The AI Governance Phase 0 Assessment was built around a single question: if a disciplinary authority, court, or sophisticated client asked your firm to demonstrate that its AI use is professionally responsible, could you do it?
Most firms cannot. Not because they are using AI irresponsibly, but because they have never been asked to document what responsible use looks like at their firm, so they haven't. The Phase 0 Assessment changes that.
What the Assessment Measures
The Assessment scores a firm's AI governance posture across five domains, each mapped directly to ABA Model Rules:
Confidentiality Controls maps to Rule 1.6. This domain measures whether the firm has reviewed the data handling practices of its AI tools, whether it has established protocols for what client information can be used with AI, and whether those protocols are documented and enforced.
Output Verification maps to Rule 3.3 and Rule 1.1. This domain measures whether the firm has a defined process for reviewing and verifying AI-generated work product before it reaches a client or court, and whether that process is documented and supervised.
Supervision & Accountability maps to Rules 5.1 and 5.3. This domain measures whether the firm has defined who is responsible for AI governance, whether supervision protocols for AI-assisted work are documented, and whether partners have assumed personal accountability for the firm's AI governance posture.
Policy & Documentation maps to Rule 1.1 broadly. This domain measures whether the firm has a written AI use policy, whether that policy is current and distributed, and whether the firm maintains records adequate to demonstrate governance in a disciplinary proceeding.
Tool Approval & Access maps to Rules 1.1 and 1.6. This domain measures whether the firm has a formal process for approving AI tools before use, whether unapproved tool use is prohibited and monitored, and whether tool approvals are documented and periodically reviewed.
How the Defensibility Score Works
Each domain is scored from 1.0 to 5.0. The aggregate Defensibility Score is a weighted average across domains, also on a 1.0 to 5.0 scale.
A score of 1.0–2.0 indicates critical exposure: the firm has no documented governance posture and cannot demonstrate defensible AI use in any of the five areas measured. This is where most firms that have not yet done governance work score.
A score of 2.0–3.0 indicates partial governance: the firm has begun addressing some areas but has significant gaps that create disciplinary exposure.
A score of 3.0–4.0 indicates a functional governance posture: the firm has documented policies and protocols in most areas but has not fully operationalized them or established an audit trail adequate for a disciplinary proceeding.
A score of 4.0–5.0 indicates a mature governance posture: the firm has documented, enforced, and periodically reviewed governance across all five domains and could demonstrate defensible AI use to any relevant authority.
Why Most Firms Score Below 2.0
The 1.3 Defensibility Score shown on the KeaneAdvisors.AI homepage is not a hypothetical. It is representative of actual scores at firms that have gone through the assessment without prior governance work. The specific pattern is consistent: firms typically score highest on Tool Approval (because they've thought about which tools they use) and lowest on Output Verification and Policy & Documentation (because they've never formalized how work product is reviewed or written down what their AI policies are).
What Happens After the Assessment
The Phase 0 Assessment produces two deliverables: a Defensibility Score and a written remediation roadmap. The roadmap is domain-specific — it identifies exactly where the firm's exposure is and what governance work would close each gap.
For firms engaging under the Master Services Agreement, the remediation roadmap becomes the foundation for Phase 1 (Governance Framework Design) and Phase 2 (Controlled Pilot Implementation). For firms completing the assessment independently through the SaaS platform, the roadmap provides the inputs needed to begin governance work internally.
Either way, the assessment is the starting point. Without a scored, documented baseline, there is no defensible governance framework to build — only an assumption that one exists.
Most firms complete it in under two hours. The Defensibility Score and summary report are available immediately on completion.