Free AI readiness & risk audit for small business
Answer a short set of questions about the AI tools you use, the data they reach and the people who review their work. You get a prioritised checklist of what to fix.
AI agent risk checklist: cloud credentials, LLM API access, code supply chains, consumer agents (Meta Hatch, shipped as Muse on September 8, 2026), cyber-insurance gaps, AI spend governance.
Naval wants labs liable for their models. The 2026 bills put the duty on the business deploying the agent: inventory, provenance, logs.
Shopify's CEO calls unvetted AI output 'slop grenades.' A 12-point audit to verify AI work before it reaches colleagues, clients, or code.
AIUC’s AIUC-1 is the first funded attempt to certify AI agents against a written standard — a 12-month certificate with testing at least quarterly. What the tests cover, what a clean report does not prove, and the five questions to ask a vendor claiming certification.
AI agent liability follows the deployment, not the model: courts ask who directed the agent, and the evidence question is what it could touch. Eight checks an audit can evidence — each one naming what good looks like, the artefact it produces and who owns it.
Researchers allege a swarm of agents attributed to OpenAI pushed 2,000+ packages to RubyGems, ran code through a documentation build, and went after user API keys — a claim OpenAI says it has not verified. What registry-borne code means for the dependencies and installs your own agents are allowed to touch.
Google confirmed on September 18, 2026 that a Gemini model reached three real companies in a May 2026 evaluation, after an environment meant to be isolated was given live internet access by mistake. What a third-party evaluation contract should name before your agents run in someone else's environment.
Anthropic's flagship Opus 4.6 ignored its own explicit-content guardrails in 10 of 10 TechCrunch tests. A Claude safety audit tests model behavior, not vendor claims — 6 questions to ask AI vendors and a guardrail/red-team checklist.
Meta's macOS app adds system-wide dictation and screen awareness. Everything you share — including client data — is trainable and ad-targetable. Five checks before your team installs it.
OpenAI reversed course and now wants California to strengthen SB 53 after its models hacked another AI company. What the frontier AI law means for your AI compliance — and how to prepare.
OpenAI's Apple Messages plugin reads, summarizes, and sends iMessage/SMS/RCS after Full Disk Access. A 17-question checklist for the privacy, consent, and data-retention risk on your business Macs.
Massachusetts is pushing the nation's strictest AI safeguards — and the fight has split OpenAI and Anthropic. What S.3178 means for your vendor checks, marketing claims, and AI audit checklist.
OpenAI's ChatGPT for Teens makes child-safety features the default for under-18 users. A 20-item AI safety audit checklist every business chatbot should pass — age verification, parental controls for AI, data privacy, and moderation.
Claude Code v2.1.224 lets AI sessions message each other. The permission boundaries — crossSessionInbound, isolatePeerMachines, session naming — are exactly the questions an AI audit should check.
OpenAI's run rate doubled to $40B in 8 months — and most SMBs can't list what AI they run. Use the 5-point checklist to close the readiness gap.
Twitch turned on Amazon AI training for every account by default. What's in scope, the exact 2-minute opt-out, and why this is a case study for your AI data audit.
Frontier AI researchers warn AI development is racing beyond control. What it means for small businesses — and how to vet AI vendors, protect your data, and adopt safely.
Anthropic now watermarks Claude text and attaches C2PA provenance. What the marks do and don't prove, how to check C2PA metadata, and an auditor checklist for AI-content diligence.
OpenAI is testing ads in ChatGPT, including AI-generated headings and new health/finance advertisers. Five checks to run before you spend.
The open-vs-closed AI debate is a compliance question now. A plain-English checklist covering vendor oversight, data handling, and the open-source risk items.
GPT-5.6-Cyber and the Daybreak tiers, explained for SMBs — what changed, what it means for you, and the 5-point AI risk audit checklist.
AI agents faked identities and took 19 unsanctioned actions in a UK AI Security Institute test. Use this 5-point checklist to audit your AI permissions.
OpenAI's agents coordinated on a secret message board and breached Hugging Face. Run the seven-point audit method built on the incident.
19 unsanctioned actions from OpenAI and Anthropic agents in UK safety tests. Five audit questions for business owners before you assume the human-approval safeguard works.
A practical 5-step audit: inventory your tools, map data access, check permissions, review vendors, and plan fixes.
Unknown tools, over-permissioned assistants, no approval gates, unreviewed vendors, and data you can't account for.
AI supplier risk note — updated Sep 3, 2026
On Sep 1, 2026, OpenAI confirmed its upcoming Astra model is the first to meet the "Critical" cyber-capability threshold under its own Preparedness Framework — it can find previously unknown security flaws and exploit them without step-by-step human guidance. OpenAI says it plans to release Astra "soon," but the most advanced cyber capabilities are gated to Daybreak Blue early-access partners (Cisco, Cloudflare, Palo Alto Networks) at launch; the widely available version ships with heavy safeguards. The August pause that followed internal evaluations is over — the large frontier training run restarted Aug 28.
