AI in Production X-Ray
Methodology
The X-Ray measures whether a company can put AI into operation and keep it running. That is why it asks what exists today, in concrete evidence, and not how much the company believes in AI.
Scoring rules
- 1.Each answer is worth 1 to 5, according to the situation described in the chosen option.
- 2."I don't know" is worth 1: if no one knows whether something exists, in practice it is not working.
- 3."Not applicable" is excluded from the average and is only accepted on questions where it makes sense.
- 4.Each dimension's score is the average of its answers, including the sector and area questions.
- 5.The overall score is the average of the 8 dimensions, capped at 1 point above the lowest score among Data, Quality and Security.
- 6.The level is the overall score rounded, from 1 to 5.
Why the cap? A company with AI in five areas but without quality testing or reliable data access is not at an advanced level: it is accumulating risk. The cap prevents progress on one front from hiding a missing foundation.
The 8 levels
Business results
Chosen processes with an owner and measured results.
Data and systems
AI can use the information in your systems, with quality and permission.
How solutions are built
How AI solutions are built and organized.
Quality control
Testing before changes, error handling and human review.
Day-to-day monitoring
Logs, cost, alerts and the ability to roll back.
Security
Protecting information and blocking malicious instructions.
Rules and privacy law
Usage rules, list of uses, risks and LGPD compliance.
Team and leadership
Who looks after AI and how leadership takes part.
The 5 levels
Exploration
Individual use of tools, with no process and no company data.
Experiments
Pilots and proofs of concept; data copied by hand; quality not measured.
First in production
At least one AI system in operation, integrated, with an owner and logging.
Managed operations
Several systems in production, with testing, monitoring, cost tracking and a policy.
Scale
AI in critical processes across several areas, with integrated governance and measured results.
References
NIST AI Risk Management Framework
The Governance, Use cases, Quality and Operations dimensions correspond to the Govern, Map, Measure and Manage functions.
ISO/IEC 42001:2023
AI management system: leadership, data, operations and continual improvement appear in People, Data, Operations and Governance.
LGPD and Brazil's AI bill (PL 2338/2023)
Legal basis, impact assessment, human review and risk classification appear in Governance and Security.
The references indicate thematic correspondence. The X-Ray is neither an audit nor a certification.
Limitations
It is a self-assessment: it depends on who answers. Answers from different people at the same company may differ, and that in itself is a finding. The report uses AI to draft the text from the score, never to calculate it.