3 questions your CISO cannot answer about AI. Yet.

These questions were not chosen at random. They touch three different legal obligations at once. The first question tests whether you meet the AI literacy obligation from the AI Act, which requires an organisation to know how AI is used within its walls. The second touches the GDPR: without a data processing agreement or an appointed owner, you cannot demonstrate that personal data passing through an AI tool is processed lawfully. And the third is a classic information security issue that NIS2 explicitly weighs into its requirement for appropriate technical and organisational measures.

A CISO who cannot answer any of the three is not just missing some operational details. He is missing the foundation that three separate laws take as their starting point. That is exactly why this check is such a good barometer: it does not test knowledge of the law, but the existence of an actual overview. Without that overview, it is impossible to demonstrate compliance with any of the three laws.

Not every "yes" carries the same weight. For question 1, a good answer is a current list, no older than a quarter, with per tool the name, the department and who uses it. "We think there are about ten" is not an answer, it is an estimate. For question 2, only a document counts, not an impression: a signed data processing agreement, or otherwise an explicit decision stating who accepted the risk and why. For question 3, a good answer is a fixed step in the offboarding process that automatically revokes access and checks data handover, not something the manager has to reinvent for every departing employee.

That distinction between an estimate and a documented answer is exactly where most businesses stumble. A CISO who says "it will probably be fine" effectively gives the same answer as a CISO who does not know. Both lack the evidence that a supervisory authority, a client or an auditor can later request.

Do not start with a policy document, start with an overview: which tools exist, who uses them, and what data goes into them. Our AI Inventory module maps that out in 30 minutes, including the tools your CISO did not yet know about.

Once you have the overview, appoint an owner per tool and document what happens to data when someone leaves the company. That last part is often the gap that stays open the longest, because it is not explicitly on anyone's plate.

Then work with a fixed rhythm: every month, a short round along department heads asking "is anything new", instead of a one-off inventory that is outdated again within a quarter. AI tools often enter through a loose subscription of an individual employee, not through an official procurement route, which means a one-off check rarely captures the full picture.

At a marketing team of 8 people, an internal audit revealed that three of them had been using an AI copywriting tool for months to write draft texts for client campaigns, including fragments from real client briefings. Nobody in IT or compliance knew the tool existed; the subscription ran on a team member's credit card. Only when a client asked whether his confidential market data had "been in an AI somewhere" did it become clear that nobody could answer that question with certainty. A quarterly round as described above would have put this tool on the radar long before a client had to ask the question itself.

Got all three checkmarks? Then ask a harder, fourth question: who in the board is ultimately accountable if one of these answers turns out to be missing anyway? In many SMBs, AI governance informally sits with whoever happens to be the most "tech-savvy", without a formal responsibility attached. Once AI lands in core processes, something that will happen at more and more companies in the coming months, that is no longer a tenable situation.