiling; nothing else this organisation does can lift it until the registration exists.
April 2026
Ghana launched its National AI Strategy. Boards are now being asked how their organisation governs the AI it already uses.
The problem
Most AI governance reviews end in a report whose conclusions nobody can re-derive six months later.
Scores that depend on who asked
Two reviewers interviewing the same department reach different conclusions. A board cannot defend a number it cannot reproduce.
Findings with no trail
A finding in a PDF does not point to the answer or document behind it, so an auditor has to take it on trust.
Law mapped by hand, every time
The mapping from Ghanaian law to international standards is rebuilt for each engagement instead of maintained once.
How it works
From interview to a document anyone can verify.
The AI does the interviewing and the drafting. Rules set the scores. People review and sign. Each step leaves a record the next one depends on.
Interview
An AI interviewer talks to each department about the AI it actually uses, including chat assistants and tools adopted without approval.
Evidence
Departments upload the policies, registers and contracts that back their answers. Each document is attached to the answer it supports.
Score
A deterministic rules engine scores seven dimensions of maturity and records a finding against every control. The AI does not set any score.
Review and sign
RAMSYS consultants review the findings and the drafted documents, then your signatories approve and sign them.
Verify
Every issued document carries a QR code. Anyone holding a copy can confirm it is genuine and still current.
What you receive
Three signed documents, not a slide deck.
Each one is assembled from a clause library vetted by lawyers, filled in from your findings, approved by RAMSYS, signed by your executives and issued with a QR code that confirms it is genuine.
One for each department interviewed
Departmental AI SOP Playbooks
Standard operating procedures written for how that department actually uses AI, with named owners.
Signed, versioned and verifiable
For signature by your accountable executives
Master Corporate AI Policy
An organisation-wide AI policy assembled from a lawyer-vetted clause library, not written freshly by a model.
Signed, versioned and verifiable
Who it is for
One assessment, read four ways.
The same evidence serves the board, the compliance team, IT and the public interest. Each sees the part they are accountable for.
Boards and executives
A maturity level you can defend, with the binding obligations listed separately from good practice.
Compliance and legal
Findings mapped to Act 843 and Act 1038, with the answer and document behind each one.
IT and data
A register of the AI tools in use across the organisation, including the ones nobody approved.
State-owned enterprises
Sovereign hosting in Ghana and documents that stand up to public scrutiny.
Frameworks
Ghanaian law first, international standards alongside.
Findings say whether a control is a legal obligation or good practice. A gap against Act 843 is not presented with the same weight as a gap against a voluntary framework.
| Framework | How Aegis treats it | What it covers in an assessment |
|---|---|---|
| Data Protection Act, 2012 (Act 843)Ghana | Binding in Ghana |
|
| Cybersecurity Act, 2020 (Act 1038)Ghana | Binding in Ghana |
|
| ISO/IEC 42001 — AI management systemsInternational standard | Benchmark |
|
| NIST AI Risk Management FrameworkUnited States, voluntary | Benchmark |
|
| EU Artificial Intelligence ActEuropean Union | Binding only where output reaches the EU |
|
Software and people
Software that scales, with experts who stand behind it.
Aegis is operated by RAMSYS, a Ghanaian legal and consulting firm. The platform does the repeatable work so practitioners can spend their time on judgement.
The platform
- Interviews every department
- Collects and links evidence
- Scores against the control library
- Drafts from vetted clauses
- Tracks adoption and actions
RAMSYS practitioners
- Scope the engagement
- Review every binding finding
- Edit and approve the documents
- Brief the board
- Advise on remediation
Trust and security
Your governance data is evidence. We treat it that way.
The controls below are part of how the platform is built, not settings you have to remember to turn on.
Isolated by the database
Row-level security scopes every query to one organisation, even if application code is wrong.
Hosted in Ghana
The sovereign tier keeps your data in Ghana, for organisations that need it to stay there.
An audit trail you cannot edit
Significant actions are written to an append-only log that records who did what, and when.
Verifiable documents
A public check confirms a document was issued and is current, without revealing its contents.
Ghana first. The Gambia next. The continent after that.
Every assessment is scored against the law that actually binds the organisation taking it, which means a country is not a translation — it is a library of instruments, obligations and crosswalks that RAMSYS’s lawyers verify before a single client sees it.
Where the data may not leave the country, the same platform runs in country, on your own infrastructure.
Pilot programme 2027
Help shape AI governance for Ghanaian organisations.
We are enrolling a small number of organisations for 2027. Pilot organisations receive a full assessment and work directly with the team building the platform.
What pilot organisations receive
- A full assessment of the departments you choose
- The scorecard, department playbooks and corporate AI policy, signed and issued
- A named RAMSYS consultant throughout
- A board briefing on the findings
- Direct input into what the platform does next
Rollout
Signed documents in about 90 days.
A typical engagement for a handful of departments. Larger organisations run in waves on the same plan.
- Day 30Assess
Scope agreed and departments named. Interviews run with each department, evidence is collected, and the AI tools in use are registered.
- Day 60Score and draft
The rules engine scores all seven dimensions. RAMSYS reviews every binding finding, and the scorecard, playbooks and policy are drafted.
- Day 90Sign and adopt
Documents are approved, signed and issued with QR verification. Adoption tracking starts and remediation actions have owners and dates.
Questions
What people ask first.
Does the AI decide our score?
No. The AI conducts the interviews and drafts prose. Every score and every finding comes from a deterministic rules engine applied to your answers and evidence, so the same inputs always give the same result.
Each number links back to the answers, documents and controls that produced it, and a RAMSYS consultant reviews the findings before anything is issued.
We do not build AI models. Is this for us?
Yes. Most organisations use AI through chat assistants, office software and vendor tools, often without a formal decision to adopt them. Aegis finds that use through interviews, so it does not need access to a model pipeline or a data science team.
Which laws and frameworks are covered?
Ghana’s Data Protection Act, 2012 (Act 843) and Cybersecurity Act, 2020 (Act 1038) are binding. ISO/IEC 42001 and the NIST AI RMF are used as benchmarks. The EU AI Act is treated as binding only for AI systems whose output reaches the EU; elsewhere it is a benchmark.
Where is our data stored, and who can see it?
Each organisation’s data is isolated by the database itself using row-level security, so a query cannot return another organisation’s records. A sovereign deployment keeps your data hosted in Ghana. See Trust for the detail.
Does this replace our lawyers?
No. Aegis supports legal advice and does not replace it. Documents are assembled from a clause library reviewed by lawyers, and RAMSYS practitioners review each engagement, but your organisation should still take advice on its own circumstances.
What does a pilot involve?
A full assessment of an agreed set of departments over roughly 90 days, run with a RAMSYS consultant, ending in signed documents. Pilot organisations also shape the product through regular feedback sessions. Ask about the pilot programme.
See your organisation’s readiness the way your board will.
A 45-minute walkthrough with a RAMSYS consultant: the interview, a scored assessment, and the documents it produces.