Yes, and it is a common starting point.
When AI is already live, the assessment focuses on hardening what is running before the next AI feature adds more risk. That typically means checking:
- Data separation. Whether AI can ever see one customer's data while working for another.
- Quality checks. Whether a change to a prompt or model is tested before customers see it.
- Cost tracking. Whether you know what AI costs per customer and per feature.
- Security. Whether your AI is protected against prompt injection and data leaks, with an audit trail a regulator would accept.
