The framework
What each of the five pillars means
The AI Strategy Health Check scores five pillars, each carrying its own risk weight and its own written Level 5 gold standard, so a rating means the same thing in every organization.
Which capabilities belong to which pillar
Every capability is assessed inside exactly one pillar, and each carries its own weight within it. Until a capability has either an independent observation or an answer from your team, it is reported as not yet assessed rather than scored low.
| Pillar | Weight | Capabilities | Status |
|---|---|---|---|
| Pillar 1 · Business strategy and AI value | 5 | 6 | Not yet assessed until your check runs |
| Pillar 2 · Data readiness | 4.8 | 5 | Not yet assessed until your check runs |
| Pillar 3 · AI security and trust | 5 | 5 | Not yet assessed until your check runs |
| Pillar 4 · People and change | 4.2 | 6 | Not yet assessed until your check runs |
| Pillar 5 · AI operating governance | 4.4 | 5 | Not yet assessed until your check runs |
Pillar 1
What is Business strategy and AI value?
Business strategy and AI value asks one question of an organization: where AI attaches to the business, who owns it, and whether the value is proven. It is Pillar 1 of the five scored in the Ejentic AI Strategy Health Check, and it is rated on the same 5-level ladder as every other pillar.
What we look at
- · Business strategy and where AI attaches to it
- · Executive sponsorship and decision rights
- · Roadmap and funding
- · Portfolio and value realization
- · Target maturity and the gap
- · Highest-leverage opportunity identification
What good looks like
Each metric has a current baseline, a target, a date and a named owner. Leadership can answer “where’s the revenue?” for every AI investment without preparation.
The Level 5 standard for Business strategy and where AI attaches to it, the heaviest capability in this pillar.
Why it matters
- · It carries a risk weight of 5 out of 5, so a weak score here moves the overall readiness figure more than a weak score in a lighter pillar.
- · 6 capabilities are scored inside it, each against a written Level 5 standard rather than an opinion.
Pillar 2
What is Data readiness?
Data readiness asks one question of an organization: is the data fit for an AI use case to consume? It is Pillar 2 of the five scored in the Ejentic AI Strategy Health Check, and it is rated on the same 5-level ladder as every other pillar.
What we look at
- · Classification and ownership
- · Data quality
- · Architecture and integration
- · Privacy, retention and regulatory constraint
- · Enterprise data use policy for AI
What good looks like
Classification is applied org-wide and enforced technically, not by policy alone. Every domain has a named owner who signs off on access changes, and the catalog is current within a defined window.
The Level 5 standard for Classification and ownership, the heaviest capability in this pillar.
Why it matters
- · It carries a risk weight of 4.8 out of 5, so a weak score here moves the overall readiness figure more than a weak score in a lighter pillar.
- · 5 capabilities are scored inside it, each against a written Level 5 standard rather than an opinion.
- · A critical gap here caps the pillar at 2.5 through the Data classification gate, however well the rest of the pillar scores.
Pillar 3
What is AI security and trust?
AI security and trust asks one question of an organization: five domains protecting the data, the models and the people using them. It is Pillar 3 of the five scored in the Ejentic AI Strategy Health Check, and it is rated on the same 5-level ladder as every other pillar.
What we look at
- · Data protection, privacy and confidentiality
- · Threat defence, guardrails and red teaming
- · Identity, access and contextual authorization
- · Governance, auditability and lineage
- · Shadow AI, vendor and supply-chain risk
What good looks like
All AI interactions pass through a gateway with real-time DLP and automated PII/PHI masking. Vendor contracts guarantee zero data retention and prohibit customer data use for base model training. Vector embeddings are encrypted and purged on the retention schedule.
The Level 5 standard for Data protection, privacy and confidentiality, the heaviest capability in this pillar.
Why it matters
- · It carries a risk weight of 5 out of 5, so a weak score here moves the overall readiness figure more than a weak score in a lighter pillar.
- · 5 capabilities are scored inside it, each against a written Level 5 standard rather than an opinion.
- · A critical gap here caps the pillar at 2.0 through the DLP / ingestion gate, however well the rest of the pillar scores.
- · A critical gap here caps the pillar at 2.5 through the RAG authorization gate, however well the rest of the pillar scores.
- · A critical gap here fires the Guardrail / execution gate: Threat defence scores 1 — raw input reaches the model and raw output reaches systems.
Pillar 4
What is People and change?
People and change asks one question of an organization: communication, collaboration and capacity when AI enters the work. It is Pillar 4 of the five scored in the Ejentic AI Strategy Health Check, and it is rated on the same 5-level ladder as every other pillar.
What we look at
- · Shared meaning
- · Question channels
- · Ownership under AI
- · Leadership consistency
- · Load honesty
- · Adoption as behaviour
What good looks like
A current RACI covers governance, delivery and risk; handoffs between human and AI steps are documented; and the catch, fix and notify roles are known before anything goes wrong.
The Level 5 standard for Ownership under AI, the heaviest capability in this pillar.
Why it matters
- · It carries a risk weight of 4.2 out of 5, so a weak score here moves the overall readiness figure more than a weak score in a lighter pillar.
- · 6 capabilities are scored inside it, each against a written Level 5 standard rather than an opinion.
- · A critical gap here caps the pillar at 2.5 through the Change capacity gate, however well the rest of the pillar scores.
- · Parts of this pillar are declared by the organization rather than observed end to end, so the report labels how much of it was evidenced.
- · Weight raised from 2.8 to 4.2 — a stated methodology decision, on the evidence that change capacity, not technology, decides whether AI reaches the P&L.
Pillar 5
What is AI operating governance?
AI operating governance asks one question of an organization: how governed the AI already running is, across five process domains. It is Pillar 5 of the five scored in the Ejentic AI Strategy Health Check, and it is rated on the same 5-level ladder as every other pillar.
What we look at
- · Discovery and inventory
- · Prompt and model lifecycle
- · Evaluation and observability
- · Access, routing and cost governance
- · Risk, compliance and auditability
What good looks like
Continuous discovery at the browser and desktop level feeds a live AI registry.
The Level 5 standard for Discovery and inventory, the heaviest capability in this pillar.
Why it matters
- · It carries a risk weight of 4.4 out of 5, so a weak score here moves the overall readiness figure more than a weak score in a lighter pillar.
- · 5 capabilities are scored inside it, each against a written Level 5 standard rather than an opinion.
Where to read next
The Ejentic AI Strategy Health Check scores these five pillars in one engagement. The methodology page explains how the ratings become a score and a grade, and the pricing page lists what an assessment and each remediation module cost.