Evidence for your first 90 days as the AI-accountable executive.
Inside the first 90 days you owe three audiences evidence: a board update, an internal audit conversation, and a record you can use in regulator conversations. The Risk Assessment produces that evidence from your own organisation, with the scope agreed before work starts.
That evidence comes from your own organisation, not from a research base. Our predecessor business, LimitedView, published security-training methodology before IntelXview focused on AI governance. Its outcome figures are not shown while their underlying sources are verified. That work is not the method behind this assessment.
The drawer
What this page covers, and what it does not.
Click any card to expand. The first cards describe the predecessor business's security-training methodology. Its outcome figures are not shown while their sources are verified, and none of it is AI-governance evidence. The last cards describe the assessment, which produces evidence from your own organisation.
Describes how the predecessor business, LimitedView, said it assessed training. Outcome figures are not shown while their sources are verified. This is not AI-governance evidence.
LimitedView, IntelXview's predecessor, worked on security behaviour change before IntelXview focused on AI governance. Its published outcome figures are not shown on this page: no underlying dataset has been located to support them, so they are treated as unverified.
What remains is the methodology it described, set out in the next cards as historical context. None of it is evidence about AI governance or about ACP.
Source: Background reading: Murre & Dros (PLOS ONE, 2015); Proofpoint, State of the Phish (2024); SANS, Security Awareness Report (2024). These do not substantiate LimitedView or ACP results.
This assessment looks at where data can reach workplace AI tools. An ACP proof of concept tests controls on an AI agent workflow. They are separate, and neither is required before the other. See what an ACP PoC includes.
The live evidence register
Our technical evidence register for UK FCA and PRA mapping is public: provider proofs, scenario coverage, audit-log evidence and operational-resilience mapping, each with its current state and residual action. It is technical evidence, not FCA or PRA certification. It rebuilds from each verification run, and each run's signed manifest is retained for 90 days.
View the live register →Why Month One
Three audiences. One evidence base. Inside the first 90 days.
Board update
A new CAIO is often expected to give a first board update within 90 days. The Risk Assessment provides evidence from your own organisation for it.
Internal audit
Internal audit will want the assessment's method, scope and limitations. We provide these with the assessment.
Regulator / insurer
Framework-specific mapping (FCA Consumer Duty, NIS2, NIST AI RMF, ISO 42001) provided on request as part of the Risk Assessment.
Walk into your next board meeting with evidence.
The AI Data Leakage Risk Assessment produces evidence measured in your own organisation, with an agreed scope.