Skip to content
AEGISbyRAMSYS
Create accountSign inRequest a demo
Platform

Interview, evidence, score, signed documents.

Aegis runs an AI governance assessment end to end. The AI handles the conversation and the first draft. A rules engine handles every number. RAMSYS handles the judgement.

Request a demoSee the 90-day plan

Five stages, each leaving a record.

  1. Interview

    An AI interviewer talks to each department about the AI it actually uses, including chat assistants and tools adopted without approval.

  2. Evidence

    Departments upload the policies, registers and contracts that back their answers. Each document is attached to the answer it supports.

  3. Score

    A deterministic rules engine scores seven dimensions of maturity and records a finding against every control. The AI does not set any score.

  4. Review and sign

    RAMSYS consultants review the findings and the drafted documents, then your signatories approve and sign them.

  5. Verify

    Every issued document carries a QR code. Anyone holding a copy can confirm it is genuine and still current.

Interview

Finds the AI you did not know you had.

Most organisations use AI through chat assistants, office suites and vendor features, not models they built. A questionnaire misses that. An interview asks follow-up questions until the real use is on the record.

Each department gets questions for the functions it performs, in a fixed order, and can stop and resume. Every answer it gives is checked against the expected form before it is stored.

What the interview captures

  • AI tools in use, approved or not, and who uses them
  • What data goes into them, including personal data
  • Where people rely on AI output to make decisions about others
  • Existing policies, training, oversight and incident procedures
  • The documents that prove each of the above
Why is data governance at level 2?Illustrative example
  1. Score2of 5, capped by a ruleData governance and privacy. Raw score 3.5 before the cap.
  2. FindingGap Registration as a data controllerBinding obligation, severity critical
  3. Answer“We haven’t registered with the Data Protection Commission. I think IT may have looked into it.”Finance department interview
  4. EvidenceNo registration certificate uploadedRequested from Finance and IT
  5. LawData Protection Act, 2012 (Act 843): a data controller that processes personal data must register with the Data Protection Commission.
The rules engine applied the cap. The AI wrote none of these numbers.
Evidence and traceability

Every number has a chain of custody.

Departments upload the registers, policies and contracts behind their answers. Each document attaches to the answer it supports, and each answer maps to the controls it tests.

When the board asks why a dimension scored 2, anyone can follow the link from the score, to the finding, to the answer and document, to the clause of law.

Scoring

Rules set the score. The AI does not.

A deterministic rules engine scores seven dimensions on a five-level maturity scale and records a met, partial or gap finding against every control. The same answers always produce the same result.

Some gaps are serious enough to cap a dimension however strong everything else is. An organisation processing personal data without registering as a data controller cannot score above level 2 for data governance, and the scorecard says so.

The seven dimensions

  • Strategy and leadership
  • Data governance and privacy
  • Security
  • Risk and compliance
  • People and AI literacy
  • Technology and tooling
  • Use-case management
2.0of 5, organisation-wide maturity
Maturity by dimension, illustrative
DimensionMaturity barLevel
Strategy and leadership3.5
Data governance and privacy2.0 (capped by a rule)
Security2.0 (capped by a rule)
Risk and compliance1.0
People and AI literacy2.5
Technology and tooling3.0
Use-case management2.0

Capped at 2.0Not registered as a data controller with the Data Protection Commission. The rules engine applied the ceiling; nothing else this organisation does can lift it until the registration exists.

Illustrative data. Hatching marks the maturity a binding legal gap removed. No model set any of these numbers.
Documents

Drafted from vetted clauses, signed by your people.

Drafts are assembled from a clause library that lawyers have reviewed, with the AI filling in the organisation-specific detail. A finding that rests on a control counsel has not yet verified cannot appear in an issued document.

For the board and executive committee

Executive AI Readiness Scorecard

One maturity level for the organisation, seven dimensions beneath it, and the binding obligations still unmet.

QR-verifiable once issued

One for each department interviewed

Departmental AI SOP Playbooks

Standard operating procedures written for how that department actually uses AI, with named owners.

QR-verifiable once issued

For signature by your accountable executives

Master Corporate AI Policy

An organisation-wide AI policy assembled from a lawyer-vetted clause library, not written freshly by a model.

QR-verifiable once issued

Review and approval

A RAMSYS consultant reviews findings and edits drafts before anything goes to your signatories. Every version is kept.

Signatures and verification

Your accountable executives sign. Each issued document carries a QR code that leads to a public check of whether it is genuine and current. Verify a document

Adoption tracking

After signing, remediation actions get owners and due dates, and departments confirm they have adopted their playbooks.

See your organisation’s readiness the way your board will.

A 45-minute walkthrough with a RAMSYS consultant: the interview, a scored assessment, and the documents it produces.

Request a demoSee how it works