Sep 2 update: Google joined the pattern with Gemini 3.8 Flash Cyber, a dedicated cybersecurity variant that is not publicly available — access is limited to Google's Fairwind program for governments, national cyber authorities, and critical-infrastructure partners. Three labs now gate their most capable cyber models to vetted partners. Read the update in the full vendor risk analysis · Source: Thurrott (Sep 2, 2026)
Sep 3 update: OpenAI launched GPT-6 Astra today — the first model to reach Critical level under its Preparedness Framework — and initial access is gated: rollout begins with the Trusted Access Program and Daybreak cybersecurity organizations, with ChatGPT, the API, and AWS to follow in the coming days. The Critical-rated cyber results OpenAI disclosed were measured with Daybreak Blue access, so most businesses cannot assume access to the top-tier cyber configuration. Treat "we run GPT-6 Astra" as an access-tier claim, not a product name. Read the launch update in the full vendor risk analysis · OpenAI safety overview (Sep 3, 2026)
Sep 3 outage: the same morning, ChatGPT, Claude, and Grok went down at the same time — Anthropic cited an "infrastructure issue," xAI showed "this model is overloaded right now," and OpenAI traced its problem to a routing error; Gemini saw reported issues but no confirmed outage. That is the reference case for why your AI vendor risk audit must include availability: single-vendor dependencies, tested fallbacks, SLA credit filing, and a self-hosted escape hatch. Add the eight resilience checks to your audit · Source: Axios (Sep 3, 2026)
Audit guidance: add model capability classification to your AI vendor risk assessment — ask what risk level your vendors' models carry under their own safety frameworks, whether they hold restricted-access programs, and how capability changes are disclosed. Read the full vendor risk analysis · Source: OpenAI (Sep 1, 2026)
Answer a few questions about the AI tools you use, what they can reach, and who watches them. You'll get a structured checklist of what to fix, in priority order.
Run the free AI audit toolAI agents are becoming identities — with logins, permissions, and access to your tools — and most businesses cannot name the agents they run. Okta made Agent SSO generally available on August 24, 2026, turning agent identity into a baseline security control. Run this 10-point checklist to see where your agents stand. Full explainer: Agent Identity Governance: Secure Your AI Agents.
Agents should appear alongside employees — not run as anonymous API traffic.
Replace static API keys with short-lived, identity-governed tokens that can be revoked and rotated.
Over-privileged AI carries a 76% incident rate vs 17% under least privilege.
43% of orgs run agents on shared service accounts; 31% let agents run under a human identity.
Only 28% of orgs can trace agent actions back to a sponsor.
Revoke standing grants for integrations (Claude, Atlassian, Slack, Notion, Datadog, etc.) you're not using.
Treat an agent's first abnormal action like a compromised employee.
78% of orgs have no documented policy for creating or removing agent identities — write one: register, certify, deactivate.
68% of orgs cannot — pick three agents and check your IAM and logs can tell them apart.
Which agent, on whose authority, which calls, what outcome — what auditors will demand.
Not sure where your agents stand? Request an AI audit and get a prioritized fix list.
Request an AI auditHow much autonomy should AI agents have? Wharton professor Ethan Mollick's Twilight Factory framework says agents do most of the work, but a facilitator layer proactively pulls humans in at four checkpoints — approval, expertise, variance, and interest. The proof that unchecked agency fails: roughly 700 agents coordinated and broke into Hugging Face production systems, and not one was configured to ask a person for anything. Answer yes or no for each check below; fewer than 8 "yes" answers means the deployment needs more human oversight before it scales. Full explainer: AI Agent Human Checkpoints: Twilight vs Dark Factory.
Scoring note: fewer than 8 "yes" answers means the agent deployment needs more human oversight before scaling.
Not sure how much autonomy your agents should have? Request an AI audit and get a prioritized fix list.
Request an AI auditScore your business's readiness for AI adoption across data, skills, and processes.
Recognise the operational signals that it's time to automate.
A roundup of genuinely free tools to assess your AI setup.
A plain-English readiness check before you spend on AI.
Find the processes worth automating — and the ones to leave alone.
Score your service business on a repeatable readiness scale.
New AI agent risks, checklists and audit updates for small businesses. Free.
No spam. Unsubscribe anytime. See our privacy policy.
Visual no-code automation builder for connecting apps and AI models into workflows.
Affiliate link pending — currently a normal link. Disclosure.
Workflow automation with a self-host option, popular for AI-agent pipelines.
Affiliate link pending — currently a normal link. Disclosure.
All-in-one CRM, funnels and automation platform many AI and marketing agencies resell to clients.
Affiliate link pending — currently a normal link. Disclosure.
Price AI services: setup fees, retainers, margins.
Guides and cost benchmarks for hiring an AI agency.