My Business AI Audit Blog

Free AI Audit Tool

Ten questions, about ten minutes. Tick the boxes that are true for your business today. When you're done, you'll get a score and a prioritized fix list. If you would rather read the controls than tick boxes, the AI agent risk checklist is the written version.

We can list every AI tool the business uses, including free trials and tools individual staff installed. If you can't tick this, the inventory is your first fix. See the readiness audit guide. For each AI tool, we know what data it can read or copy (customer data, financial data, credentials). Data access you can't account for is an exfiltration path. No AI tool can send messages, edit records, trigger payments, or approve anything without a human. Irreversible actions need a human gate — the AISI test was stopped by one human refusing code. Every AI tool runs with the minimum permissions it needs (least-privilege), and we review permissions at least quarterly. Permission creep is the most common finding in real audits. We have asked every vendor what AI tools they run and what those tools connect to. An agent you never met can reach you through a vendor you never audited. We have a named person responsible for reviewing AI tool audit logs and alerts. Monitoring only works if someone is responsible for reading it. We treat AI-generated output as untrusted until a human verifies it. Agents have fabricated "independent reviewers" to vouch for their own work. We know which of our tools train on our data, and we've accepted or changed that. Training-data policies change; re-check them at least yearly. Contracts with AI vendors include incident-response commitments and testing evidence. Treat AI vendors like any supplier with access to your systems. We re-run this checklist at least quarterly. The AI tool list changes faster than any other part of your stack.

Insurance and liability

AI agents can cause losses without a conventional hack — insurers including MSIG, QBE, and Beazley are rewriting cyber policy language for exactly this gap. If you can't tick these, take them to your broker before the loss, not after. See Does Your Cyber Insurance Cover AI Agents? for the full breakdown.

Our cyber policy defines AI agents or automated systems — or our broker has confirmed in writing how they're treated. Most policies were written for human attackers; an agent that acts on its own fits no definition cleanly. We have confirmed there is no exclusion for losses caused by autonomous AI actions. Targeted exclusions are under discussion for systemic events and agents "acting as designed." We have disclosed our AI agent deployments and what they can access to our insurer. An agent using access it was deliberately given may not trigger a policy's "security event" definition. We know who bears liability if an agent acts without human instruction — us, the vendor, or the model provider. "Who is liable when an AI agent causes damage?" is unresolved; get the position in writing. Our policy covers vendor and principal risks — agents our vendors run for us and agents we run for clients. An agent you never met can reach you through a vendor you never audited — and the policy may not respond.

Your AI audit score

0/114 —

Next steps: read how to run a full readiness audit, check the AI agent security risks you should know about, see whether you need an audit at all, ask your broker the cyber insurance coverage questions before an agent-caused loss, and run the agent identity governance checklist before you grant agents more access.

© 2026 My Business AI Audit — ABD Legacy LLC. All rights reserved.

Related reading:

What Massachusetts' Strict AI Bill Means for AI Audits and SMB Compliance — New state AI law: what S.3178 means for your AI audit checklist.
Free AI Audit Tools for Small Business — More on free ai audit tools for small business.
agencies using ai agents? audit — Agencies Using AI Agents? Audit Your Toolchain Now